Retail Security and Compliance Where On Earth is it Headed?

Transcription

1 Retail Security and Cmpliance Where On Earth is it Headed? An verview f the retail sectr s IT threats and hw t be mre effective in preventing them.

2 Agenda Intrductin Retail in the news Why cyber security is imprtant? Where are the threats? What can yu d? Additinal Resurces Questins?

3 Abut Calfire Calfire is a funding member f the PCI Security Standard Cuncil s (SSC) prgram fr Qualified Security Assessrs (QSAs) and has been a QSA under Visa s CISP initiative since We are als an Apprved Scanning Vendr (ASV) and Payment Applicatin Qualified Security Assessr (PA-QSA). We have cmpleted mre than 4,000 PCI prjects fr merchants, service prviders and payment applicatin develpers and we are recgnized as ne f the tp five assessrs based n the number f Reprts n Cmpliance cmpleted fr service prviders and Reprts n Validatin cmpleted fr payment applicatin develpers.

4 Our clients include 4

5 Abut Jeff Messer Senir IT Security Cnsultant 15+ years f infrmatin technlgy and business experience. Extensive experience in delivering security assessments, cmpliance auditing, general IT and applicatin cntrls assessments and system develpment reviews Industries Retail, higher educatin, healthcare, transprtatin, banking, finance, entertainment and leading edge technlgies. Hands-n experience in develping and implementing IT security strategy, directing and managing an IT department and knwledgeable in varius areas including: Netwrk & Systems Security Risk Management Vulnerability Assessments Authenticatin & Access Cntrl System Mnitring Regulatry Cmpliance Systems Integratin Planning Penetratin Testing Certificatins CISSP - Certified Infrmatin Systems Security Prfessinal CISA - Certified Infrmatin Systems Auditr QSA - Qualified Security Assessr

6 Retail in the news US FBI Warns Retailers f Further Cyber Attacks Similar t Target Data Breach Target - 40 millin payment card recrds and 70 millin custmers' recrds Neiman Marcus millin cards Michaels (2 nd breach) Sally Beauty - 282,000 cards Sears? Accrding t the FBI there were 20 infectins with BlackPOS. S far, Target and Neiman Marcus are the nly tw t g public.

7 Why cyber security is imprtant? Increasing reliance n technlgy Attacks are increasing faster than ability t stp them Lts f mney can be made frm stealing the data Public image can be tarnished quickly Crprate espinage Federal agencies mving t the clud

8 Where are the threats? POS Sftware Mbile POS Remte Desktp/Terminal services Wireless Access Access rights Outsurcing managed services Unencrypted data ver the netwrk SQL injectins Weak cntrls

9 POS Sftware Have yu patched yur POS devices lately? When was the last time yu upgraded? D yu perfrm any vulnerability scans? Have yu turned n lgging? PA-DSS and P2PE certificatin ptins Magnetic Card Reader POS

10 Mbile POS Using an ipad r mbile POS device ver wireless? Hw is the device secured? Is the data cached lcally? ipad running POS

11 Remte Desktp/Terminal Services D yu have a device plugged int the internet? If they use cellular r 3G/4G, where is the firewall? Digi Internatinal Wireless Radi Lantrnix Netwrk Access Server WIFI and Web Access fr Ethernet Devices Ethernet Switches

12 Wireless ruters Hw is yur netwrk setup? Have yu perfrmed a wireless assessment? Rgue access pints? Wireless Access Pint/Ruter

13 Access rights Generic and shared accunts? Default accunts? Default passwrds? User = Passwrd? Segregatin f duties? Lgging f rt r admin accunts? User Accunt reviews? User and Access Rights Administratin

14 Outsurced managed services What have yu utsurced? Have yu checked yur cntract? Are yu mnitring their wrk? Third-party administrating firewall rules

15 Unencrypted data ver the netwrk Have yu prperly segmented yur netwrk? It s a private/crprate netwrk, that s safe, right? Where des respnsibility begin/end fr sending data? We nly send unencrypted data acrss trusted netwrks. Sniffing the wire

16 SQL Injectins Have yu escaped r blacklisted any cmmands? Have yu limited the database permissins f the web app? Have yu restricted the type f cmmands, r applied parameterized statements? SELECT * FROM users WHERE name = 'a';drop TABLE users; SELECT * FROM userinf WHERE 't' = 't'; Sample SQL Injectin Line

17 Weak cntrls When was the last time yu perfrmed a risk assessment? D yu have an external, independent auditr? Are yu experiencing high turnver? D yu d perfrm backgrund checks? We rely n a third-party and they d it

18 What can yu d? Firewall management Segment yur POS netwrk Training PCI cmpliance Pint-t-pint encryptin (P2PE) Deply a Security Infrmatin and Event Management (SIEM) t mnitr netwrk events Use tw-factr authenticatin when accessing payment prcessing netwrks. Mnitr alerts frm Visa, MasterCard, and Amex Ensure yu are using certified hardware and sftware Whitelist prgrams

19 Enhance yur existing cyber security Scial engineering Penetratin testing Applicatin penetratin testing Wireless assessment IT risk assessment POS frensic testing Vulnerability scanning IT Audits

20 Tp 5 trends that we see ahead 1. Cyber attacks are ging t cntinue t increase in frequency, cmplexity and scale. 2. Mbile is n lnger the exceptin. 3. The mve t clud cmputing will shw demnstrable cst savings but will add new risks 4. Data breaches will cntinue t drive new security standards and spending 5. Infrmatin risk management is n lnger an IT prblem its a bard prblem.

21 Additinal resurces Whitepapers, webinars, blg What t d if yu are cmprmised? Respnd t a breach? h.pdf Identity Theft Resurce Center ITRC Breach Reprt ww.idtheftcenter.rg/images/breach/itrc_breach_reprt_2014.pdf 2014 ITRC Breach Stats Reprt Incident Respnse - Best Practices Data Breach Respnse & Preparatin - Interactive Breach/Hacks Diagram

22 Fr additinal infrmatin, cntact Jeff Messer Senir IT Security Cnsultant Calfire Bake Parkway, Suite 100 Irvine, CA Office: (949) x7089 Cell: (949)