Visa Inc. · NYSE:V
Visa — Technical Presentation (April 2015)
22 slides from Visa's technical presentation, Apr 29, 2015
Slide 1: Identifying and Mitigating Threats to E-commerce Payment Processing
Identifying and Mitigating Threats to E-commerce Payment Processing Erik Rasmussen Director, NA Cyber Security Intelligence Visa Inc. 29 April 2015 Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Payment System Risk • E-commerce Threat • OWASP • Case Studies • What To Do If Compromised • Visa Resources 3 | Identifying and Mitigating Threats to E-commerce Payment Processing | 29 April 2015 Visa Public
Slide 4: Visa Payment System Risk (PSR)
Visa Payment System Risk (PSR) • Risk Organizational Structure • Mission: – Maintain and enhance stakeholder trust in Visa as the most secure way to pay and be paid. • PSR manages this by partnering with clients and stakeholders that play a role in the Visa transaction network Acquirers Issuers Thir
Slide 5: Visa Payment System Risk (PSR)
Visa Payment System Risk (PSR) • Cyber Intelligence, Investigations and Fraud Resolution • Mission: – Investigate, document and manage external account data compromise incidents, fraud attempts utilizing Visa accounts or other fraudulent schemes that impact the Visa network or its clients – Identify
Slide 6: Merchant Data Compromises
Merchant Data Compromises Typical data breach & counterfeit cycle Entry Card Data Theft Monetization • Hackers targeting internet- • Payment card data is extracted with • Payment data is used to commit exposed remote access systems as specialized, difficult to detect fraud, often across countries vi
Slide 7: Techniques
Techniques Graphic Courtesy of Trend Micro 7 | Identifying and Mitigating Threats to E-commerce Payment Processing | 29 April 2015 Visa Public
Slide 8: E-Commerce Payment Flow
E-Commerce Payment Flow Web Browser Company Server(s) Acquirer/Processor 8 | Identifying and Mitigating Threats to E-commerce Payment Processing | 29 April 2015 Visa Public
Slide 9: E-commerce Threat Overview
E-commerce Threat Overview • Old school vs. new school – Strategic web compromise vs. opportunistic web app attacks – 50.7% of all documented web app attacks occurred through the use of stolen credentials (source: 2015 Verizon DBIR) – Contradicts Open Web Application Security Project (OWASP) (more o
Slide 10: E-commerce Threat
E-commerce Threat <&> naw i am making all the…on [hacking website] go and audit…ecommerece software because i am selling the sqli in the site <&> you wont be able to find this sqli from auditing the source even if you knew what ecommerence software this was <&> i bet some kids try to extort me for t
Slide 11: Milw0rm screenshot. Site no longer active.
Milw0rm screenshot. Site no longer active. 11 | Identifying and Mitigating Threats to E-commerce Payment Processing | 29 April 2015 Visa Public
Slide 12: Open Web Application Security Project (OWASP)
Open Web Application Security Project (OWASP) • www.owasp.org • Non-profit designed to improve web application security • OWASP Top Ten Web Application Security Risks – A description Note: Visa does not officially endorse OWASP. – Example vulnerabilities Use of the information in these slides is to
Slide 13: OWASP Top 10 - 2013
OWASP Top 10 - 2013 Attack Type • A1 Injection • A6 Sensitive Data Exposure • A2 Broken Authentication and • A7 Missing Function Level Session Management Access Control • A3 Cross-Site Scripting (XSS) • A8 Cross-Site Request Forgery • A4 Insecure Direct Object (CSRF) References • A9 Using Components
Slide 14: Case Studies
Case Studies Threat Agents Containment / Mitigation • Remote administrative shells • Delete malware from all systems installed • Firewall rules set to block malicious • Hidden IFRAME vulns IP addresses • Malicious Javascript • Install Web Application Firewall • Adminer (tool for malice) • Install Fi
Slide 15: Known Indicators of Compromise
Known Indicators of Compromise Type (MD5) Purpose • D9A47A70E5326C7C590580ADEA9B882F • Captures HTTP post data, e.g. payment card numbers • 2E13630F8660C36260643D3905F0EDD5 • Captures HTTP post data, e.g. payment card numbers • 1EC7F06F1EE4FA7CECD17244EEC24E07 • PHP shell allows attacker add/edit/de
Slide 16: Known Indicators of Compromise, Continued
Known Indicators of Compromise, Continued 123.45.67.89 - - [31/Jul/2014:06:31:07 -0400] "POST /phpminiadmin.php HTTP/1.1" 200 9542 "http://acmewidgets.com/phpminiadmin.php?XSS=e9d08cdc8550577C&db=acmewidgets_1_12&q=select+*+from+%60admin_user%6 0" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/
Slide 17: General Tips and Tricks
General Tips and Tricks Cause Effect • Track user behavior • Allows for anomalous trends tracking • Two factor authentication • Reduces risk of credentials compromise • Disable autocomplete for fields • Prevents data leakage where sensitive data is provided • Encrypt, encrypt, encrypt [front end • A
Slide 18: What To Do If Compromised
What To Do If Compromised Action Assisting Party • Preserve evidence and facilitate the • Merchant, merchant bank, investigation (throughout) forensics firm, card brands, law enforcement • Alert all necessary parties immediately • Merchant bank, forensics firm, card • Provide Visa with at risk accou
Slide 19: What To Do If Compromised, Part II
What To Do If Compromised, Part II Large Merchants Small Merchants • Self-reported data security breach • Small merchant with annual Visa affecting payment cards transaction volume > 201K – 1M • Suspected data breach: multiple – Combination of onsite and alternative forensic investigation Common Poi
Slide 20: Visa-hosted event on cyber security and e-commerce
Visa is hosting a must-attend event that will focus on trends and developments related to cyber security, mobile payments, e-commerce and Visa’s global authentication strategy. In order to secure the future of commerce all stakeholders including merchants, acquirers, agents and Visa need to collabor
Slide 21: Upcoming Merchant Events and Resources
Upcoming Merchant Events and Resources Upcoming Webinars – Training page on www.visa.com/cisp • Strategies to Effectively Manage Data Compromise Events ‒ 27 May 2015, 10 am PST Visa Data Security Website – www.visa.com/cisp • “What To Do If Compromised” Guidelines • Alerts, Bulletins • Best Practice
Slide 22: Thank you
Thank you VISA Visa Public