Visa Inc. · NYSE:V
Visa — Technical Presentation (October 2015)
18 slides from Visa's technical presentation, Oct 21, 2015
Slide 1: Data Breach Findings and Mitigation Actions for the Payment System
Data Breach Findings and Mitigation Actions for the Payment System 21 October 2015 Glen Jones Lester Chan Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Introduction • Global Payment Compromises • Cyber Attack Kill Chain • Profile of Large & Small Breaches • Wishful Thinking Security • Breach Findings & Security Controls Deep Dive • Secure Technology to Devalue Data • Key Takeaways • Questions and Answers 3 | Data Breach Findings and Mitiga
Slide 4: Payment Card Compromises and Lessons Learned
Payment Card Compromises and Lessons Learned Glen Jones, Sr. Director Cyber Intelligence Visa Public
Slide 5: Global Data Compromises: US payment continues to be most at-risk
Global Data Compromises US payment continues to be most at-risk 2011-2015 Compromise Cases by Region • Global data compromise events are slightly higher in Percentage of compromises 2015 over those managed in 2014 CEMEA • The U.S. is the largest contributor, mainly due to its AP large mag stripe inf
Slide 6: Breach trends by merchant level
Global Data Compromises Breach trends by merchant level Breach events by merchant level Large breach events (levels 1 & 2) Entity Type 2012 2013 2014 2015* % % % % Merchant / Entity size Level 1 <1% 1% 1% <1% Level 2 <1% 1% 1% <1% Level 3 1% 4% 4% 4% Level 4 95% 92% 93% 93% Agent <1% 1% 1% 2% Other
Slide 7: Cyber Attack Kill Chain
Cyber Attack Kill Chain Elements of the attack / opportunities for prevention and detection 1 2 3 4 5 6 7 Reconnaissance – Weaponization – Delivery – Exploitation – Installation – Command & Action – commit harvesting emails, exploit weaponize exploiting a malware on Control – remotely harvesting and
Slide 8: Profile of Large U.S. Merchant Breaches
Profile of Large U.S. Merchant Breaches Large merchant breach root causes • Had privileged • Had weak • Had weak anti- • Most had • Had a weak accounts application malware completed PCI audit function compromised security testing detection on DSS validation • Had sysadmin • Had inadequate POS system
Slide 9: Profile of Small (Level 4) U.S. Merchant Breaches
Profile of Small (Level 4) U.S. Merchant Breaches What do breached small merchants have in common? • Third-party • Few host, user, • Did not have • None had • Common / remote access network security application completed PCI shared for POS controls white-listing DSS validation username & management
Slide 10: Wishful Thinking vs. Effective Security Controls
Wishful Thinking vs. Effective Security Controls Perceived Security Security Controls • A plan to implement security • Implemented security • A firewall (ANY/ANY ALLOW) • A firewall that blocks traffic • Separate networks with two-way trusts • Truly segmented cardholder data environment • Intrusion
Slide 11: Breach Findings & Security Controls
Breach Findings & Security Controls Lester Chan, Director, Merchant Security Visa Public
Slide 12: Breaches Continue to Occur
Breaches Continue to Occur Hackers and fraudsters target specific industries and victims Small Businesses Integrators & Resellers Hospitality Industry • Hotels and restaurants • Continue to be targeted • Targeted by hackers continue to be targeted fraudsters • Improper implementation • Typically, ba
Slide 13: Breach Findings to Security Controls
Breach Findings to Security Controls Mapping vulnerabilities to PCI DSS requirements Remote Network Elevated Weak IT Internet Access Segmentation Privileges Audit Egress/Ingress Breach Findings 8.1.5 - Manage IDs Strongly 7.1 Limit access to 10.1 Implement 1.3 Prohibit direct public PCI DSS used by
Slide 14: Fraud Migration to Other Channels
Fraud Migration to Other Channels Fraud will migrate to e-commerce, automated fuel dispensers, and ATMs • Fraud and attacks will continue in card not • Scan for vulnerabilities present/e-commerce channels • Be aware of OWASP Top 10 • Insecure websites and mis-configured security • Properly scope all
Slide 15: Implement Secure Technology
Implement Secure Technology Benefits of secure technology Implement EMV Chip Terminals Benefits of Implementing Secure Technology • EMV chip or “smart” cards are credit, debit or prepaid cards that have an • Reduce your liability from counterfeit embedded microchip fraud • Microchip generates a dyna
Slide 16: Key Takeaways
Key Takeaways • Breaches continue to occur with fraud and attacks to migrate • Scrutiny between controls documented in ROC and PFI report • Control effectiveness is as important as the control itself • Additional analysis on security controls: – Remote access – Network segmentation – Elevated privil
Slide 17: Upcoming Events and Resources
Upcoming Events and Resources Visa Data Security Website – www.visa.com/cisp • Alerts, Bulletins • Best Practices, White Papers • Webinars PCI Security Standards Council Website – www.pcissc.org • Data Security Standards – PCI DSS, PA-DSS, PTS • Programs – ASV, ISA, PA-QSA, PFI, PTS, QSA, QIR, PCIP,
Slide 18: Questions?
Questions? Visa Public