Visa Inc. · NYSE:V
Visa — Visa Threat Intelligence Webinar Series (March 2016)
28 slides from Visa's conference presentation, Mar 23, 2016
Slide 1: Stay One Step Ahead of Hackers With Visa Threat Intelligence
Stay One Step Ahead of Hackers With Visa Threat Intelligence 23 March 2016 Glen Jones, Sr. Director, VISA, Cyber Intelligence and Investigations Kevin Thompson, Threat Analyst, FireEye Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Cyber Intelligence Trends • Payment System Threat Intelligence • Upcoming Events and Resources • Q&A 3 | Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public
Slide 4: Cyber Intelligence Trends: Making Intel Actionable
Cyber Intelligence Trends Making Intel Actionable Kevin Thompson, Threat Analyst, FireEye Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public
Slide 5: What Is Threat Intelligence?
What Is Threat Intelligence? Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 5
Slide 6: Data vs. Threat Intelligence
Data vs. Threat Intelligence Commoditized Feeds: Raw Data Threat Intelligence • Misses the threats that matter. • Threat intelligence curates data sources to Commoditized threat intelligence is too create high-fidelity, precise alerts to surgically broad and out-of-date to protect against identify t
Slide 7: Internal Intel: Why Me?
Internal Intel Why Getting Me? Access Context Keeping Access Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 7
Slide 8: Internal Intel: Why Me?
Internal Intel Why Getting Me? Access Keeping Access Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 8
Slide 9: Email vs. Web
Email vs. Web • 10 0-days discovered by the FireEye Labs: • 7 of them used via drive by download • 3 of them used email • Macros are back • Retail: ~97% had an email component • Healthcare: ~97% had an email component • Finance: ~98% had an email component Stay One Step Ahead of Hackers With Visa Th
Slide 10: Email vs. Web
Email vs. Web Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 10
Slide 11: Internal Intel: Why Me?
Internal Intel Why Getting Me? Access Keeping Access Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 11
Slide 12: Median Days Before Discovery
Median Days Before Discovery 416 243 229 205 146 2011 2012 2013 2014 2015 Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 12
Slide 13: How Compromises Are Detected
How Compromises Are Detected 47% Internal 53% External Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 13
Slide 14: Lateral Movement ≠ Malware
Lateral Movement ≠ Malware Of all of the compromised machines Mandiant identified in the last two years, only ~50% had malware on them. Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 14
Slide 15: New persistence mechanisms: Hijacking the VPN
New persistence mechanisms • Hijacking the VPN – Attackers targeting VPN immediately after compromise and abandon traditional malware – Theft of client-side certificates – Exploiting single-factor authentication Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public
Slide 16: Attackers in the cloud
Attackers in the cloud Attackers use Twitter to send instructions to their malicious tools • Twitter accounts include encoded instructions on where to go next • Network monitoring shows an end user visiting a twitter account, NOT malware receiving instructions Stay One Step Ahead of Hackers With Vis
Slide 17: Internal Intel: Why Me?
Internal Intel Why Getting Me? Access Keeping Access Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 17
Slide 18: Isn't all cyber crime stealing CC #'s?
Isn’t all cyber crime stealing CC #’s? Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 18
Slide 19: Ransomware
Ransomware Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 19
Slide 20: How to Use Strategic Intel
How to Use Strategic Intel • Going from reactive to proactive • Building a business case • Prioritize response • Anticipate attacker TTP • Going from threats based to risk based • What do we need to defend against first? Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Vi
Slide 21: Payment System Threat Intelligence
Payment System Threat Intelligence Glen Jones, Sr. Director, VISA, Cyber Intelligence and Investigations Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public
Slide 22: Merchant Data Compromises
Merchant Data Compromises Entry Card data theft Monetization • Hackers targeting internet- • Payment card data is extracted • Payment data is used to commit exposed remote access with specialized, difficult to fraud, often across countries via systems as initial intrusion detect malware coordinated
Slide 23: Point of Sale RAM scraping
Point of Sale RAM scraping Merchant Cardholder network POS ! Issuer Acquirer Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 23
Slide 24: Rise of POS Malware
Rise of POS Malware Privatized malware POS malware functionality • Kaptoxa (BlackPOS), BlackPOSv2, Alina, • RAM-scraping Dexter, BrutPOS, Backoff, FindPOS, • Keystroke logging RawPOS, Poseidon • Command-and-control communication • Nearly undetectable malware sold on underground markets • Data exfilt
Slide 25: Transactional Threat Intelligence
Transactional Threat Intelligence Intelligence comes from recognizing fraud Breach Detection Cycle patterns, predicting fraud activity – Cardholders report fraud to their bank – Banks report fraud to Visa (CPP) – Visa reports fraud to other banks – Breach found, stopped Cardholder Issuing Bank One m
Slide 26: A new approach to Intel: Visa Threat Intelligence
A new approach to Intel: Visa Threat Intelligence Stay One Step Ahead of Hackers With Visa Threat Intelligence | 23 March 2016 Visa Public 26
Slide 27: Visa Threat Intelligence in Action: Case Study
Visa Threat Intelligence in Action: Case Study 1 • Visa or FireEye staff are involved in an investigation in the field* • Malware that was used in the data compromise is discovered and analyzed • Visa or FireEye inputs the Indicators of Compromise (IOC’s) and other information into the Visa Threat I
Slide 28: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp FireEye – FireEye Threat Intelligence Website Visa Threat Intelligence Webinar Series • Retail Threats: April 13, 2016 Visa Data Security Website – www.visa.com/cisp • Hospitality Industry Threats: April 27, 2016 • A
Visa — Visa Threat Intelligence Webinar Series (March 2016) on 6ix