Visa Inc. · NYSE:V
Visa — Technical Presentation (January 2015)
23 slides from Visa's technical presentation, Jan 28, 2015
Slide 1: Breach Findings for Large Merchants
Breach Findings for Large Merchants 28 January 2015 Glen Jones – Cyber Intelligence and Investigation Lester Chan – Payment System Security
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Introduction • Payment Card Compromises • Analyzing Large Merchant Breaches • Breach Findings & Vulnerabilities • Security Controls for Large Merchants • Questions and Answers 3 Breach Findings for Large Merchants – 28 January 2015 Visa Public
Slide 4: Payment Card Compromises
Payment Card Compromises Glen Jones 4 Breach Findings for Large Merchants – 28 January 2015 Visa Public
Slide 5: Visa Inc. CAMS Compromise Events Entity Type by Month
Visa Inc. CAMS Compromise Events Entity Type by Month Brick & Mortar Ecommerce Processor / Agent Source: Compromised Account Management System (CAMS) – Original “IC” and “PA” Alerts 5 Breach Findings for Large Merchants – 28 January 2015 Visa Public Visa Public 5
Slide 6: Visa Inc. CAMS Compromise Events Top Market Segment (MCC)
Visa Inc. CAMS Compromise Events Top Market Segment* (MCC) • Restaurants and retailers are leading market segments in 2014 • Insecure remote access and poor credential management continue to be attack vectors RESTAURANTS OTHER RETAIL QSR'S B2B SUPERMARKETS LODGING 2011 2012 2013 2014 * Market Segmen
Slide 7: Analyzing Large Breaches
Analyzing Large Breaches Lester Chan 7 Breach Findings for Large Merchants – 28 January 2015 Visa Public
Slide 8: What we looked for…
What we looked for… • Large breaches over the past 2 years • Common themes, sources • Attack patterns, characteristics • Malware used • Determine vulnerabilities • Large versus small breaches • Lessons learned Conclusion: Intruders are exploiting basic vulnerabilities 8 Breach Findings for Large Mer
Slide 9: Breach Findings & Vulnerabilities
Breach Findings & Vulnerabilities 9 Breach Findings for Large Merchants – 28 January 2015 Visa Public
Slide 10: Profile of Large U.S. Merchant Breaches
Profile of Large U.S. Merchant Breaches Aggregate findings over the past 2 years 9 8 6 5 2 • Privileged • Weak AppSec • Malware • Completed PCI • Weak audit accounts testing infected POS DSS validation function compromised • Inadequate systems before • Sysadmin monitoring • Weak incident accounts se
Slide 11: Establish Security Controls for Remote Access
Establish Security Controls for Remote Access • Many remote servers not hardened • Point of entry for attackers • Auditing not configured properly • Harvest credentials using malware • Lack of multi-factor authentication • Social engineering to acquire • Lack of account management REMOTE ACCESS • En
Slide 12: Ensure Merchant Core Network is Properly Segmented from CDE
Ensure Merchant Core Network is Properly Segmented from Cardholder Data Environment (CDE) • Some had flat networks • Network reconnaissance • Weak using ACLs, VLANs • Lack of auditing and monitoring • Allows attacker to pivot and traverse • Lack of IPS/IDS on systems NETWORK SEGMENTATION • ACLs and
Slide 13: Review Elevated Account Privileges, Reviews, and Justifications
Review Elevated Account Privileges, Reviews, and Justifications • Owns the network, systems • Attackers use multiple accounts • Allows attackers to execute • Install malware on POS systems commands • Login with one, switch to elevated • Hides audit trails, actions, logs ELEVATED PRIVILEGES • Ensure
Slide 14: Review Audit Controls To Capture Relevant Data
Review Audit Controls To Capture Relevant Data with Actionable Information • Misconfigured logs • Requires tuning (noise) • Not capturing correct or enough • Assists investigators • Threshold for alerts • Ensure integrity on logs WEAK AUDITING • Requires human interaction • Some did not capture enou
Slide 15: Review Internet Ingress/Egress for Controls, Insecure Protocols and Alerts
Review Internet Ingress/Egress for Controls, Insecure Protocols and Alerts L • Lack of monitoring • Suspicious network activity • Insecure protocols • Large data transfers • Infiltration of malware • Outside work hours • Exfiltration of cardholder data INTERNET INGRESS/EGRESS • Employ the use of IDS
Slide 16: Security Controls for Large Merchants
Security Controls for Large Merchants 16 Breach Findings for Large Merchants – 28 January 2015 Visa Public
Slide 17: Protecting Cardholder Data
Protecting Cardholder Data External network Ensure strong controls between Internet facing systems and core network Core Ensure proper network segmentation between core network and CDE Cardholder using strong security data controls environment Cardholder data 17 Breach Findings for Large Merchants –
Slide 18: Highlighted Changes to PCI DSS version 3.0
Highlighted Changes to PCI DSS version 3.0 V 2.0 V 3.0 Changes to PCI DSS 3.0 related to breach findings 1.1.2 1.1.2, 1.1.3 Understand all data flows in your environment especially cardholder data ingress/egress and provide an updated network diagram 2.1 2.1 Clarifies requirement to change all defau
Slide 19: Maturing Information Security
Maturing Information Security Validate to Version 3.0 Implement P2PE, EMV Chip, and Proactive Security Controls Tokenization After January 1, 2015, all merchants EMV Chip - Creates a unique • Use two-factor authentication must validate to PCI DSS version 3.0. especially for remote access cryptogram
Slide 20: Additional Security Controls…
Additional Security Controls… SIEM •Security intelligence and correlation •Alerts and notification •Tuning Vulnerability Management •Frequency of scans •Zero day vulnerabilities •Remediation and tracking Antivirus •Keep signatures updated •Ensure settings cannot be altered Patch Management •Keep all
Slide 21: Key Takeaways
Key Takeaways • Large merchant breaches continue to occur • Continue focus on security “basics”, ongoing maturity and going “beyond PCI” • Review security controls for remote access • Review elevated account privileges, reviews, and justifications • Ensure proper network segmentation • Review auditi
Slide 22: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • Cyberlocker Merchant Overview & Enhanced Due Diligence ‒ 24 February 2015, 7 pm PST (Asia Pacific / Central Europe, Middle East, Africa audience) • Cyberlocker Merchant Overview & Enhanced Due Diligence ‒ 25 Februa
Slide 23: Questions?
VISA Questions?