Visa Inc. · NYSE:V
Visa — Technical Presentation (August 2015)
11 slides from Visa's technical presentation, Aug 25, 2015
Slide 1: Implement Effective Penetration Testing
Implement Effective Penetration Testing Ed Verdurmen Navid Jam Visa - Moderator FireEye Rob Chahin & Kevin Dunn NCC Group Ryan Wakeham & Scott Sutherland netSPI August 25, 2015 Visa Public
Slide 2: Notice of Disclaimer
Notice of Disclaimer The information, recommendations or “best practices” contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy
Slide 3: What's Changed in 2015?
What’s Changed in 2015? The PCI SSC Issued Pentest Guidance Q: How has the PCI guidance improved assessments? A: Alternate guidance is exhaustive (read: expensive), the previous PCI requirement set a low bar 3 | Implementing Effective Pentesting | August 25, 2015 Visa Public
Slide 4: What's Changed in the Past Five Years?
What’s Changed in the Past Five Years? Penetration testing has emerged as a mature market niche in the U.S, Western Europe, and parts of Asia Q: How do you find a top tier pentester? A: Good pentesters remain hard to identify. Examine the company’s hiring process. It must include testing, and the co
Slide 5: Q: How do I prepare for a pentest?
Q: How do I prepare for a pentest? A: People don’t do this everyday, so: • Start with an overview of the company, • Ensure your QSA helps prepare your pentester, • Set high-level goals, and • Collaborate, Collaborate, Collaborate 5 | Implementing Effective Pentesting | August 25, 2015 Visa Public
Slide 6: Have a Threat Model Ready
Have a Threat Model Ready It needn’t be detailed nor technical, cybercrime and POS malware may be sufficient Q: How do I prioritize my first technical pentest or first investment in a more expensive pentesting firm? A: Merchant breaches tend to exploit the POS and remote access, Fortune 500 breaches
Slide 7: Large Companies Are Strict and Complex
Large Companies Are Strict and Complex Q: How do I scope a test that provides system access to the tester without creating undue risk? A: REPEAT POINT: Use your QSA to help negotiate and provide appropriate detail to your pentester 7 | Implementing Effective Pentesting | August 25, 2015 Visa Public
Slide 8: Do companies really struggle with PCI penetration tests?
Q: This sounds basic, do companies really struggle with performing detailed PCI penetration tests? A: Yes. Although Fortune 500 companies tend to have more experience, many firms set low standards for pentests 8 | Implementing Effective Pentesting | August 25, 2015 Visa Public
Slide 9: How can a pentester help with encryption and tokenization?
Q: Our company is deploying encryption, tokenization, and upgrading hardware between 2015 and 2017. How can a pentester help? A: A good pentester can help identify implementation errors. Implementation errors can render most technologies ineffective. 9 | Implementing Effective Pentesting | August 25
Slide 10: Q&A
Q&A 10 | Implementing Effective Pentesting | August 25, 2015 Visa Public
Slide 11: Thank you
Thank you Visa Public