Visa Inc. · NYSE:V
Visa — Technical Presentation (September 2015)
17 slides from Visa's technical presentation, Sep 2, 2015
Slide 1: The Importance of Containment and Remediation of Compromised Payment Processing Environments
The Importance of Containment and Remediation of Compromised Payment Processing Environments Glen Jones – Cyber Intelligence & Investigations September 2, 2015
Slide 2: Notice of Disclaimer
Notice of Disclaimer The information, recommendations or “best practices” contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy
Slide 3: Agenda
Agenda • Global data compromises • Importance of containment & eradication • Case study: improper containment & eradication • Cyber attack kill chain • Importance of proper scoping investigative response • Proper containment – short & long term • Effective eradication • Containment versus eradicatio
Slide 4: Global Data Compromises
Global Data Compromises • A compromise is not a matter of “if,” it’s a matter of “when” • Global data compromise events grew 23% in 2014 over those managed in 2013 • The average total cost of a data breach is now up to $3.79 million • The U.S. is the largest contributor, mainly due to its large mag
Slide 5: Examples of entities experiencing multiple breaches
Examples of entities experiencing multiple breaches Suffered multiple compromises 5 The Importance of Containment and Remediation of Compromised Payment Processing Environments | 09/02/15 Visa Public
Slide 6: Importance of Containment and Eradication
Importance of Containment and Eradication Risks of not containing and eradicating the first time • Large merchants can spend significant resources on multiple compromises – Multiple forensic investigations – Multiple QSAs, since you cannot use the same one as before – Money spent on professional sec
Slide 7: Case Study: Improper Containment and Eradication
Case Study: Improper Containment and Eradication Based on a payment card forensic investigation • Retail merchant with over 1,000 locations in the United States and Canada • Forensic Findings: o Cause of breach was undetermined by the forensic investigators o Not properly scoped o Hosts were not ide
Slide 8: Cyber Attack Kill Chain
Cyber Attack Kill Chain Breaking down elements to contain and remediate Reconnaissance – Weaponization – Delivery – Exploitation – 1 harvesting emails, 2 exploit vulnerability 3 weaponized 4 exploiting a 5 Installation – malware on 6 Command & Control – remotely operate and 7 Action – commit harvest
Slide 9: Importance of complete scoping
Importance of complete scoping Identify all hosts • Gather events from all sources • Log files, error messages, IDS/IPS, and firewall logs • Super hackers do not exist, they always leave a trace • Document cleanly and completely • Risk of missing just one host • Should not proceed until scoping is c
Slide 10: Proper Containment
Proper Containment Short Term Long Term • Goal is to limit and prevent further • Ensure accounts and/or backdoors are damage removed left by attackers • Isolate network segments impacted • Root cause analysis • Perform system backups before re- • Rebuild impacted systems imaging – Malware persistenc
Slide 11: Effective Eradication
Effective Eradication Removal and restoration of affected systems • Malware removal is addressing the symptom, not the cause – Don’t clean, rebuild – Determine how the malware got installed in the first place • When in doubt, tear it down and rebuild • Blocking is good, but not enough • Rip off the
Slide 12: Containment versus Eradication
Containment versus Eradication Containment Eradication • An incident is “contained” when • Fixing what led directly to the cardholder data is no longer being compromise breached – Removal of malware or rebuilt of compromised systems • The Window of Intrusion starts from the – Compromised system remo
Slide 13: Remediation
Remediation • Remediation is the term used to describe the end of the Window of System Vulnerability • The Window of System Vulnerability is the time frame in which a weakness(s) in an operating system, application or network could be exploited by a threat to the time that weakness is properly remed
Slide 14: Key Takeaways
Key Takeaways Lessons Learned 1. Understand why the breach occurred – People, process, technology failures 2. Properly scope the account data compromise – Ensure all affect hosts are identified 3. Short term containment – Limit and prevent further damage 4. Long term containment – Backdoor removal,
Slide 15: Additional Resources
Additional Resources Guidance and standards on incident response and handling • Review Visa’s “What To Do If Compromised” guide – http://usa.visa.com/download/merchants/cisp-what-to-do-if-compromised.pdf • SANS Incident Handler’s Handbook – http://www.sans.org/reading-room/whitepapers/incident/incid
Slide 16: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Under Merchant Resources/Training on www.visa.com Visa Online Merchant Tool Kit provides helpful information to make a seamless EMV transition • Streamline your chip migration – www.VisaChip.com/businesstoolkit Visa Data Security Website – www.visa.c
Slide 17: Thank you for attending! Questions? Comments?
Thank you for attending! Questions? Comments?