Slide 1: Minimizing Payment Risks for Merchants Using Integrators/Resellers
Minimizing Payment Risks for Merchants Using Integrators/Resellers Webinar 17 June 2015 Stoddard Lambertson – Cyber Intelligence and Investigations Mamie Lee – Third Party and Processor Risk Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Data Breach Landscape for Small Merchants and Integrators • Organized campaigns attacking remote access vulnerabilities • Small Merchant Safeguards and Mitigation • Merchant Agents and POS Integrators • Questions and Answers 3 | Minimizing Payment Risks for Merchants Using Integrators | Jun
Slide 4: The Data Compromise Landscape for Small Merchants and their Integrators / Resellers
The Data Compromise Landscape for Small Merchants and their Integrators / Resellers Stoddard Lambertson 4 | Minimizing Payment Risks for Merchants Using Integrators | June 17, 2015 Visa Public
Slide 5: Merchant Data Compromises
Merchant Data Compromises Typical data breach and counterfeit cycle Entry Card data theft Monetization • Hackers targeting internet-exposed • Payment card data is extracted with • Payment data is used to commit fraud, remote access systems as initial specialized, difficult to detect malware often ac
Slide 6: Current Compromise Landscape
Current Compromise Landscape Remote access services used by small brick-and-mortar merchants • POS integrators / Resellers and Level 4 brick-and-mortar merchants were the most common victims of payment card data theft over the last 18 months • Concerted criminal effort to target the smallest compani
Slide 7: Visa Inc. CAMS Compromise Events
Visa Inc. CAMS Compromise Events Top Market Segment* (MCC) • Restaurants and retailers are leading market segments in the first quarter of 2015 • Integrators and resellers implementing insecure remote access and poor credential management are targeted by hackers RESTAURANTS OTHER RETAIL QSR'S B2B SU
Slide 8: Visa Security Alert – Integrators Under Attack
Visa Security Alert – Integrators Under Attack www.visa.com/cisp Visa Security Alert also published by the U.S. Secret Service 8 | Minimizing Payment Risks for Merchants Using Integrators | June 17, 2015 Visa Public
Slide 9: Organized Campaigns Attacking Remote Access
Organized Campaigns Attacking Remote Access POS Integrators / Resellers are the target • Recent account data compromise events have been traced back to spoofed LogMeIn phishing emails which then leads to the compromise of user credentials at the POS integrator The emails often contains either a mali
Slide 10: Organized Campaigns Attacking Remote Access
Organized Campaigns Attacking Remote Access POS Integrators / Resellers are the target • Once the credentials are stolen, the attacker traverses the POS integrator network to access to the integrator’s merchant customer base, thus infecting merchant POS systems with “RAM scraping” malware designed t
Slide 11: FindPOS Malware
FindPOS Malware Common family of Malware • The most common family of POS malware attached to these phishing attacks is called by several names, including “FindPOS” • Two sites that explain the behavior of this malware are: 1. http://researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos- malwar
Slide 12: PCI Data Security Standard – Remote Access
PCI Data Security Standard – Remote Access Requirement 8: Identify and authenticate access to system components • Merchants must understand their part to protect their business and customer cardholder data • Ensure your Integrator / Reseller is an approved PCI QIR and work with them to ensure your r
Slide 13: Remote Access Vulnerabilities
Remote Access Vulnerabilities Remote access vulnerabilities that are enabling attackers to gain access to merchant POS environment • Remote access services always on and available on the Internet - An attacker only needs to perform a port scan against a merchant's IP address space to identify potent
Slide 14: Mitigation
Mitigation Security Practices to Help Mitigate this Threat • Always use two-factor authentication for remote access - Two factor authentication can be something you have (a device) as well as something you know (a password) • Ensure proper firewalls rules are in place, only allowing remote access fr
Slide 15: Examples of Small Merchant Security Safeguards
Examples of Small Merchant Security Safeguards Protect your business and take these steps 1 2 3 4 5 Only enable Only Enable Use only PCI Use only Change remote access Remote Approved QIRs Default Visa with 2 factor Access When Listed Passwords authentication Needed QIRs Ease of Easy Easy Easy Easy E
Slide 16: Implement Secure Technology
Implement Secure Technology • Benefits of EMV Chip and Upcoming Liability Shift Implement EMV Chip Terminals Liability Shift •EMV chip or “smart” cards are credit, debit or prepaid cards that have an • Effective October 1, 2015, counterfeit liability shift will be instituted in the U.S for embedded
Slide 17: Merchant Agents and POS Integrators
Merchant Agents and POS Integrators Mamie Lee 17 | Minimizing Payment Risks for Merchants Using Integrators | June 17, 2015 Visa Public
Slide 18: Payment Card Industry Security Standards Council
Payment Card Industry Security Standards Council Qualified Integrators and Resellers (QIR) Program Program Overview • The QIR Program provides payment application developers, integrators and resellers with the training to help merchants and industry participants install and configure validated PA-DS
Slide 19: Why Use a QIR?
Why Use a QIR? Visa Recommends • Only using the QIRs listed on the PCI SSC QIR website to ensure a merchant’s PCI DSS compliance status is not jeopardized • Help protect your organization and improve security • Simplify the vendor selection process 19 | Minimizing Payment Risks for Merchants Using I
Slide 20: PCI SSC Approved QIR Companies
PCI SSC Approved QIR Companies • Ask your Integrator/Reseller to become trained and qualified to be listed as a QIR • Currently, the following entities are PCI Approved QIR Companies: 1. Amano McGann, Inc. 2. eMazzanti Technologies 3. Fujitsu Services Limited 4. Reliant Info Security Inc. 5. Traffic
Slide 21: Merchant Agents
Merchant Agents POS integrators are merchant agents • A Merchant Servicer (MS) agent stores, processes, transmits, or has access to Visa account numbers on behalf of the client’s merchants. The MS may have a contract with the merchant but not with the client (the merchant’s acquiring bank). Registra
Slide 22: Visa Global Registry of Service Providers
Visa Global Registry of Service Providers • The Visa Global Registry of Service Providers includes 3,400 entities who have met industry security and Visa program requirements. • To support the PCI SSC QIR Program, Visa is expanding the definition of a merchant servicer to be “an entity that stores,
Slide 23: Visa Global Registry of Service Providers
Visa Global Registry of Service Providers First QIR Listed on both the PCI QIR and Visa Global Registry Traffic & Safety Control Systems, Inc. 23 | Minimizing Payment Risks for Merchants Using Integrators | June 17, 2015 Visa Public
Slide 24: Visa Data Security Bulletin
Visa Data Security Bulletin – www.visa.com/cisp Visa Recommends Using PCI SSC Qualified Integrators and Resellers 24 | Minimizing Payment Risks for Merchants Using Integrators | June 17, 2015 Visa Public
Slide 25: Visa security event invitation
Visa is hosting a must-attend event that will focus on trends and developments related to cyber security, mobile payments, e-commerce and Visa’s global authentication strategy. In order to secure the future of commerce all stakeholders including merchants, acquirers, agents and Visa need to collabor
Slide 26: Upcoming Security Events and Resources
Upcoming Security Events and Resources Upcoming Webinars – Under Merchant Resources/Training on www.visa.com Visa Launches EMV Chip Education Tour for Small Businesses • 20-City Tour for Small Businesses – www.VisaChip.com Visa Merchant Tool Kit provides helpful information to make a seamless EMV tr
Slide 27: Resources For Managing Third Party Agents
Resources For Managing Third Party Agents Merchant Servicer Self-Identification Program – https://mssip.visa.com/ • Self-identify to Visa as a merchant agent • Complete the PCI SSC QIR program PCI SSC Approved Qualified Integrators and Resellers – https://www.pcisecuritystandards.org/approved_compan
Slide 28: What To Do Before You Are Compromised
What To Do Before You Are Compromised* Review and understand the fraud investigation procedures: What To Do If Compromised • Located on the Protect Your Business section under Merchants on Visa.com • http://usa.visa.com/download/merchants/cisp-what-to-do-if-compromised.pdf Actively review Alerts, Bu
Slide 29: Questions
Questions 29 | Minimizing Payment Risks for Merchants Using Integrators | June 17, 2015 Visa Public