Visa Inc. · NYSE:V
Visa — Technical Presentation (February 2016)
27 slides from Visa's technical presentation, Feb 24, 2016
Slide 1: Third Party Risk Program Updates
Third Party Risk Program Updates 24 February 2016 Diana Greenhaw, Senior Director, Data Security & Third Party Risk Aureliano Islas, Program Manager, Third Party & Processor Risk Helen Resalvo, Program Manager, Third Party & Processor Risk Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Third Party Risk Initiatives • Visa Global Registry of Service Providers • Agent Registration • Merchant Servicer Self-Identification Program (MSSIP) • Qualified Integrator and Resellers • Resources • Questions and Answers 3 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Pu
Slide 4: Third Party Risk Initiatives
Third Party Risk Initiatives 4 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 5: Third Party = an entity that provides payment-related services
Third Party = an entity that provides payment-related services to a Visa client, merchant or another Third Party. • VisaNet Processors • Card Vendors • Trusted Service Managers Acquirers Issuers • Terminal Vendors • Independent Sales Organizations (ISOs) • Encryption Support Organization (ESOs) • Th
Slide 6: New players and technologies are transforming the payment landscape
New players and technologies are transforming the payment landscape Note: All brand names and logos are the property of their respective owners, are used for identification purposes only, and do not imply product endorsement or affiliation with Visa. 6 | Visa Third Party Risk Program Updates | 24 Fe
Slide 7: As the payment landscape evolves, maintaining consumer trust is key
As the payment landscape evolves, maintaining consumer trust is key Emerging technology such as mobile, social media, introduce new threats Criminals are evolving quicker than detection and response Consumers and regulators’ concerns about online security and privacy are rising Effect of a data brea
Slide 8: Visa Third Party Risk Initiatives
Visa Third Party Risk Initiatives Promote adoption Enhance visibility of Provide Risk Management of security standards and secure service providers education and awareness technologies • Agent registration drive • Promote PCI Qualified • Online webinar series • Changes to Merchant Servicer Integrato
Slide 9: Visa Global Registry of Service Providers
Visa Global Registry of Service Providers 9 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 10: The Value of Transparency
The Value of Transparency Visa’s Global Registry of Service Providers provides a platform for clients and merchants to select service providers who have met Visa program and industry requirements. Easy for clients, merchants and other service providers to identify registered, validated providers Dif
Slide 11: Registry Enhancements
Registry Enhancements Recognize compliance with other Distinguish service providers who Visa or industry data security support secure technologies standards Acknowledge longevity in the Highlight new service providers payment system Display service provider brand Enhance search functionality logo an
Slide 12: Agent Registration
Agent Registration 12 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 13: Third Party Agent Registration Drive
Third Party Agent Registration Drive The Third Party Agent Registration Program was established to ensure that Visa clients comply with the Visa Rules, Payment Card Industry Data Security Standard (PCI DSS) and other applicable security standards regarding their use of Third Party Agents (TPAs). Vis
Slide 14: Merchant Servicer Self Identification Program (MSSIP)
Merchant Servicer Self Identification Program (MSSIP) 14 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 15: MSSIP North America program changes
Merchant Servicer Self-Identification Program North America program changes No longer required for registered Merchant Servicers • Focus on the intent of the program – portal for agents to identify themselves and get registered • Remove redundancy in AOC submission Fees are waived for Merchant Servi
Slide 16: Qualified Integrator and Resellers
Qualified Integrator and Resellers 16 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 17: Majority of Compromises Occur at Small Merchants
Majority of Compromises Occur at Small Merchants • Untrained integrators that deploy weak remote access configurations are the most common reason for small merchant compromises • Common attack vector: web-based and direct remote access services used by POS Integrators and Resellers According to Trus
Slide 18: Visa Security Alert – Integrators Under Attack
Visa Security Alert – Integrators Under Attack www.visa.com/cisp Visa Security Alert also published by the U.S. Secret Service 18 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 19: PCI Qualified Integrators and Resellers Program
PCI Qualified Integrators and Resellers Program • Qualification at company and employee level • QIR training and examination • QIRs install and configure POS applications in a way which supports merchants’ on-going PCI DSS compliance 19 | Visa Third Party Risk Program Updates | 24 February 2016 Visa
Slide 20: Designed With Merchants in Mind
Designed With Merchants in Mind QIR Program Provides Benefits to Merchants • Improves security, reduces risk, and helps maintain merchant compliance − As part of broader responsibilities, QIR must cooperate with forensic investigation in cases of breach • Simplifies the vendor selection process − Ch
Slide 21: Program Benefits Extend to Integrators and Resellers
Program Benefits Extend to Integrators and Resellers Value in Visibility • Achieve industry-recognized qualification (3 year certification) • Included on PCI SSC list of qualified integrators and resellers • Receive specialized training from PCI SSC experts • Earn CPE credits • QIRs may be included
Slide 22: Visa Global Registry of Service Providers
Visa Global Registry of Service Providers Dual Listing Opportunity Traffic & Safety Control Systems, Inc. 22 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 23: Visa Small Merchant Security Program
Visa Small Merchant Security Program QIR and PCI DSS Validation Requirements* Effective Date Requirement Acquirers must communicate to Level 4 merchants that beginning January 31, 2017, they must use PCI-certified Qualified Integrators March 31, 2016 and Resellers for point-of-sale application and t
Slide 24: The Bottom Line
The Bottom Line Layers of Security People + Processes + Technology = Security 24 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 25: Resources Questions and Answers
Resources Questions and Answers 25 | Visa Third Party Risk Program Updates | 24 February 2016 Visa Public
Slide 26: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • Stay One Step Ahead of Hackers With Visa Threat Intelligence ‒ 23 March 2016, 10 am PST Visa Data Security Website – www.visa.com/cisp • Alerts, Bulletins • Best Practices, White Papers • Past Webinars PCI Security
Slide 27: Questions?
Questions? Visa Public