Visa Inc. · NYSE:V
Visa — Creating, Developing and Instituting an Effective Incident Response Plan Webinar (April 2015)
22 slides from Visa's conference presentation, Apr 15, 2015
Slide 1: Creating, Developing and Instituting an Effective Incident Response Plan
Creating, Developing and Instituting an Effective Incident Response Plan Webinar 15 April 2015 Stan Hui – Payment System Security Stephen J. Kopeck – Verizon Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Data Breach Landscape • The Need for Incident Response • Incident Response Plan Elements • Questions and Answers 3 | Creating, Developing and Instituting an Effective Incident Response Plan | 15 April 2015 Visa Public
Slide 4: Data Breach Landscape
Data Breach Landscape Stan Hui 4 | Creating, Developing and Instituting an Effective Incident Response Plan | 15 April 2015 Visa Public
Slide 5: Visa Inc. CAMS Compromise Events Entity Type by Month
Visa Inc. CAMS Compromise Events Entity Type by Month Brick & Mortar Ecommerce Processor / Agent Source: Compromised Account Management System (CAMS) – Original “IC” and “PA” Alerts 5 | Creating, Developing and Instituting an Effective Incident Response Plan | 15 April 2015 Visa Public Visa Public 5
Slide 6: Visa Inc. CAMS Compromise Events Top Market Segment (MCC)
Visa Inc. CAMS Compromise Events Top Market Segment* (MCC) • Restaurants and retailers are leading market segments in 2014 • Insecure remote access and poor credential management continue to be attack vectors RESTAURANTS OTHER RETAIL QSR'S B2B SUPERMARKETS LODGING 2011 2012 2013 2014 * Market Segmen
Slide 7: Recent Threats due to POS Integrators
Recent Threats due to POS Integrators • POS Integrators support merchant POS software installations • Typically merchant setup includes Remote Access Services (RAS) for monitoring and software support • Integrators have access to POS system - however PCI compliance not maintained • Multiple POS Inte
Slide 8: Merchant Due Diligence
Merchant Due Diligence Requirement 12 – Maintain a policy that addresses information security for all personnel • Requirement 12.5.3 – Establish, document, and distribute security incident response and escalation procedures to ensure timely and effective handling of all situations • Requirement 12.1
Slide 9: Creating, Developing and Instituting an Effective Incident Response Plan
Creating, Developing and Instituting an Effective Incident Response Plan Stephen J. Kopeck, Verizon 9 | Creating, Developing and Instituting an Effective Incident Response Plan | 15 April 2015 Visa Public
Slide 10: Proprietary Statement
PROPRIETARY STATEMENT This document and any attached materials are the sole property of Verizon and are not to be used by you other than to evaluate Verizon’s service. This document and any attached materials are not to be disseminated, distributed, or otherwise conveyed throughout your organization
Slide 11: Objective
OBJECTIVE OBJECTIVE— To outline and discuss the fundamental components of developing, and implementing an Incident Response Plan. Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to an
Slide 12: Putting It Into Perspective: The Need for IR
PUTTING IT INTO PERSPECTIVE THE NEED FOR IR— IR is not just an — Incidents continue to occur with IT problem… increasingly sophisticated threats: —Management —organized crime / sensitive data theft —Legal —denial of service attacks / “hacktivism” —Human Resources —insider threats / corporate espiona
Slide 13: Putting It Into Perspective: The Need for IR
PUTTING IT INTO PERSPECTIVE THE NEED FOR IR— 1 – Recover quickly from an incident —damage and loss minimized —future incidents prevented, or at least mitigated 2 – Implement a pre-planned strategy —efficient, effective, and repeatable process 3 – Protect the company’s interests —proprietary informat
Slide 14: IR Plan Elements: Focus Areas
IR Plan Elements FOCUS AREAS— Scope & Purpose IR Roles and Responsibilities Internal Stakeholders External Entities IR Process Flow/Phases Revision History IR Resources IR Stakeholder Contact List First Responder Checklist Incident Report Template Evidence Chain of Custody/Log Confidentia
Slide 15: IR Plan - Stakeholders
IR Plan - Stakeholders INCIDENT RESPONSE STAKEHOLDERS— —Chief Information Risk Officer —Incident Response Team / Manager —Business Organizations / Managers —Information Technology (IT) Organizations / Managers —Information Security / Officers —Legal —Human Resources —Compliance —Physical Security —L
Slide 16: Incident Response Elements: Incident Response Phases
INCIDENT RESPONSE ELEMENTS INCIDENT RESPONSE PHASES— — Preparation — Detection & Analysis — Containment, Eradication, & Recovery — Post-Incident Activities NIST SP 800-61, R2, Computer Security Incident Handling Guide Confidential and proprietary materials for authorized Verizon personnel and outsid
Slide 17: Incident Handling Elements: Incident Response Process
INCIDENT HANDLING ELEMENTS INCIDENT RESPONSE PROCESS— Source: NIST SP 800-61, R2, Computer Security Incident Handling Guide Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unau
Slide 18: Recommendations: Things to Consider
RECOMMENDATIONS THINGS TO CONSIDER— — Less is more philosophy — Develop, Review, Train, & Operate by the Plan — It is a living document — Ensure everyone is familiar with the plan – Required reading Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Us
Slide 19: Conclusion: Take-Aways
CONCLUSION TAKE-AWAYS— — Remember any organization can be a target — Establish policies and plans before an incident occurs — Processes should be reliable and consistent — Ensure Incident Responders are trained and know their roles, responsibilities, & authorizations — Maintain good documentation —
Slide 20: Visa Merchant Event Announcement
Visa is hosting a must-attend event that will focus on trends and developments related to cyber security, mobile payments, e-commerce and Visa’s global authentication strategy. In order to secure the future of commerce all stakeholders including merchants, acquirers, agents and Visa need to collabor
Slide 21: Upcoming Merchant Events and Resources
Upcoming Merchant Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • Identifying and Mitigating Threats to E-commerce Payment Processing ‒ 29 April 2015, 10 am PST • Strategies to Effectively Manage Data Compromise Events ‒ 27 May 2015, 10 am PST Visa Data Security Website
Slide 22: Steve Kopeck, Principal Consultant, Verizon Risk
STEVE KOPECK PRINCIPAL CONSULTANT | VERIZON RISK STEPHEN.KOPECK@VERIZON.COM 202.384.2687 Confidential and proprietary materials for authorized Verizon personnel and outside agencies only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties e