Visa Inc. · NYSE:V
Visa — Technical Presentation (May 2015)
26 slides from Visa's technical presentation, May 27, 2015
Slide 1: Effectively Managing Data Breaches
Effectively Managing Data Breaches May 27, 2015 Stoddard Lambertson – Cyber Intelligence and Investigations Justina Jow – Cyber Intelligence and Investigations
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Introduction • Compromise Event Trends and Segments • Merchant Servicer (POS) Integrator Threats and Best Practices • PCI Qualified Integrators and Resellers (QIR) • Common Point of Purchase Process Flow • Small Merchant Investigations and Common Point of Purchase Process • Large Merchant I
Slide 4: Recent Fraud Trends and Small Merchant Investigations
Recent Fraud Trends and Small Merchant Investigations Stoddard Lambertson Cyber Intelligence and Investigations
Slide 5: Trends in Data Compromises
Trends in Data Compromises Criminals are launching more sophisticated attacks targeting small merchants FREQUENCY MAGNITUDE SOPHISTICATION ORGANIZATION 5 Effectively Managing Data Breaches – May 27, 2015 Visa Public
Slide 6: Visa Inc. CAMS Compromise Events – Entity Type by Month
Visa Inc. CAMS Compromise Events – Entity Type by Month Se 3 Se 4 13 M 4 5 13 14 A 3 A 4 Ju 3 D 3 Ju 4 D 4 Fe 4 Fe 5 M 4 M 5 A 4 5 O 3 Ja 3 O 4 Ja 4 N 3 N 4 -1 -1 -1 -1 l-1 l-1 -1 -1 1 1 1 1 -1 -1 1 -1 1 -1 -1 -1 -1 -1 - n- n- n- n- b- b- p- p- ug ug pr pr pr ay ay ov ov ar ar ct ct ec ec Ju Ju A A
Slide 7: Visa Inc. CAMS Compromise Events: Top Market Segment
Visa Inc. CAMS Compromise Events Top Market Segment* (MCC) • Restaurants and retailers are leading market segments in the first quarter of 2015 • Integrators and resellers implementing insecure remote access and poor credential management are targeted by hackers RESTAURANTS OTHER RETAIL QSR'S B2B SU
Slide 8: Recent Threats due to Merchant Servicers
Recent Threats due to Merchant Servicers • POS Integrators/Resellers may provide merchant POS software installation and ongoing enterprise support for your POS system • Merchant setup may include Remote Access Services (RAS) for monitoring and software support etc. • Use of remote management product
Slide 9: PCI Qualified Integrators and Resellers (QIR)
PCI Qualified Integrators and Resellers (QIR) • QIRs receive training and qualification on the secure installation of PA-DSS validated payment applications into merchant environments in a manner that supports PCI DSS compliance • Demand that your POS Integrator be qualified and listed by the PCI SSC
Slide 10: PCI Approved QIR Companies
PCI Approved QIR Companies Ask your Integrator/Reseller to become trained and qualified to be listed as a QIR Currently the following entities are PCI Approved QIR Companies: • Amano McGann, Inc. • eMazzanti Technologies • Fujitsu Services Limited • Reliant Info Security Inc. • Traffic & Safety Cont
Slide 11: Visa Recommends Using PCI SSC Qualified Integrators and Resellers
Visa Recommends Using PCI SSC Qualified Integrators and Resellers In support of the PCI SSC Qualified Integrators and Resellers Program, Visa is expanding the definition of a Merchant Servicer to be “an entity that stores, processes, transmits or has access to Visa account numbers on behalf of a cli
Slide 12: Cyber Intelligence & Investigations - Small Merchant Investigations
Cyber Intelligence & Investigations - Small Merchant Investigations Most reported CPPs result in the detection of a small merchant (Level 4) breach • A Common Point of Purchase (CPP) is determined when issuing clients identify a subset of accounts with legitimate cardholder usage, containing a singl
Slide 13: Common Point of Purchase Process Flow
Common Point of Purchase Process Flow Goal is to Contain compromises quickly and Mitigate Issuer losses by sending at-risk accounts via Proactive Comprised Account Management System (CAMS) alerts Visa Small Merchant Investigations Receive Visa validates Fraud Incident Visa sends CPP Visa sends At- S
Slide 14: Small Merchant Security Safeguards
Small Merchant Security Safeguards 1. 2. 3. 4. 5. Change Install Enable Remote Use only PCI Use only Default Antivirus Access Only Approved Registered Passwords When Needed QIRs Agents Ease of Easy Medium Easy Easy Easy Implementation Cost None Medium None None None Effectiveness Medium Medium High
Slide 15: Large Merchant Investigations
Large Merchant Investigations Justina Jow Cyber Intelligence and Investigations
Slide 16: Prevention and Detection Strategies
Prevention and Detection Strategies Communication Incident PCI Response Compliance Organization Readiness Remain vigilant and be prepared!!! Fraudsters target the weakest link and can evolve quickly 16 Effectively Managing Data Breaches – May 27, 2015 Visa Public
Slide 17: What To Do Before You Are Compromised
What To Do Before You Are Compromised* Review and understand the fraud investigation procedures: What To Do If Compromised • Located on the Protect Your Business section under Merchants on Visa.com • http://usa.visa.com/download/merchants/cisp-what-to-do-if-compromised.pdf Actively review Alerts, Bu
Slide 18: What To Do Before You Are Compromised (cont.)
What To Do Before You Are Compromised* (cont.) Designate and empower an internal breach response team • Educate employees on indicators of compromise and how to respond • Create mock exercise to test and refine procedures • Develop breach response communications Identify and establish relationships
Slide 19: What To Do If Compromised
What To Do If Compromised* Indicators of a Data Breach • Visa notification of Common Point of Purchase (CPP) identification • Customer complaints of fraudulent activity on payment cards • Law enforcement notification • Bank reports of fraud after legitimate use • Abnormal activity/behavior of Point
Slide 20: What To Do If Compromised (cont.)
What To Do If Compromised* (cont.) Notification • Immediately report suspected or confirmed unauthorized access or data exposure to the Visa Risk group Visa Cyber Intelligence & Investigations usfraudcontrol@visa.com or 650-432-2978, option 4 Evidence preservation (page 7 from WTDIC) • Do not access
Slide 21: Merchant Responsibilities
Merchant Responsibilities* Notification • Alert your acquiring bank immediately • Notify your QIR (Third Party Integrator) Initial Containment • Immediately contain and limit the data exposure and minimize data loss Preservation • Preserve evidence and facilitate the investigation Forensic engagemen
Slide 22: Acquirer Responsibilities
Acquirer Responsibilities Notification • Report any suspected breach to Visa immediately Coordinate the investigation until its completion • Organize conference calls with merchant / acquirer / Visa • Provide ongoing updates Forensic engagement (work with the merchant to obtain an approved PCI Foren
Slide 23: Implement Secure Technology
Implement Secure Technology Benefits of EMV and Upcoming Liability Shift Benefits of Implementing Secure Technology Implement EMV Chip Terminals • Reduce your liability from counterfeit fraud •EMV chip or “smart” cards are credit, debit or prepaid cards that have an • Reduce risk to the Payment Syst
Slide 24: Visa is hosting a must-attend event on cyber security and payments
Visa is hosting a must-attend event that will focus on trends and developments related to cyber security, mobile payments, e-commerce and Visa’s global authentication strategy. In order to secure the future of commerce all stakeholders including merchants, acquirers, agents and Visa need to collabor
Slide 25: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Under Merchant Resources/Training on www.visa.com • Minimizing Payment Risks for Merchants Using Integrators / Resellers • 17 June 2015, 10 am PST Visa Launches EMV Chip Education Tour for Small Businesses • 20-City Tour for Small Businesses – www.Vi
Slide 26: Questions?
Questions? VISA