Visa Inc. · NYSE:V
Visa — Technical Presentation (August 2011)
28 slides from Visa's technical presentation, Aug 17, 2011
Slide 1: Identifying and Detecting Security Breaches
Identifying and Detecting Security Breaches August 17, 2011
Slide 2: Payment System Risk Data Security Webinars Overview
Payment System Risk Data Security Webinars Overview • Encourage greater adoption of and adherence to the Payment Card Industry Data Security Standard (“PCI DSS”), Payment Application Data Security Standard (“PA- DSS”) and PCI PIN Transaction Security (“PTS”) Requirements • Promote security awareness
Slide 3: Controlling Fraud: A Layered Approach
Controlling Fraud: A Layered Approach PREVENT PROTECT Minimize fraud in the payment Trust Protect vulnerable ! system and account data Partnership RESPOND Monitor and manage events that occur Maintaining and enhancing stakeholder trust in Visa as the most secure way to pay and be paid Visa Public Au
Slide 4: Agenda
Agenda • Global System Compromises • Common Vulnerabilities and Malware • Signs of an Incident • How to Detect a Security Incident • Implementing and Reviewing Logs • Logs and PCI DSS Compliance • Basics of Incident Management • Top Challenges • Visa’s “What To Do If Compromised” Procedures • Resour
Slide 5: Common Vulnerabilities
Common Vulnerabilities Web-based exploits • SQL injection • Misconfigured web applications that allow remote execution Network-based exploits • Payment systems accessible from the Internet • No segmentation on internal network • Single domain implementation • No strict firewall configuration • Remot
Slide 6: Common Vulnerabilities
Common Vulnerabilities Host-based exploits • Excessive permissions • Use of shared and/or default credentials • Administrative accounts not protected (e.g., domain accounts, DBAs, SAs) • Databases not hardened (e.g., direct-SQL queries, stored procedures) Payment application-based exploits • Unautho
Slide 7: Malicious Software
Malicious Software Malicious Software – Configured to damage and infiltrate computer systems • Packet sniffers • Key loggers • Backdoors • Password crackers 7 Visa Public August 2011as Needed Information Classification Presentation Identifier.7
Slide 8: Signs of an Incident
Signs of an Incident Understanding where and how payment data flows through the environment is essential to the early detection of malicious activity • What networks are traversed? • What systems are touched? Data “in-flight” • Where is data stored? Data “at rest” In 2010, most reported data comprom
Slide 9: Signs of an Incident
Signs of an Incident Before an organization is able to effectively detect malicious activity on the network, some preliminary work is required: For each network in the environment: • Identify all connections in the network • Identify dependencies and shared resources • Document network connections a
Slide 10: Signs of an Incident
Signs of an Incident Once data flow maps and network diagrams have been created or updated, a security baseline can be established Security baselines can help an organization by: • Concentrating focus on actual incidents • Establishing “norms” for data channels and network traffic • Determining peak
Slide 11: Signs of an Incident
Signs of an Incident Once an organization’s environment is prepared, its processes, people and tools can be placed to detect malicious activity Visa recommends adoption of a layered approach Layered security offers several levels of protection and harder to circumvent for attackers – more traces lef
Slide 12: Signs of an Incident
Signs of an Incident Indicators of a compromise can be as diverse as the methods used to perpetrate malicious activities. Some examples include: • Excessive login attempts in system authentication and event logs • Unexplained modification or deletion of data • Presence of unexpected IP addresses or
Slide 13: How To Detect A Security Incident
How To Detect A Security Incident Examine security event logs on: • Web • Application logs for SQL injection • Firewall • Intrusion detection (host and network) • VPN servers • Third-party remote access Visa Public August 2011as Needed Information Classification Presentation Identifier.13 13
Slide 14: How To Detect A Security Incident
How To Detect A Security Incident Where and what to look for: • Inspect recent vulnerability scan reports and remediate immediately • Look for suspicious error and usage trends across your web servers • Monitor user accounts (root level privileges) for unusual local and remote access dates, times an
Slide 15: Implementing and Reviewing Logs
Implementing and Reviewing Logs Implement third-party security log management tool • Centralized logging • Analyze logs • Disseminate alerts • Keep a history of logs • Protect logs from unauthorized access • Companies should have standard procedures for log management Visa Public August 2011as Neede
Slide 16: Implementing and Reviewing Logs
Implementing and Reviewing Logs Logs are useful when performing: • Forensic analysis • Auditing • Internal investigations • Operational trends • Long-term problems Routine log review is useful in identifying: • Security incidents • Policy violations • Operational problems Visa Public August 2011as N
Slide 17: Logs and PCI DSS Compliance
Logs and PCI DSS Compliance PCI DSS Requirement 10: Track and monitor all access to network resources and cardholder data. Objective: To ensure controls are implemented: • To adequately monitor and track all network resources and all access to cardholder data • To identify and alert in the event of
Slide 18: PCI DSS Requirement 10:
PCI DSS Requirement 10: Track and monitor all access to network resources and cardholder data Establish a process for linking all access to system components to an individual user Implement automated audit trails to reconstruct the following events, for all system components: • All individual user a
Slide 19: PCI DSS Requirement 10:
PCI DSS Requirement 10: Track and monitor all access to network resources and cardholder data Record at least the following audit trail entries for each event, for all system components: • User identification • Type of event • Date and time • Indication of success or failure • Origination of event •
Slide 20: Basics of Incident Management
Basics of Incident Management Preparation • Organizations should have policies and procedures in the event of a compromise • Computer Incident Response Team (“CIRT”) should include information security, legal, PR, executive management • Incident handlers should have proper software / hardware • Know
Slide 21: Basics of Incident Management
Basics of Incident Management Containment • Remove compromised system from the network • Do not access or alter compromised system • Create a binary copy of the compromised system • Store original drives in a safe place Eradication • Rebuild infected systems • Rotate passwords • Implement strict inb
Slide 22: Basics of Incident Management
Basics of Incident Management Recovery • Restore systems from clean backups • Validate the systems have been restored • Monitor systems closely Follow-up / Lessons learned • Identify areas for improvement, such as: – Procedures – Security – Communication Visa Public August 2011as Needed Information
Slide 23: Top Challenges
Top Challenges 1. Failure to report or ask for help 2. Incomplete / non-existent notes 3. Mishandling / destroying evidence 4. Failure to create working backups 5. Failure to contain or eradicate 6. Failure to prevent re-infection 7. Failure to apply lessons learned Visa Public August 2011as Needed
Slide 24: Visa's What To Do If Compromised Procedures
Visa’s What To Do If Compromised Procedures Compromised entities must: • Immediately contain and limit the exposure • Notify their merchant bank • Notify law enforcement • Work with Visa on forensic investigation • Provide compromised Visa, Interlink, and Plus accounts to your merchant bank • Provid
Slide 25: Visa's What To Do If Compromised Procedures
Visa’s What To Do If Compromised Procedures Acquirers must: • Ensure compromised entity cooperates with Visa on the investigation • Perform an initial investigation and provide documentation to Visa • If Visa deems necessary, an independent forensic investigation must be conducted by a PCI Forensic
Slide 26: Visa's What To Do If Compromised Procedures
Visa’s What To Do If Compromised Procedures Acquirers must: • Provide at-risk account numbers to Visa • Ensure the compromised entity has contained the incident • Perform a PIN security assessment (If PINs are at risk) • Provide forensic report to Visa • Ensure the compromised entity achieves PCI co
Slide 27: Resources
Resources Visa • www.visa.com/cisp • “What To Do If Compromised” document • “Responding To A Data Breach: Communications Guidelines for Merchants” document PCI Security Standards Council • www.pcisecuritystandards.org • PCI Data Security Standard (“DSS”) • PCI Forensic Investigator (“PFI”) program V
Slide 28: Questions?
Questions? Visa Public August 2011as Needed Information Classification 28 Presentation Identifier.28