1 / 28

For Payments, the Best Offense is a Multi-Tiered Security and Policy-Based Defense

For Payments, the Best Offense is a Multi-Tiered Security and Policy-Based Defense. Dan Miner, CTP – General Manager, Treasury Services, 3Delta Systems . Friday, June 8, 2012 10:10 – 11:00 AM Plaza B. LEGAL DISCLAIMER.

varana
Download Presentation

For Payments, the Best Offense is a Multi-Tiered Security and Policy-Based Defense

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. For Payments, the Best Offense is a Multi-Tiered Security and Policy-Based Defense Dan Miner, CTP – General Manager, Treasury Services, 3Delta Systems Friday, June 8, 2012 10:10 – 11:00 AM Plaza B

  2. LEGAL DISCLAIMER • Nothing we discuss today constitutes legal advice. For any specific questions, seek the independent advice of your attorney. Furthermore, loremduisautemveleumiriure dolor in hendrerit in vulputatevelitessemolestie on sequat, velillumdoloreeufeugiatnullafacilisis at veroerosloremipsum. Loremduisautemveleumiriure dolor in hendrerit in vulputatevelitessemolestie on sequat, velillumdoloreeufeugiatnullafacilisis at veroerosloremipsumautemveleumiriure dolor in hendrerit in vulputatevelitessemolestie on sequat, velillumdoloreeufeugiatnullafacilisis at veroerosloremipsum. Loremduisautemveleumiriure dolor in hendrerit in vulputatevelitessemolestie on sequat, velillumdoloreeufeugiatnullafacilisis at veroerosloremipsum. Loremduisautemveleumiriure dolor in hendrerit in vulputatevelitessemolestie on sequat, velillumdoloreeufeugiatnulla…

  3. Consumerization of the WorkspaceData: anywhere, anytime on any device • Devices • Tablet PCs • Smart phones • Home systems used to access work assets • BYOD • Angry Birds, anyone? Fun. Harmless (probably…) • How about “DroidDream”? • Social Media • Used as a recon base for phishers

  4. The Fine and Ancient Art of Phishing

  5. I don’t think I bought this….

  6. Oh, NO! My Google Adwordshave stopped working. • Better get right on that!

  7. And, Now I Am Getting Sued (by illiterates). Trough?

  8. And, I can’t even get paid… From:payments@nacha.org [mailto:payments@nacha.org]Sent: Tuesday, February 22, 2011 7:32 AMTo: Doe, JohnSubject: ACH transaction rejectedThe ACH transaction, recently sent from your checking account (by you or any other person), was cancelled by the Electronic Payments Association.Please click here to view report------------------------------------------------------------------Otto Tobin,Risk Manager= = = = = = = = = = = = = = = = = = =

  9. Compromises At All-Time High • More breaches, less stolen data? • Number of breaches almost doubled since 2010 Verizon Data Breach Report • However, record loss decreases • 361 million >> 144 million >> 4 million Verizon 2011 Data Breach Investigations Report

  10. Compromises At All-Time High • It appears that cybercriminals are currently satisfied with compromising Point-of-Sale (POS) systems and performing account takeovers and Automated Clearing House (ACH) transaction fraud. • There has been an increase in these areas in 2010. In relation to prior years, it appeared that there were more data breaches in 2010, but the compromised data decreased due to the size of the compromised company’s databases. • This shows willingness in the cybercriminal underground to go after the smaller, easier targets that provide them with a smaller yet steady stream of compromised data. Verizon 2011 Data Breach Investigations Report

  11. Compromises At All-Time High • There’s been a noticeable increase in account takeovers. • This can be directly related to the continued rise of the Zeus Trojan and other malware variants created to capture login credentials to financial websites. • These account takeovers result in fraudulent transfers from the victim’s account to an account under the control of the perpetrator. Verizon 2011 Data Breach Investigations Report

  12. Increased Scrutiny and Liability Data Collection/Use • Explosion in use of mobile phones and apps has led to increased scrutiny of how providers and application developers are collecting, using and sharing mobile data. • WSJ articles and high-profile breaches spawned a series of congressional inquiries and hearings regarding companies’ data collection, use and sharing practices. • August 2010 – Congress asked 15 companies re: online behavioral tracking • October 2010 – Congress asked Facebook re: sending user identifiers to app developers • April 2011 – Congress asked Apple re: location data on iPhones and iPads • May 2011 – Sen. Franken sent letters to Apple and Google asking companies to require all apps for Apple’s iOS and Google’s Android OS have privacy policies

  13. Legislative and Regulatory Activity Pending cybersecurity bills in last Congress numbered over 45… and many (at least 42) already pending in the 112th Congress, including • Cybersecurity and Internet Freedom Act of 2011 (S.413) • S. 21 - Cyber Security and American Cyber Competitiveness Act of 2011 • S. 1151 Personal Data Privacy and Security Act of 2011 • S. 1223 Location Privacy Protection Act of 2011 • S. 1408 Data Breach Notification Act of 2011 • S. _____ Cloud Computing Act of 2011 • S. _____ Legislation on Securing the U.S. Electrical Grid • H.R. 174 - Homeland Security Cyber and Physical Infrastructure Protection Act • H.R. 2096 – Cybersecurity Enhancement Act of 2011 • H.R. 2577 – Secure and Fortify Electronic (SAFE) Data Act

  14. Legislative and Regulatory Activity Regulatory • OCC Guidance re application security (OCC 2008-16) • HIPAA Security Rule updates (NIST 800-66) • Proposed FTC Privacy Framework (December 1, 2010) • International: EU Cookie Law • FFIEC Guidance supplement to the Authentication in an Internet Banking Environment guidance

  15. Selected Litigation Example Experi-metal v. Comerica (2011). Successful phishing attack led to over $9MM in fraudulent transfers; lawsuit by business against bank; judge rules for business stating “[t]his trier of fact is inclined to find that a bank dealing fairly with its customer, under these circumstances, would have detected and/or stopped the fraudulent wire activity earlier.

  16. PCI DSS – Penalties for Non-Compliance • Failure to comply (or certify compliance) with the PCI DSS may result in fines • Fines for non-compliance can be up to $5K - $10K per month • If you have a data breach and are not PCI-compliant, fines can be as high as $500K (MasterCard®) or $750K (VISA®) • Merchants may also be responsible for any fraudulent charges resulting from the breach and the costs of re-issuing any cards compromised during the breach • In theory, you can be precluded from accepting credit/debit cards if your compliance deficiencies are bad enough

  17. FFIEC Guidance Summary • Not every online transaction poses the same level of risk. • Retail/Consumer Banking: Since the frequency and dollar amounts of these transactions are generally lower than commercial transactions, they pose a comparatively lower level of risk. • Business/Commercial Banking: Online business transactions generally involve ACH file origination and frequent interbank wire transfers. Since the frequency and dollar amounts of these transactions are generally higher than consumer transactions, they pose a comparatively increased level of risk to the institution and its customer.

  18. FFIEC Guidance Summary • Financial institutions should implement layered security, utilizing controls consistent with the increased level of risk for covered business transactions. • Recommend that institutions offer multifactor authentication to their business customers.

  19. FFIEC Layered Defense Suggestions Technical Countermeasures Emphasize Enhanced Authentication • Dual customer authorization through different access devices • Out-of-band verification for transactions • "Positive pay," debit blocks, and other techniques to appropriately limit the transactional use of the account • Internet protocol [IP] reputation-based tools to block connection to banking servers from IP addresses known or suspected to be associated with fraudulent activities

  20. FFIEC Layered Defense Suggestions Policy/Activity-Based Countermeasures Emphasize Usage Management • Fraud detection and monitoring systems that include consideration of customer history and behavior and enable a timely and effective institution response • Enhanced controls over account activities, such as transaction value thresholds, payment recipients, number of transactions allowed per day and allowable payment windows [e.g., days and times]

  21. FFIEC Layered Defense Suggestions Policy/Activity-Based Countermeasures Emphasize Usage Management (con’t.) • Policies and practices for addressing customer devices identified as potentially compromised and customers who may be facilitating fraud • Enhanced control over changes to account maintenance activities performed by customers either online or through customer service channels • Enhanced customer education to increase awareness of the fraud risk and effective techniques customers can use to mitigate the risk

  22. Layered Security Model • Begin with the assumption your client’s systems are compromised. • Can you do business? • Contemporary systems are being developed to robustly and repeatedly answer: • Who are you? (Authentication) • Where can you go in the system? (Authorization) • What can you see when you get there? (Authorization) • What can you do when you get there? (Authorization)

  23. Layered Security Model • And allow these rights and permissions to be assigned at various levels through the organization with vigorous logging and auditing capability (Accounting)

  24. Layered Security Model:Data Tokenization • Investigate new methods of reducing risk such as data tokenization as means of removing the valuable and risky data from systems • Valuable data is replaced by value-less data: Credit card number “4111 1111 2222 3333” is replaced by “PG43J74F” or otherwise useless-to-the-criminal values • Tokenization reduces the scope of PCI efforts as the presence of a “cardholder data environment” can be reduced or eliminated Why do ants show up at a picnic? It’s where the food is.

  25. Summary • Corporate risk management is really getting interesting • The number of devices and systems that directly or indirectly access financial systems are exploding and innovation is outstripping controls • Criminal malware is very good, very prevalent, and very hard to detect • Account takeover cases are exploding

  26. Summary (con’t.) • Legal and regulatory consequences and impacts on corporate operations are numerous, complex and ambiguous. Rights and responsibilities are still being defined. • Corporate as a consumer of banking / financial services • Corporate as the provider of systems to its customers • Layered security and control models emphasizing multiple measures and countermeasures are the recommended solution

  27. Questions / Discussion

  28. Presenter Dan Miner, CTP General Manager, Treasury Services 3Delta Systems, Inc. Dan.Miner@3DSI.com (w) 703.234.6016 www.3DSI.com

More Related