Visa Inc. · NYSE:V
Visa — Visa Data Security Webinar Series: Restaurant Webinar (December 2006)
38 slides from Visa's conference presentation, Dec 12, 2006
Slide 1: Keep Data Security on the Menu
Keep Data Security on the Menu Martin Elliott Enterprise Risk and Compliance December 12, 2006
Slide 2: Data Security Webinar Series Overview
Enterprise Risk and Compliance Data Security Webinar Series Overview • Encourage greater adoption of and adherence to Payment Card Industry Data Security Standards (“PCI DSS”) • Promote security awareness • Use frontline information – As new developments occur, take lessons learned and provide to st
Slide 3: Agenda
Agenda • Payment cards and the restaurant industry • What are hackers after? • Overview of threats to the restaurant industry: − Network security − Remote management risks − Host security − SQL injection • Payment Application Best Practices • Additional resources • Questions? Restaurant Webinar Pres
Slide 4: Payment Card Value to Restaurants
Payment Cards and the Restaurant Industry Payment Card Value to Restaurants Accepting Payment Cards can Deliver Many Benefits to your Business • Provides customers a fast, efficient way to pay • Improves cash management • Reduces costs associated with handling cash and checks • Visa study of 100,000
Slide 5: Security: A Customer Point of View
Payment Cards and the Restaurant Industry Security: A Customer Point of View • Cardholder awareness of security issues at record high levels • Concerns permeate all facets of their financial life and could impact their spending • Maintaining consumer confidence in electronic payments is mutually ben
Slide 6: Why Should Restaurant Merchants be Concerned?
Payment cards and the Restaurant Industry Why Should Restaurant Merchants be Concerned? • Approximately 40% of known compromises this year involved a restaurant • 53% of Visa’s current compromise investigations involve a restaurant • Nearly all compromises involved full magnetic stripe data • You ma
Slide 7: What are Hackers After?
VISA What are Hackers After?
Slide 8: Security Environment
Security Environment Hackers are attacking: • Brick-and-mortar merchants • E-commerce merchants • Processors and Agents Hackers are looking for: • Software that stores sensitive cardholder data • Personal information to perpetrate identity theft • Track data and payment account numbers Restaurant We
Slide 9: What the Data Criminals are After
What the Data Criminals are After Important, sensitive information is stored on the card’s magnetic stripe. *NOTE: The merchant or its agent must NOT retain or store magnetic-stripe data subsequent to authorization of a transaction If this information is stored and compromised, it can enable crimina
Slide 10: Threat Environment
Threat Environment Common Vulnerabilities and Mitigation Activities System Vulnerabilities • Network security • Remote management risks • Host security • SQL injection Restaurant Webinar Presentation 12/12/2006
Slide 11: Network Security
Network Security Ingrid Beierly Investigations and Fraud Management December 12, 2006
Slide 12: Network Security: Background / History
Network Security Part 1: Background / History • A network is the primary means for transmitting information between devices • In today’s environment, devices most commonly communicate via TCP/IP (Transmissions Control Protocol & Internet Protocol) • TCP/IP allows open communication and transmission
Slide 13: Network Security: Known Issues
Network Security Part 2: Known Issues • Hackers abuse network connectivity to attack POS systems • Some examples of network attacks are: – Distributed Denial of Service (DDOS) – Unauthorized access – Viruses, worms and Trojan Horses Restaurant Webinar Presentation 12/12/2006
Slide 14: Network Security: Typical Merchant Environment
Network Security Part 3: Typical Merchant Environment POS Environment Restaurant Webinar Presentation 12/12/2006
Slide 15: Network Security: PCI DSS Requirements
Network Security Part 4: PCI DSS Requirements • Implement a firewall to protect external and internal access – Never use default settings and/or passwords • Implement rules on the firewall to only allow ports/services necessary for business purposes. This applies to both inbound and outbound traffic
Slide 16: Remote Management Risks
Remote Management Risks Petr Darius Emerging Risk December 12, 2006
Slide 17: Remote Management: Overview
Remote Management Part 1: Overview • Remote management (“RM”) products have been introduced into the marketplace as part of the POS architecture • RM products simplify maintenance • RM products provide time and cost efficiency for the maintenance process – Menu updates – Troubleshooting / system mai
Slide 18: Remote Management: Typical POS Environment
Remote Management Part 2: Typical POS Environment ab c d POS Environment abcd Restaurant Webinar Presentation 12/12/2006
Slide 19: Remote Management: PCI DSS Requirements and Recommendations
Remote Management Part 3: PCI DSS Requirements and Recommendations • Upgrade to the latest version of the remote management product or service. Ensure the latest security patches are applied prior to full deployment • If the remote connection is via dial-up, configure the modem/software to provide d
Slide 20: Remote Management: Requirements (continued)
Remote Management Part 3: PCI DSS Requirements and Recommendations (continued) • Enable data encryption within the remote management system • Use strong passwords for all types of system access – Never use default settings and/or passwords • Enable logging built into remote management product • Esta
Slide 21: Host Security
Host Security Ingrid Beierly Investigations and Fraud Management December 12, 2006
Slide 22: Host Security: Overview
Host Security Part 1: Overview • A host is a system that provides payment processing functionality within the POS network • The host must be properly configured, patched and segmented from other devices on the network • In the event of a network compromise, the host can be attacked and compromised •
Slide 23: Host Security: PCI DSS Requirements and Recommendations
Host Security Part 2: PCI DSS Requirements and Recommendations • Remove full magnetic stripe data from the host • “If you don’t need it, don’t store it” • Use only PABP-compliant POS applications – List of compliant applications: www.visa.com/cisp • Ensure latest security patches, anti-virus engines
Slide 24: Host Security: Requirements (continued)
Host Security Part 2: PCI DSS Requirements and Recommendations (continued) • Use latest version of operating systems and applications – Consult with product manufacturer’s website or technical support for ways to secure operating systems and applications • POS host should only be used for payment da
Slide 25: Host Security: Requirements (continued)
Host Security Part 2: PCI DSS Requirements and Recommendations (continued) • Enable any available logging on the host – Logging should also be enabled on: • Remote management system • Firewall (hardware and software) • POS application • If POS application requires a database (SQL Server, MS Access,
Slide 26: SQL Injection
SQL Injection Petr Darius Emerging Risk December 12, 2006
Slide 27: SQL Injection: Overview
SQL Injection Part 1: Overview • Structured Query Language (“SQL”) is used to manipulate and extract data from databases • SQL injection is an attack method that exploits improperly coded applications to access the back-end database via the web interface • SQL injection usually occurs when user inpu
Slide 28: SQL Injection: Common Merchant Environment
SQL Injection Part 2: Common Merchant Environment • Typical environment components include: – web servers – database servers – payment (POS) application servers – firewalls (required by PCI DSS) • SQL injection exploits a vulnerability in the web server application to attack the database server POS
Slide 29: SQL Injection: Legitimate Use Example
SQL Injection Part 3: Legitimate Use Example • Customer enters their login ID (“jdoe”) and password into the browser • Web application uses a pre-defined SQL statement to query the database for user credentials: “SELECT * FROM [tbl_users] WHERE user_name =‘<user_input>’;” • Web application replaces
Slide 30: SQL Injection: Attack Method Example
SQL Injection Part 4: Attack Method Example • Attacker prepares for attack by inputting invalid phrases and analyzes error messages returned to the web browser • Attacker alters the login ID field to execute an illegitimate SQL statement • For example, the attacker can type “jdoe’ OR ‘a’=‘a” into th
Slide 31: SQL Injection: Consequences of a Successful Attack
SQL Injection Part 5: Consequences of a Successful Attack • A successful SQL injection attack may result in: – data being revealed to the attacker – data being altered by the attacker – destruction of data – elevation of privileges – system takeover Restaurant Webinar Presentation 12/12/2006
Slide 32: SQL Injection: Defending Against an Attack
SQL Injection Part 6: Defending Against an Attack Follow these recommendations: Application level – Always validate user input – Avoid dynamic SQL statements – Avoid returning full error messages to the client browser Database level – Always execute SQL statements under a minimally privileged accoun
Slide 33: Payment Application Best Practices (PABP)
Payment Application Best Practices (“PABP”) Martin Elliott Enterprise Risk and Compliance December 12, 2006
Slide 34: Payment Application Vulnerabilities
Payment Application Vulnerabilities • Over 20 applications have played a role in compromises • Top 5 vulnerabilities related to payment applications include: – Full track data and/or encrypted PIN block retention – Default accounts – Insecure remote access by software vendors and their resellers – C
Slide 35: Payment Application Best Practices
Payment Application Best Practices • Visa’s PABP was released in 2005 – Ensure vendors provide products that support PCI DSS compliance – Minimize compromises caused by insecure payment application – Focus is elimination of the storage of full track data • Payment application vendors have voluntary
Slide 36: Reference Tools
Reference Tools • Payment Card Industry (PCI) • Visa CISP – Data Security Standard – What To Do If Compromised Guide – Security Audit Procedures – Qualified CISP Incident Response – Self-Assessment Questionnaire Assessor List – Security Scanning Procedures – List of CISP-Compliant Service Providers
Slide 37: Questions
Questions Restaurant Webinar Presentation 12/12/2006
Slide 38: Thank You!
VISA Thank You!
Visa — Visa Data Security Webinar Series: Restaurant Webinar (December 2006) on 6ix