Visa Inc. · NYSE:V
Visa — Conference Presentation (October 2015)
23 slides from Visa's conference presentation, Oct 28, 2015
Slide 1: Data Security Basics for Small Merchants
Data Security Basics for Small Merchants 28 October 2015 Stan Hui – Director, Merchant Risk Lester Chan – Director, Merchant Risk Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Compromises and Small Businesses • Impacted Industries and Merchants • The PCI Data Security Standard • All Stakeholders Have A Role • Small Business Challenges and Security Basics • Utilizing Secure Technologies and Service Providers • Key Takeaways • Resources 3 | Data Security Basics for
Slide 4: Global Data Compromise Landscape and PCI Data Security Standard
Global Data Compromise Landscape and PCI Data Security Standard Stan Hui – Director, Merchant Risk Visa Public
Slide 5: Global Data Compromises
Global Data Compromises Compromise Cases by Region • The U.S. is the largest contributor, mainly due to its large mag stripe infrastructure and an increase in successful attacks on third party service providers • Payment ecosystem attackers continue to target POS integrators via third-party IT suppo
Slide 6: Global Data Compromises: Breach trends by merchant level and MCC
Global Data Compromises Breach trends by merchant level and Merchant Category Code Breach Events by Merchant Level Percent of Breach Events by MCC Entity Type 2012 2013 2014 2015* % % % % Level 1 <1% 1% 1% <1% Merchant Level 2 <1% 1% 1% <1% Level 3 1% 4% 4% 4% Level 4 95% 92% 93% 93% Agent <1% 1% 1%
Slide 7: Who Are The Targets?
Who Are The Targets? Hackers and fraudsters target specific industries and victims Small Businesses Integrators & Resellers Hospitality Industry • Frequently targeted by hackers • Increased focus on hotels and • Large population (~5MM+) restaurants • Low/no security controls • Improper Point-of-Sale
Slide 8: PCI Security Standards Council (PCI DSS)
PCI Security Standards Council (PCI DSS) • Industry-wide standards group founded in 2006 – Visa, American Express, Discover, JCB and MasterCard • Responsible for development and management of PCI Security Standards ‒ PCI DSS, PA-DSS, P2PE and PTS • Trains and certifies data security companies and pe
Slide 9: Roles and Responsibilities
Roles and Responsibilities • PCI Security Standards Council ‒ Manages and maintains the standards and validation tools ‒ Answers questions regarding the intent of the standards • Visa – Works with banks to ensure merchants and service providers protect cardholder data in accordance to the PCI DSS –
Slide 10: Merchant Classification and Validation
Merchant Classification and Validation • Visa has prioritized and defined levels of compliance validation based on the volume of transactions, the potential risk, and exposure introduced into the payment system by merchants and service providers. ‒ Merchant classification process should account for
Slide 11: Compliance vs. Validation
Compliance vs. Validation • Compliance is required of all entities that store, process, or transmit Visa cardholder data, including financial institutions, merchants and service providers ‒ PCI DSS compliance applies to all payment channels, including retail (brick-and-mortar), mail/telephone order,
Slide 12: Small Business Challenges with PCI DSS and Security Basics
Small Business Challenges with PCI DSS and Security Basics Lester Chan – Director, Merchant Risk Visa Public
Slide 13: Top Concerns by Small Business Owners
Top Concerns by Small Business Owners According to State of Small Business Report* Growing Revenue Government Regulations Hiring New Employees Cash Flow * 2015 State of Small Business Report 13 | Data Security Basics for Small Merchants | 28 October 2015 Visa Public
Slide 14: Small Businesses Challenges with PCI DSS
Small Businesses Challenges with PCI DSS Challenges with understanding PCI DSS • Long and complicated • Lack of resources • Needs to be easy to • Unsure which requirements • Time understand are applicable • People • Simple and concise • Budget • Understand the purpose and • Too much technical jargon
Slide 15: Importance of PCI DSS for Small Businesses
Importance of PCI DSS for Small Businesses Impacts and costs of a data breach* • Cost of forensic analysis and report - $20,000 - $50,000 • Notification to customers can be thousands of dollars • Credit monitoring and counseling services to impacted customers • Fines and assessments by Payment Card
Slide 16: Small Merchant Security Basics
Small Merchant Security Basics Effective, cost efficient and easy to implement 1 2 3 4 5 Change Default Update system Use only PCI Conduct Disable always- training and Passwords/Use on remote access and application approved qualified Strong Passwords patches integrators/resellers awareness for emplo
Slide 17: Data Security Next Steps
Data Security Next Steps Beyond basics Install, configure, Implement two- Segment cardholder Install and update and maintain a factor authentication data environment anti-virus firewall for remote access Install file integrity Control access to monitoring payment card data 17 | Data Security Basics
Slide 18: Implement Secure Technology
Implement Secure Technology EMV Chip Terminals Liability Shift • EMV chip have an embedded microchip • Effective October 1, 2015, counterfeit liability • Generates a dynamic one-time use code (a shift instituted in the U.S for POS transactions. cryptogram) • The party that is the cause of a chip tra
Slide 19: Small Merchant Data Security Incentives
Small Merchant Data Security Incentives • In May 2014, introduced incentive program in high risk markets to increase use of more secure acceptance solutions by small merchants* – Acquirers granted Safe Harbor from fines in the event its merchants experience a data compromise – To attain safe harbor,
Slide 20: PCI SSC Qualified Integrators and Resellers (QIR) Program
PCI SSC Qualified Integrators and Resellers (QIR) Program Program Overview • The QIR Program provides payment application developers, integrators and resellers with the training to help merchants and industry participants install and configure validated PA-DSS payment applications in a manner that e
Slide 21: Why Use a QIR?
Why Use a QIR? Visa Recommends • Only using the QIRs listed on the PCI SSC QIR website to ensure a merchant’s PCI DSS compliance status is not jeopardized • Help protect your organization and improve security • Simplify the vendor selection process 21 | Data Security Basics for Small Merchants | 28
Slide 22: Key Takeaways
Key Takeaways • Merchant breaches continue to occur • Small businesses, integrators / resellers and hospitality continue to be targets • Understand the risks to your business, threats, and how data can be fraudulently stolen • Implement easy, low-cost, effective security basic controls • De-value pa
Slide 23: Resources
Resources Visa Data Security Website – www.visa.com/cisp • Alerts, Bulletins • Best Practices, White Papers • Webinars PCI Security Standards Council Website – www.pcissc.org • Data Security Standards – PCI DSS, PA-DSS, P2PE, and PTS • Programs – QSA, ASV, PA-QSA, PFI, ISA, PCIP, and QIR • Fact Shee