Wednesday, May 27, 2009

Barney Frank Easily Gaining Co-Sponsors

It is not taking Representative Barney Frank long to convince fellow lawmakers that the current laws regarding Internet gambling in the US are outdated. Late last week four new co-sponsors signed on to support the Internet Gambling Regulation, Consumer Protection, and Enforcement Act.

With the four new co-sponsors, the Bill now has twenty-three co-sponsors to date. All four of the new sponsors are Democrats, three from New York, and one from California.

Of course, California may actually beat Frank to the punch when it comes to legalized online gambling. State lawmakers are discussing a plan that would make online poker legal in California. It is a plan that has tremendous support among the citizens of California.

Continue Reading at New Online Casino's dot Org

Barney Frank, Online Gambling, Co-Sponsors, Democrats

13 Hottest Fraud Schemes You Can Prevent

http://www.bankinfosecurity.com/articles.php?art_id=1490

The fraud fight is getting nastier by the minute, say experts familiar with the new schemes - and some old ones with new wrinkles -- being perpetrated by criminals against financial institutions and their customers. Here are 13 of the most prevalent ruses.

#1 - Credit Bust-Out Schemes

#2 - Customer Loan Account Takeover

#3 - Corporate Account Takeovers

#4 - Cross-Channel Call Center/Online CD Purchase Scam

#5 -- Wire Fraud Account Grooming

#6 -- In-Session Phishing

"A somewhat recent tactic being perpetrated by fraud rings --"in-session Phishing" -- has emerged as one of the chief threats to thebreach of secured online assets. These attacks utilize vulnerabilitiesin the Javascript engine found in most of the leading browsers,including Internet Explorer, Firefox and even Google's Chrome, notesEisen.

How it happens: Utilizing a host website that has been injectedwith malware acting as a parasite, this parasite monitors for visitorswith open online banking sessions or similar protected asset sites(such as brokerage or retirement planning sites).

Using the Javascript vulnerability, the parasite can identifyfrom which bank the victim has a session currently open by searchingfor specific sites pre-programmed in the malware itself. "There are nolimits to the volumes of URLs a website hosting the parasite can testfrom the victim's machine. The malware asks: 'is my victim logged ontothis XYZ bank website' and their browser replies either yes or no,"Eisen says.

Once any site from the list is confirmed to be "in session," apop-up claiming to be from the bank issues a warning. Most warningsappear as time-out messages stating "For security purposes your bankingsession has been terminated. To continue your session please re-enteryour username and password here (supplied link by fraudster)."
Once an unknowing victim complies, clicks the link and entershis/her credentials, the damage has been done and the attack wassuccessful and the game is over - right?

In most cases it would be devastating for a victim after theircredentials had been breached; expecting the fraud rings to quicklybegin selling off this information or pillaging through the victim'saccount. Since many financial institutions rely on cookies or tags todiscern one device entering user credentials from another, and thencount on fairly common (and easily answered by crooks) out of walletquestions - to validate a new device attempting access, this would betrue.

However, simply by utilizing a robust device ID technology -which creates the equivalent of a device fingerprint for every machineattempting to log on to a banks site, coupled with historical negativelists of known bad devices, "financial institutions could rendercredential breaches using in-session or any other type of phishingattack useless to the fraudster," Eisen says.

The power lies in knowing what a suspicious or fraudulentattempt looks like upon log-in. "If you know a legitimate customer mostalways uses a device configured for local New York time and thelanguage for this device is English, you would not provide unchallengedaccess to this account from a machine showing to come from China andhaving a default language set to Mandarin," Eisen says.

Further strengthening against future attacks, placing thedevice fingerprints gleaned from all known previous fraudulent attemptsinto a negative list effectively blocks the devices with a history offraud from ever gaining access to another user account. "

#7 -- ATM Network Compromises

#8 -- Precision Malware Strikes

#9 -- PIN-Based Attacks

For the past 10 years, Verizon Business has tracked metrics andstatistics from IT investigative cases, including incident response,computer forensic and litigation support, across the globe.

The VerizonBusiness' just-issued 2009 Data Breach Investigation Report, shows moreelectronic records were breached in 2008 than the previous four yearscombined, fueled by a targeting of the financial services industry anda strong involvement of organized crime, says Bryan Sartin, director offorensics and investigative response at Verizon Business.

Driving this explosion in compromised records are moresophisticated attacks, specifically targeting the financial sector. Infact, 2008 saw three of the world's largest known data compromises onrecord.

With many large individual compromises over the past twoyears, the value of payment card, check, and other forms of consumerdata on the information black market are on rapid decline, says Sartin."

Just two years ago, magnetic-stripe sequences sufficient forcounterfeit were priced at an average of $14 per record, while todaythat cost has dropped to as little as 20 cents," he says. "Cybercrime,it seems, chases the almighty dollar."

Last year showed a sharp increase in attacks againstcounterfeit sequences plus the corresponding cardholder PIN value,leading to the direct theft of consumer assets, Sartin notes. "The leadindicators of these types of crimes were not based on the conventionalanalysis of signature-based counterfeit fraud patterns to find commonvalid transaction points within legitimate spending histories. Instead,bank customers were suddenly reporting zero balances in checking andsavings accounts, alleging fraudulent ATM withdrawals." As more andmore similar complaints surface, it became easier to pinpoint thelikely source of compromise, whether it be a bank, data processor, orpayment gateway, Sartin says.
Verizon Business tracked at least three different techniquesduring 2008. Until recently, many PIN-based attacks were known to bepossible but no credible evidence of them being used in real-worldincident has ever surfaced. That has since changed as attacks againstPIN information are on the rise, setting the stage for moresophisticated forms of identity fraud.

#10 -- Account Manipulation
.
#11 -- Fraud Pattern Changes

#12 -- Foreclosure Prevention Schemes

#13 -- Builder Bail-Out Fraud

International Credit Card Fraud Ring Dismantled in NYC

Banking / Finance News
Source: Queens District Attorney's Office
Complete item: http://www.queensda.org/newpressreleases/2009/may/operation%20plastic%20pipeline_05_2009_ind.pdf

Queens District Attorney Richard A. Brown, joined by Police Commissioner Raymond W. Kelly, today announced that an international forged credit card and identity theft ring based in the New York metropolitan area and with roots in Nigeria has been successfully dismantled following the indictment this week of forty-five individuals.

The ring - which was comprised of three separate identity theft and forged credit card groups that employed multiple cells - is alleged to have been responsible for stealing the credit cards and personal credit information of thousands of American and Canadian consumers, costing these individuals, as well as financial institutions and retail businesses, more than $12 million in losses over the past year alone.

District Attorney Brown said, "Our investigation reveals that - in terms of just the sheer number of people indicted - this is one of the largest identity theft networks uncovered in recent history and is just possibly the tip of a much larger global credit card trafficking operation.

Besides draining the bank accounts of individuals throughout North America, we believe that the defendants - some of whom live in California, Illinois, Maryland, Pennsylvania and Toronto - also shipped stolen or fraudulently obtained credit cards to buyers around the world and that purchases were made in such far-off places as Japan, Saudi Arabia and Dubai. Particularly disturbing is that we have no way of knowing if any of these accounts have fallen into the hands of terrorists and are being used to finance their terrorist activities or to undermine the efforts of homeland security and other law enforcement officials intent on keeping our borders and citizens safe.

Such a serious threat to public safety cannot go unchallenged. We will continue to work closely with our law enforcement colleagues to stamp out such fraud and help to maintain our nation's safety and security."

ATM Skimminig Is Reaching Epidemic Proportions

ATM Skimming on the Rise

Source: The Frederick News-Post Online - Frederick County Maryland Daily Newspaper

ATM card skimming on the rise
Originally published May 27, 2009 By Ike Wilson | News-Post Staff

ATM card skimming on the rise

The PNC Bank automated teller machine at 191 Thomas Johnson Drive was rigged with a skimming device in April, Frederick police said. It's called "skimming," and ATM users worldwide are losing millions. The ATM Industry Association describes skimming as one of the industry's most recurrent fraud threats. The practice hit Frederick in April, when the PNC Bank automated teller machine at 191 Thomas Johnson Drive was rigged with a skimming device, Frederick police said.

The hardware recorded card numbers of customers using the ATM. Police think a video recording device was placed near the ATM to capture personal identification numbers entered into the machine. PNC Bank spokesman Fred Solomon said bank policies prohibit him from speaking about security or theft matters, including details about how many were affected by skimming at the Thomas Johnson Drive branch. Customers with unidentifiable transactions on their statements should contact their local branches, Solomon said.

Just over 4,500 of the 11,360 ATM crimes recorded by the ATM Industry Association Global Cognito crime data management system for 2005 through 2008 involve skimming, according to association CEO Mike Lee.

"It's probably the most widespread crime type we face," Lee said. The association defines skimming as the unauthorized capture of magnetic strip information by modifying the hardware or software of a payment device, or through the use of a separate card reader. Skimming is often accompanied by the capture of customer PIN data.

Skimming is one of the financial industry's fastest-growing crimes, according to the U.S. Secret Service, which investigates bank fraud.

The ATM Industry Association has reported more than $1 billion annually in global losses from credit card fraud and electronic crime associated with ATMs. Last week, the ATM Industry Association launched an international Anti Skimming Forum to counteract the growing trend. Skimming is a problem that will continue to increase until technology brings it under control, Lee said. "The technology exists today to help defeat the problem," he said.

According to Bankrate.com, ATM skimming devices come in two types: ones that interfere with the ATM operation and ones that don't. The skimmers that interfere with the ATM operation are easier to detect, because even though customers insert or swipe their cards, it's not the ATM's card reader so the ATM isn't actually being used and the customer isn't getting any money.

In other skimming cases, the thieves don't interfere with the normal operation of the ATM. The skimmer is placed over the card reader but doesn't block off the reader, and the customer gets money when making a withdrawal. Credit and debit card abuse may also happen at cash registers during purchases. Pay a restaurant tab with a credit card and you have no idea what the waiter might be doing with the card when it's out of your sight, according to Bankrate.com.

The mission of the ATM industry's new forum is to measure the global impact of skimming through the pooling and analysis of data. It is also to write best practices for preventing and reducing skimming. This will include a global skimming classification system. Industry officials also want to increase sentences for skimming convictions to create a stronger deterrent. Lee thinks more can be done in terms of educating customers to protect their PINs by covering the hand used to key in the PIN at an ATM so someone cannot learn the code. This simple measure alone would significantly reduce the success rate of skimming attacks, he said.

atm skimming, skimming, card skimming, PIN, Debit, Credit, ATM Card Skimming

Moble Phone Location Technology to Cut Into Card Fraud?

Source: Network World
Complete item: http://www.networkworld.com/news/2009/052609-mobile-phone-location-technology-fights.html

Description:
Ericsson is courting major banks with a security service the company thinks could cut down on credit card fraud as well as eliminate an inconvenience for travelers using cards overseas.

Banks are increasingly blocking credit card transactions in certain high-risk countries due to increasingly levels of fraud. A business traveler who lives in the U.K. but goes to Russia can likely have a transaction rejected if the person hasn't informed the credit card company of their travel plans. It's embarrassing and inconvenient.

Ericsson's IPX Country Lookup service uses a person's mobile phone to provide a confirmation that a person is actually in the country where the transaction is carried out, said Peter Garside, U.K. and Ireland regional manager for Ericsson's IPX products.

For the service to work, Ericsson's technology must be installed on a mobile operator's network. Once installed, Ericsson will pay the operator a "small fee" every time a bank wants to verify a certain transaction by one of their customer's mobile phones, Garside said. Ericsson will then put a margin on the lookup fee and charge that to banks, he said. The lookup fee hasn't been set yet.

Garside said that Ericsson has figured out how to extract the location information from operators worldwide. The technology only identifies what country a person is in and not where they exactly are in that country. It only works for GSM networks.

To allay privacy concerns, Ericsson is recommending that the banks should get consumers' consent prior to using the transaction verification service. Once a person's approximate location has been passed onto the banks, that data will not be held any longer, Garside said.

The service will work even if someone's phone is off, but as long as they've turned the phone on at least once when they're in a new country. Mobile phones will register with the local operator when turned on in a different country, so Ericsson will be able to query the last known location.

The service comes out of Ericsson's IPX product line, which enables third parties to bill for ring tones or other content via mobile networks.

Garside said operators won't incur any costs to integrate the service into their networks and can make money from the location information they hold. "The operators are sitting on some valuable assets," Garside said.

E-Secure-IT
https://www.e-secure-it.com

Heartland's New Strategy - Segment Data into Jigsaw Pieces

Below is an interview with Evan Schuman the Editor at StorefrontBacktalk.com regarding Heartlands new strategy which is basically to segment the data into a jillion pieces to make it harder for hackers to to grab the data. Read the original article by Evan Schuman at StorefrontBacktalk.com

Consumerist - Credit Card Processors Launch A New Strategy To Defeat Theft - heartland

This fall, credit card processors will being rolling out a new approach to preventing data theft, based on the assumption that it's impossible to thwart every attack. Instead of keeping 100% of criminals out, they'll segment and encrypt the data into such small chunks that it will no longer be a cost-effective crime.

We spoke with Evan Schuman, the editor and publisher of the blog StorefrontBacktalk.com, which broke the story earlier this month. Schuman has spoken directly with representatives of Heartland—which announced its own massive data breach a few months ago—and says they'll roll out this new approach around October of this year, and that other processors are working on similar solutions. It involves new point-of-sale hardware that can encrypt each day's batch of credit card numbers separately, then shuttle each daily pack off to Heartland's data centers for archiving.

It's a better approach than what we currently have. For one thing, retailers will no longer have any reason to store credit card numbers. But it's not an ideal solution and there are some definite costs, as Schuman points out below. In fact, there's a much better end-to-end encryption solution that we could already be using but aren't simply because it's not as profitable for card companies like Visa and Mastercard.

Consumerist:
So what is it that Heartland is proposing?

Evan Schuman, StorefrontBacktalk.com:
"Historically security has always been based on, 'You build a really good deadbolt, you keep the bad guys out. And if they come in you set it up so that you'll learn about it quickly and engage in pursuit.' What they're saying here is, you know as a practical matter, let's be a little smart about this. First of all we really can't keep the bad guys out. Trying to do that is futile. Might as well let 'em in, and let them steal a certain amount of data, and let them go. A, they're going to anyway, and B., if you do it that way, you make sure they don't get enough data that they can profitably sell. If you do that, they're not going to steal it, or at least not very often, because they're not going to make money that way.

"So it's really about segregating data, so instead of having 50 GB of data here, you've got in a thousand different locations small quantities of data. They may get through that. Fine. They're not going to make any money off of that, and it's not cost-effective to break in at 50 different locations. It's like instead of having a million dollars in your house, you've got 5 dollars in 200,000 houses. They'll have to break in that many times, and each time there's a risk of getting caught. It's not worth it.

"Right when we broke the story, [we found out that] two other major processors, including one that's larger than Heartland, were working on essentially the same thing, with their own proprietary angle."

"Proprietary" sounds expensive.

"What it means is that there are a variety of proprietary efforts out there. Today, it's pretty easy for a retailer, if you don't like your processor, you go to another one. It's really not that big a deal to switch. But with this, now they're going to have all this hardware that only works with processor 3, and now it's much more difficult for [retailers] to shift, particularly when multiple processors are doing it. So it's going to be a whole lock-in time for retailers where they're going to have to stay if they let this happen."

A commenter on your story points out that this will separate retailers from their own data.

"I checked with our people at Heartland and they said, 'Well, yeah, that's kind of true.' When a retailer uses their own credit card—for instance, when Sears uses a Sears credit card—they're going to have to pay a processor to unencrypt their own data. In other words, you'll be paying someone else to give you access to your own data. And if you start following through the logic of that, there are a lot of issues."

Heartland calls this an end-to-end solution, but you and your readers have pointed out that this isn't really true.

"This is not end-to-end, this is not even close to end-to-end. End-to-end really refers to, you take a credit card off the factory line, when they print the credit card, before the consumer gets it, before anyone can steal it, on the factory floor it's encrypted. And it stays encrypted all the way through to the processor and even beyond to the card brand. Now that's end-to-end encryption. You can steal it at any point—the consumer never has it unencrypted in their hand. Neither does the retailer, you completely bypass them.

"What these guys [Heartland] are doing is kind of, 'Well, a little bit to the right of middle, to the middle of middle'—which just doesn't have as much of a marketing tone."

So why isn't the end-to-end approach being pursued? Is it too technologically difficult?

"No, it's not difficult at all. First of all, in Heartland's defense, and any of the processors' defense, it's beyond their power to do it. They don't ave the ability to do that, they don't own the card.

It would have to be at the Mastercard or Visa level...

"Exactly. And Visa, among others, doesn't want to do this because they would have to pay for the technology to unencrypt at their end. They would rather have it unencrypted. They insist that you send it in the clear, unencrypted, across a proprietary network. That's they way they've done it for decades.

"The card brands, they don't want to pay for end-to-end encryption, they have not supported it. They say, 'Oh, we'll consider it, we'll talk about it,' but they don't want to do that. They can see that's the best way to go, but they don't feel like doing it, and no one in Congress is forcing them to do it. Even the latest credit card overhaul, they didn't even come close to security issues. It was all about interest rates. No one is forcing them to do anything in terms of security, so why should they. So the processors are saying, 'Well, we're doing what we can here.'

"This doesn't solve the problem, it won't even materially reduce the problem, but it's a definite improvement in security. It's safer, it's better than what exists today. It won't resolve everything, but it's better than today."

So, how likely is it that Heartland's approach will happen?

"As far as Heartland is concerned, this is definite, they're going to have it out by October.

"Now, retailers who are Heartland's customers have got to buy it. As far as I can tell, no one has bought this yet, so in theory if no one ever does... It's sort of like a car company that puts out a car. Is the car definite? Yes, it's going to roll off the assembly line and be in showrooms, assuming there are showrooms any more, but if no one buys it it won't be out there for long.

"So this will definitely be introduced by Heartland. Whether anyone buys it has yet to be seen. I'm guessing some will. Heartland can deeply discount it to the point where it will be easy for them to do. But the cost is not really in the cost of the hardware, although if it's a large chain, that can add up quickly. The cost is in making the change and then making it much more difficult for yourself to move later if you feel like it."

We're reporting on this on Consumerist because it reveals a little of the world of credit card processing and data security—the part of the retail chain that we never see, but that affects us at the register and after we leave the store. Schuman points out that whether the new data segmentation approach takes off or not, things won't change for the consumer experience—it's all pretty invisible from our side of the register.

What it could affect, however, is the cost of transactions for the retailer, and consequently it could impact prices at the register. Whether that's worth it to implement a better security approach remains to be seen.

If you're interested in how retailers approach the issue of data security, you should check out StorefrontBacktalk.com.

Heartland Payments Systems

Security Experts Sound Alarm Over Insider Threats

Security Experts Raise Alarm Over Insider Threats

Economic troubles raising the stakes on potential threats, FIRST members say

May 26, 2009 | 06:18 PM
By Tim Wilson |DarkReading

Security researchers and other experts are turning up the heat on insider threats, warning enterprises that the problem is growing and could prove devastating for many enterprises.

In preparation for its meeting in Japan next month, the Forum of Incident Response and Security Teams (FIRST) issued a press release in which its senior officers urge organizations to step up their efforts to protect themselves from insider attacks, saying that many are "ill-prepared for an onslaught which could prove calamitous."

"One of the greatest security threats of our times is from insiders, as organizations lay off tens of thousands of workers," said Scott McIntyre, a FIRST steering committee member and representative of the Netherlands-based KPN Computer Emergency Response Team (CERT). "People know the axe is coming, and the longer employers prolong the swing of that axe, the more danger they expose themselves to, either from sabotage or data theft. An employee who thinks he or she is [going to be laid off] can start fouling up systems which are critical to the organization, or decide to take an unauthorized pay-off by stealing a mass of data."

Continue Dark Reading

insider threat, FIRST, Forum of Incident Response and Security Teams, Verizon

Aite Group Releases New Report on Mobile Transactions Landscape

A New Report From Aite Group

The Mobile Transactions Landscape: Mapping New Territory

By understanding the various initiatives around the globe, and what failed and what succeeded, financial
institutions and other players can better tailor their own solutions.

BOSTON — A new report from Aite Group LLC examines mobile transaction initiatives that are currently happening around the globe. The report, based on quantitative and qualitative research of 69 mobile transaction initiatives internationally, explores the current range of services in development and the underlying technologies powering each initiative.

Following an initial wave of mobile transaction initiatives at the turn of the century, developers are again active in bringing mobile transaction services to market. The technological evolution of the mobile device and mobile networks, coupled with increased end-user savvy, has led to an increase in mobile transaction initiatives over the past five years. By understanding the various initiatives around the globe and what failed and what succeeded, financial institutions and other players can better tailor their own solutions.

"Card networks, financial institutions, mobile operators and industry associations can separate hype from reality by not focusing on mobile transaction initiatives that are purely vendor-driven," says Nick Holland, senior analyst with Aite Group and author of this report. "One of the most critical questions that any stakeholder can ask of a 'new' mobile transaction initiative is this: 'Who has done this already and what was the outcome?' Invariably, any mobile transaction initiative will already have been done elsewhere. To state that is has not, means that due diligence has not been performed adequately."

This 41-page Impact Report contains 32 figures. Clients of Aite Group's Retail Banking service can download the report
by clicking on the icon to the right.

Fed Should Have Larger Role in ePayments: Hoenig

Feds should have larger role in e-payments: Hoenig

FRANKFURT - The US Federal Reserve should play a bigger part in the development of electronic retail payment systems, a top Fed official said on Monday.

'In light of the trend toward greater industry concentration and the existence of important payments system externalities, the Federal Reserve should play a larger and more active role in electronic retail payments,' Thomas Hoenig, president of the Kansas City Fed, said in the text of a speech to be given at an European Central Bank conference in Frankfurt.

Mr Hoenig also said that it was unlikely more competition in the payment systems would emerge without the Fed's participation, especially at current times when capital is scarce and expensive.

Mr Hoenig, who is not a voting member of the central bank's Federal Open Market Committee in 2009, did not comment on the economic outlook or interest rates in his speech.

The US central bank has cut interest rates to near zero and committed to massive lending and securities purchases to heal shattered financial markets and pull the economy out of the longest recession since the Great Depression. -- REUTERS

Thomas Hoenig, ePayments, US Federal Reserve

Rebuttal from SPSP (Society of Payment Security Professionals

Society of Payment Security Professionals - Compliance Demystified

End to End Encryption & Tokenization…is this really a debate?
May 26th, 2009 by cmark Posted in PCI DSS | No Comments »

I just finished reading an article in the Greensheet related to end to end encryption. While the article does a very good job at showing the different angles and arguments for and against the concept, it is disturbing that the concept is being summarily dismissed by some people in the industry. I have been fortunate to have worked with a number of companies that have developed end to end (actually point to point) and tokenization type solutions. These solutions represent a very big step forward in data security within our industry.

On the third page of the article it states that “…it is generally thought that even unencrypted data is safe when the PCI DSS is strictly followed.” Having been a QSA, card brand employee, and QSA trainer that has worked with over 100 very large banks, processors, and merchants, I can tell you definitively that not a single one with which I worked was able to ’strictly’ follow the PCI DSS in such a way as to make unencrypted data “safe”.

There is an argument in the article against tokenization that says: ”the risk is focused upon a particular entity, as opposed to spread out among various entities.” Really? This is an argument against tokenization? Keep in mind that Tokenization solutions are offered primarily by gateways and that gateways have their merchant’s data anyhow. These tokenization solutions remove data from the merchants that don’t really need it. Instead of 1,000 potential points of compromise, you now have a single point of vulnerability (the gateway). Regardless of whether they were offering a tokenization type solution or not, the gateway would be a target for data thieves. The person who made the previous statement then goes on to say: “And you are reliant upon a single entity, that entity has to be hardened and secured beyond any potential doubt.” Any potential doubt? This is difficult to understand. Is he saying that this entity must be PCI DSS compliant? If we are conceding that the PCI DSS represents the “best line of defense against a data compromise” as also stated in the article is it not enough to ask the companies providing the tokenization solutions to be PCI DSS compliant? As we all know, there is no guaranteed security.

Consider the following scenario. Gateway X provides payment processing services for 5,000 level 4 retail merchants. These level 4 retail merchants are using an IPOS provided by some VAR. They don’t have a firewall, IDS, or a security policy. While they are required to comply with the PCI DSS, they are not required to validate. Furthermore, even if they were required to validate, they simply do not possess the technical aptitude to install and maintain a web application firewall, intrusion detection system, file integrity monitoring or many of the other 230+ sub requirements. When they accept a card for payment, the data is stored locally on their IPOS and sent to their gateway for follow-on processing. In this situation, do you have 5,001 points of potential compromise? No, you likely have 7,001 or more as many of these merchants have more than a single POS or location. Since Gateway X already has the merchant data, they offer to allow their merchants to NOT store the data and instead provides a token for the merchant to store. Now we have reduced the points of vulnerability from 7,001 to a single point of vulnerability (the gateway). Gateways generally have the technical ability and the vested interest in protecting the data. Is there a risk that they will be compromised? Certainly. Have we reduced the risk to that data? It is hard to understand how we have not.

Let me be clear. We are a long ways off from end to end encryption being employed in most large merchants. Most level 4 retail merchants however can benefit from tokenization type solutions and end to end encryption solutions. In fact, while this is not public knowledge, I personally know of three Level 1 retail merchants that have removed nearly all of their data through tokenization solutions.

Is there a potential vulnerability in these solutions? Sure there is. Are these solutions appropriate for all merchants? Certainly not. Can many, many of the 6 million plus level 4 merchants (that are not currently compliant with the PCI DSS) benefit from these types of solutions? Absolutely!

Bob Russo states in the article that: “We (the PCI SSC) will continue to advocate for the PCI standards as an organization’s best line of defense against data compromise.” My question is; “Why do the concepts of PCI compliance and end to end encryption or tokenization have to be mutually exclusive?” Consider PCI compliance as a spectrum. On one end you have 233 requirements with which you must comply. On the other end you have a handful of requirements. The number of requirements is predicated upon whether you store, transmit, or process data, and in what manner. If I use tokenization for nothing more than replacing stored data, I have just removed a huge technological and administrative burden from my company. Simply not having to “Protect Stored Data” as per 3.4 of the PCI DSS, saves me a huge amount of money and complexity. By using tokenization, I have addressed 3.4 of the PCI DSS.

I find it unbelievable that we would be having a debate as to the value of end to end encryption and tokenization. When I was training QSA’s I used to really enjoy the hard core techies that could come in and make a compelling argument that any form of encryption was worthless. Many of these were folks that had come from the various government agencies and would make very compelling arguments. Truth be told, however, we are not in the “absolute security” business, we are in the “risk management” business and tokenization type solutions and end to end encryption solutions represent better risk management for one reason….they REMOVE THE DATA. No Data, No Risk to the data.

In reading the article, it was obvious that some of the people had a vested interest in seeing such solutions discounted. This is expected. My suggestion is that as a merchant you take a long hard look at these ‘alternative solutions’. Because we love you, we are providing (free of charge) some companies that offer good solutions. If you know of any more, please post them here in the comments!

* TrustCommerce (end to end w/vault)
* ProPay (end to end w/vault)
* Shift4 (Tokenization w/vault)
* MerchantLink (Tokenization w/vault)
* EPX (Tokenization w/vault)
* PPI (end to end w/vault)
* BrainTree (end to end w/vault)
* Network Merchants (tokenization I think)
* MagTek (encrypted MagStripe Reader supports End to End)
* Semtek (encrypted MSR supports End to End)
* HomeATM (encrypted Pin Entry Device; PED2.0 Approved)
* VeriFone (end to end; for IPOS)

Tuesday, May 26, 2009

BSMS Part Deaux!

It was nice that Javelin Strategy and Research took the time to write about HomeATM in their analysis of Finovate Startup09 but I'm a little confused about something they say in their report. Maybe a reader might be able to clarify what they mean. Cause right now I've got kindova BSMS (Both Sides of the Mouth Syndrome)...taste in my...well, for lack of a better word, "mouth." Editor's Note: You may click the picture to enlarge and read.

Why do I say BSMS? Welll..in the first portion of Javelin's analysis of HomeATM, they say that our Safe-T-PIN device provides (the more secure) card present (vs. card not present) credit card transaction and the "even more secure" PIN Debit transaction. Here's their quote:

"Launched in April 2009, P2P Safe-T-PIN offers home-based “card present” credit card and PIN debit transactions online using a PCI-certified device attached to a personal computer through a USB port. Users also could make online purchases by swiping their credit card or debit card and PIN at checkout. The device allows for secure real-time money movement with an option for delayed transactions."

Then, after stating that, the next thing they say is:

There is greater potential for HomeATM as a frequent high-value P2P solution such as a Western Union money transfer than for enabling e-commerce. Many consumers may be hesitant to swipe their ATM cards on hardware attached to their computer because of security concerns.

Therein lies my confusion. First they state that our PCI certified device allows for "Card Present" and "Online PIN Debit" transactions, along with the statement that our "device" ALLOWS SECURE REAL TIME MONEY MOVEMENT" and then in their next breath they say, that many consumers may be hesitant to use that very same PCI 2.0 Certified PIN Entry Device because of security concerns?

Did they possibly mean to imply that many consumers may be hesitant to swipe their ATM cards on hardware attached to their computer because they don't want "improved" security? Someone help me out here! I'm not being sarcastic. I'm being serious. Okay, I admit...I'm being "totally" sarcastic.

But there's good reason. In fact 117 good reasons. You may have noticed when you first visited the blog, there was a popup that appeared asking if you would please partake in our survey. (and I hope you have, if not please do, just refresh the page and it should pop up again) Well, I started the survey yesterday and already have 117 responses...and it doesn't appear to me that very "many consumers may be hesitant to swipe their ATM (or debit or credit) cards on hardware attached to their computer". In fact, 117 said they would prefer to Swipe their Card and 117 said they would prefer NOT to Type in a Username/Password. Thank to those who have participated thus far! There's only 5 questions if you refresh you can participate as well.

Click below to enlarge and read two questions pertaining to whether individuals (who read this blog) would prefer to Type or Swipe their Card information at a merchant website or Online bank:

The analysis did go on to say that two of the "differentiators" enjoyed by HomeATM is that we provide "end to end encryption" and our device is PCI certified, so I'm still left confused by what they meant about many consumers being hesitant because of security concerns...chime in!

HomeATM Differentiators:

• A HomeATM Mobile device will be also available for mobile phones with Web access, allowing transactions on the go
• PCI-certified device.
• Hardware-based end-to-end encryption
• 100% acceptance with all bank cards.

Editor's Note: Plus our PCI 2.0 Certified PED also "encrypts" the Track 2 data and utilizes DUKPT key managment as an additional layer of security.

EMV: Coming to a Town Near You?

In a very well written article, Andy Williams, the Associate Editor for Avisian Publications, argues that EMV (also known as Chip and PIN) will eventually wind up in the United States.

When it happens HomeATM is EMV ready. Which leads me to ask an obvious (yet rhetorical) question. If a consumer must enter their smart card in a smart card reader, then how in the world wide web could there possibly be a Chip and PIN solution with a software application? Did you say it cannot be done?

Then congrats! You're right...it couldn't and therefore wouldn't be done. Segway: That fact falls directly in line with the fact that a PIN (online) Debit transaction cannot take place without swiping the card and obtaining the PIN Offset and PVV. Thus, a software PIN Debit application, like a software Chip and PIN transaction, not only doesn't...it cannot exist. (See: It Doesn't Exist...Figment of the PIN-agination or: Updated: Acculynk...Where's the PIN Offset? My Pet PVV )

Here's the article:

EMV takes aim at U.S.

Tuesday, May 26, 2009 in Library

Technology may be a solution to domestic payment card fraud

by Andy Williams, Associate Editor, Avisian Publications

Like a massive tidal wave, EMV continues to roll across the world,changing the global payments landscape. Since UK banks first committedto EMV five-years ago, more than 100 countries have taken the plunge inefforts to stem credit card fraud.

But the U.S. has always remained outside the EMV plan. This,however, may be changing as fraud, technology and business is changingthe payments landscape.

Brian Byrne, head of product technology for standards andspecifications at Visa estimates there are some 730 million EMV cardsand 10 million terminals in existence around the world.

ToniMerschen, group head of chip at MasterCard Worldwide, notes that theSingle European Payments Area initiative requires 38 countries tocomplete the migration to EMV by Jan. 1, 2011.

EMV gets its name from the companies which originally created it,Europay, MasterCard and Visa. Seven years ago Europay merged withMasterCard and the new standards body was renamed EMVCo. Its membersnow include Visa, MasterCard, Japan-based JCB and its newest member,American Express.

EMVCo’s primary goal “is to facilitate global interoperability andcompatibility of chip-based payment cards and acceptance devicesthrough deployment of relevant EMV Specifications,” says an EMVCospokesperson.

EMV also goes by “chip and PIN,” because the card contains a chipand a PIN is required before a transaction is processed. But nowadays,that chip and PIN moniker may be misleading. As Byrne, points out, manycountries are foregoing the PIN part of EMV implementation, thepredominant reason being that many consumers don’t want to remember aPIN.

The country most advanced towards EMV implementation is the UK, thebanks their were the first to adopt chip and PIN, says Merschen. Othermarkets that have reached maturity for EMV migration on either cards,point-of-sales devices and ATMs include France and Turkey in Europe andMalaysia in the Asia-Pacific region, he adds.

The migration isn’t easy. Merschen says a number of infrastructurechanges are required to handle EMV. “For issuers, there are new dataelements that need to be supported by the issuer authorization andclearing host systems. Card data preparation, including key management,and card personalization also require hardware and software upgrades,”Merschen says. “On the acquiring side, the impacts are similar.Acquirer host systems must be able to receive new data fields fromterminals, which also need to be upgraded from both a hardware andsoftware perspective.”

Glitches all but resolved
In the early days of EMV there were issues, Merschen says, such as ashortage of approved products, lack of customer and vendor expertisewith EMV and areas where the specifications left implementation options.

That was then. These issues from the early days of EMV have largelybeen resolved, says Merschen. “Robust migration processes are availableto guide the banks, merchant, and consumers in their migrationinvolvement,” he adds.
Visa’s Byrne describes the early road bumps as minor. “This cardissued in country A was having some acceptance problems in country B.In some cases, some of the older terminals wouldn’t work properly, butthat was usually due to configuration issues, fairly minor stuff.”

EMV in the U.S.?
So with the U.S. sandwiched between two EMV countries–Mexico andCanada–most think it’s only a matter of time before the U.S. joins theEMV parade.

Paul Beverly, president of Gemalto North America, believes increased fraud will mandate such changes.

In an article in the spring 2009 issue of Regarding ID magazine,Beverly wrote: “The rest of the world is well on the way to EMVimplementation. Europe and Asia have long been issuing cards and …Latin America, faced with exploding credit card skimming fraud, isfully committed to EMV smart cards. .. Yet stakeholders in the UnitedStates still find fraud losses and identity theft risks acceptable. Itis disappointing that U.S. companies are trailing the rest of the worldin this area.”

Charles Walton, executive vice president for payments for INSIDEContactless, believes that the U.S. will ultimately get on board withthe secure cards. “We’re seeing inherent insecurities in the system,such as the Heartland Payment Systems hack. It’s only a matter of timebefore these types of hacks will become intolerable.”

Walton says hackers will look at the weakest point in the paymentchain and exploit it. “If you start securing one point in the chain, itbegins to expose the other points, the path of least resistance forwater, will find the lowest point.”

MasterCard’s Merschen says that these fraud migration and datacompromise incidents, plus the possibility of government regulationwill lead several U.S. banks to consider EMV.

The handwriting is on the wall, so to speak. “It’s inevitable thatthe U.S. migrate to EMV, primarily because fraud is escalating,” addsRandy Vanderhoof, executive director of the Smart Card Alliance. “Majorfinancial institutions in the U.S. are also international so it willnot be a big step for them to issue these cards in the U.S.”

Contactless and EMV
At first blush it would seem that contactless and EMV would beworking toward opposite purposes, but Walton says EMV can run on top ofcontactless. “I would think of EMV as a security protocol that workswith contactless as well as contact chips.”

Visa is using EMV specs in its contactless payWave technology, Byrnesays. “The way we’re deploying contactless in the U.S. is using EMVspecs,” says Byrne. “It’s based on EMV technology making use of strongsecurity elements baked into EMV. These new cards will not only beaccepted in readers in the U.S. but also in the UK.”

The next generation of contactless cards will be a step toward EMV,says Vanderhoof. For example, MasterCard terminals certified forcontactless also carry elemental portions of EMV. “We’re seeing thesegradual upgrades of the infrastructure to support it,” he says.

Vanderhoof says these new rules for EMV contactless are differentthan those for EMV contact cards. Purchases under about $25 can be acontactless transaction in the UK, just like in the U.S. “Just tap itand go, no PIN or signature. After a certain number of transactions youmight be required to enter your PIN.”

EMV vs. contactless overseas
While EMV and contactless will have to coexist in the U.S., it’s notthat simple where’s there’s already an EMV infrastructure in place.“Europeans have a lot invested in EMV,” says Urs A. Lampe, vicepresident, product marketing and new business for contactless smartcard provider LEGIC Identsystems, in Switzerland. “Now contactless ishappening and the EMV installed base is all on contact, so you’llprobably see some swapping out of terminals in the next few years.”

Or they could opt for integrated contactless readers or readers thatare configured to accept contactless peripherals, adds Byrne.

Another solution is dual interface products in which a single chipcan communicate in contact or contactless mode. INSIDE will be bringthe Micropass 6002, a dual interface chip to market in the fourthquarter of this year, Walton says.
Merschen adds that a number of markets, such as Canada, the UK,France, Malaysia and Taiwan, have already embraced dual interfacesolutions, running both EMV contact and contactless transactions usingone single chip. “Some banks have clearly stated that contactless willbe a standard feature for many of their portfolios,” he says.

Canada, Walton says, is an interesting market because 10 millioncontactless chip cards have been deployed. He projects that by the endof the year, dual-interface cards will make an appearance there. “We’llbe seeing use of chip-based cards in the U.S. for security reasons. Thebuildup of EMV in Canada will tend to cause fraud to migrate to theU.S.,” he adds.

But there’s no getting around that the purposes of EMV andcontactless can be at odds. “EMV certainly brings about much moresecurity and flexibility to today’s mag-stripe cards,” Merschen says.“While contactless brings transaction speed and cardholderconvenience.”

In the U.S. it may come down to a question of speed versus security.As retailers transition to newer payment terminals it will be up to thecard issuers on whether or not to deploy EMV and put a safeguard inplace to help stem the tidal wave of payment card fraud.

EMV definitely works, but…

Latest card fraud losses reported by APACS, the UK paymentsassociation, show EMV does work, but it’s not a cure all. Certain typesof credit card fraud will require other measures.

While 2008 fraud loss figures totaled about U.S. $902.5 million thetwo main areas of fraud were on transactions not protected by chip andPIN: Internet, phone and mail order fraud, and fraud abroad committedby criminals using stolen UK card details in countries yet to upgradeto EMV.

This second fraud type has nearly doubled in two year, providingmore ammunition to those pushing the U.S. to become EMV compliant.

Phone, Internet and mail order fraud (card not present) accountedfor more than half of those losses at U.S. $485.9 million, just a 13%increase over 2007 losses but is double the losses suffered in 2004.

Counterfeit card fraud increased 18%, to about U.S. $250 million.But that’s down from the 46% increase reported in 2007. The vastmajority of this fraud is due to criminals stealing card details in theUK to make counterfeit magnetic stripe cards for use in countries yetto upgrade to chip and PIN, says APACS.

“The industry continues to apply pressure on those countries, suchas the U.S., where chip and PIN has still to be rolled out,” the APACSreport adds. “Increasingly effective use of intelligence systems andthe ongoing global rollout of chip and PIN have contributed to thisslowdown.”

Although card fraud losses have increased, losses as a percentage ofplastic card turnover amounted to just 0.12% in 2008, equaling about atenth of a penny lost to fraud in every dollar spent. This, too,reflects EMV’s “positive effects as well as the fact that we continueto use our cards more and more each year,” says APACS.

As to card not present losses, that can happen with or without EMV.More retailers, APACS notes, need to encourage cardholder and retaileruse of the secure codes found on the back of most credit cards.

However, one area where EMV is still vulnerable is with ID theft.Card ID theft losses have increased by 39% where criminals take overthe running of another person’s credit or debit card. This fraudtypically involves a criminal obtaining a genuine card and a genuinePIN, and has contributed to the fraud increases seen at UK shops andcash machines, APACS says.

Discover Small Business Watch Shows Drop in Economic Confidence

Discover^® Small Business Watch^SM:

Small Business Economic Confidence Drops Sharply after 3-Month Climb

Cash Flow Issues Increase; Spending on Business Development Decreases

POLL: ECONOMY TAKING ITS TOLL ON SMALL BUSINESS WORKWEEK

Many Small Business Owners Putting in More Hours and Canceling or
Postponing Vacations

RIVERWOODS, Ill.--(BUSINESS WIRE)--After reaching its highest level in 14 months, the economic confidence
among small business owners fell in May as owners reported cash flow concerns and expect to cut back on business development spending, according to the latest Discover^® Small Business Watch^SM.

The monthly index dropped more than 10 points to 78.1, down from 88.5 in April. The Watch also recorded significant drops in the numbers of small business owners who think the overall economy is getting better, and number of owners who thought economic conditions were improving for their own businesses.

“We saw cash flow problems jump this month to their highest level in 2½ years, which is certainly not going to boost the optimism of a small business owner, especially in this economic climate,” said Ryan Scully, director of Discover's business credit card. “However, for the past three months we’ve been recording our highest confidence levels since summer of 2008, so all is not lost.”

May Highlights:

49 percent of small business owners say they have experienced
temporary cash flow issues in the past 90 days, up 10 percentage
points from April. That’s the highest percentage in that category
since the Watch started in August 2006.
Nearly half of small business owners, or 48 percent, see economic
conditions for their businesses getting worse, up from 40 percent in
April; 24 percent see conditions improving, down from 32 percent last
month; and 23 percent say conditions are the same; 4 percent were not
sure.
60 percent of small business operators rate the economy as poor, up
from 54 percent in April. Only 7 percent rate the economy as excellent
or good, and 32 percent called it fair.
57 percent believe the economy is getting worse, up from 51 percent in
April, while 23 percent believe it’s getting better, down from 31
percent in April; 16 percent say it’s staying the same; and 4 percent
weren’t sure.
53 percent of small business owners say they plan to decrease spending
on business development over the next six months, an increase over the
46 percent in April who said the same. Twenty-two percent plan to
increase spending, which is largely unchanged from 21 percent in
April; while the number of owners who were not planning any changes in
spending dropped from 30 percent in April to 23 percent in May.

POLL: Small Business Owners Continue to Toil Harder Than Most Americans, Even More During Tough Economic Times

As documented in previous Watch surveys, American small business owners report working more hours, more days and more holidays than their general public counterparts, and during the past year, that gap has widened. While the amount of days and hours on the job for the average American have been relatively flat since 2007, the number of small business
owners who work more than 10 hours a day jumped from 30 percent in 2008 to 39 percent in 2009. In comparison, only 20 percent of average workers make the same claim.

When it comes to days worked per week, 61 percent of small business owners said they work six or more, up from 45 percent in 2008 and 43 percent in 2007. Comparatively, only 22 percent of workers in the general population say they work more than five days a week. “The economy has obviously been a factor for small business owners caught in the slowdown; they’re grinding out more hours serving existing customers and likely putting in more time looking for new business,” Scully said.

More Work Survey Results:

Given their heavy work schedules, small business owners are finding
less time for vacation than in years past. Today, only 29 percent say
they have taken a vacation in the past year that lasted a week, down
from 40 percent in May 2008 and 41 percent in May 2007. Thirty percent
say it’s been four years or more since they had a vacation that lasted
a week, up from 23 percent in both 2008 and 2007.
56 percent of small business owners say that the economy has caused
them to postpone or cancel vacation time this summer, compared to 45
percent of the general population who said the same.
27 percent of small business owners define a day off as not working at
all, followed by 37 percent who say a day off means not actively
working, but available for calls and e-mails; 25 percent define it as
working an hour here and there; 7 percent said it’s working all day,
but from a remote location; and 3 percent weren’t sure how they would
define a day off. In the general population, 54 percent of people
define a day off as not working at all.
57 percent of small business owners say they always or most of the
time work on holidays, up from 47 percent in 2008.
31 percent of the general public says they always or most of the time
work on holidays, up from 29 percent in 2008.
The spouses of small business owners haven’t changed their opinions
much since 2007 on whether they approve of checking work e-mail when
away: 56 percent approve, 19 percent disapprove and 24 percent aren’t
sure.
Spouses in the general public seem to be getting much more used to the
idea of checking work e-mail when off: In 2007, only 21 percent of
spouses approved of the practice, while 74 percent disapproved and 5
percent weren’t sure. This year, 39 percent of spouses approve, 22
percent disapprove and 39 percent aren’t sure.

The views and opinions expressed by small business owners and consumers who participate in the Small Business Watch survey are their own and do not necessarily reflect those of Discover Financial Services or its affiliates.

About the Small Business Watch

The Discover Small Business Watch is a monthly index measuring the relative economic confidence of U.S. small business owners who have less than five employees, a segment that consists of 22 million businesses producing more than a trillion dollars in annual receipts. The Watch is based on a national random survey of 750 small business owners. It is commissioned by the Discover Business Card, which strives to offer the best business credit card for American small businesses, and is conducted by Rasmussen Reports, LLC (www.rasmussenreports.com), an independent survey research firm. The numeric index is calculated by assigning values to responses to a set of six consistent questions. The base value of the Watch was established at 100.0 based on surveys conducted in August 2006. In addition to generating the index, the Small Business Watch surveys small business owners every month on key issues,
and polls 3,000 consumers four times per year to gauge purchasing behavior and attitudes towards small businesses. For past results and survey data, visit www.discovercard.com/business/watch.

For information on Discover Business Card, visit www.discovercard.com/business.

About Discover Financial Services

Discover Financial Services (NYSE: DFS) is a leading credit card issuer and electronic payment services company with one of the most recognized brands in U.S. financial services. Since its inception in 1986, the company has become one of the largest card issuers in the United States. The company operates the Discover Card, America's cash rewards pioneer, and offers student and personal loans, as well as savings products such as certificates of deposit and money market accounts. Its payments businesses consist of the Discover Network, with millions of merchant and cash access locations; PULSE, one of the nation's leading ATM/debit networks; and Diners Club International, a global payments network with acceptance in 185 countries and territories. For more information, visit www.discoverfinancial.com.

Trustwave Sounds Alarm

Trustwave raises alarm, advises hospitality sector

In response to a growing number of data security breaches in thehospitality industry, information and security compliance firmTrustwave issued an alert to help hotels and restaurants identify andaddress security weaknesses.

Colin Sheppard, Forensic PracticeManager for Trustwave, said much of the problem involves themultichannel acceptance of payments. Channels of acceptance includeMO/TO, card-present, point-of-service transactions and card-not-presentpayments done via the Internet.

According to Sheppard, when aguest books a hotel room online for a property that is part of a hotelchain, a link is formed between the chain's enterprise wide, onlinereservation system and the individual hotel being booked; perhaps acentral corporate headquarters will have remote access to the data aswell. But weak links in the system can be infiltrated by fraudsters.

Regardlessof the method of attack, such as key logging, skimming or sniffing, "ifthe attacker is able to gain access to a specific property, and there'sdeficiency in their security, there's the potential to exploit thatlink back to possibly another property," Sheppard said. (Translation: Security is only as strong as the weakest link)

He alsocited noncompliant or improperly configured payment applications as amajor weakness that can increase the risk of data breaches. "In manycases, that includes the use of vendor default passwords," he said.

Third-party peril

MichelleGenser, Corporate Communications Manager for Trustwave, added thatbusinesses without internal information technology resources havethird-party vendors set up their hardware and software securitysystems. Hospitality companies, such as resorts, bed and breakfasts andmotels, that do not employ security experts trust third-party vendorsto correctly install and manage the right security systems for theirbusinesses, she said.

Even if companies are certified PaymentCard Industry (PCI) Data Security Standard (DSS) compliant and arefollowing the PCI's best practices today, if their security vendorshire new employees who disregard best practices tomorrow, businessesthat rely on those vendors can be noncompliant and vulnerable tobreaches.

Laurence Barron, Vice President and Chief InformationOfficer for the American Hotel and Lodging Association and Member ofthe PCI Security Standards Council, said when breaches occur, thebusiness entities breached are liable, not the third-party securityvendors that may have been the actual problem.

"The propertiesneed to be aware of the potential liability [and] make sure that thirdparties are compliant, make sure they have conformed to PCI regulatedscans, make sure that the companies they get actually do follow bestpractices," Barron said. "The [entity] that's ultimately liable, and alot of people miss this, is the place that actually takes the creditcard. I've had different hotels say, 'Well I called my company. Theysaid they're compliant, so I'm good.'"

Sheppard also noted thatmany location managers are under the impression that maintaining datasecurity compliance is handled on a corporate level. "But they need tofocus on security themselves and not assume that those systems aresecure," he said.

Barron believes that "at some pointlegislation is going to have to be acted on or the [card brands] aregoing to have to say, 'If you take a credit card, you must becompliant, you must conform.'" He noted that many business owners stillbelieve security breaches can't or won't happen to them, with theadditional problem being smaller operations often don't want to spendmoney on compliance.

Call to action

In itsalert issued May 14, 2009, and entitled Security Alert for Businessesin the Hotel, Motel and Lodging Industries, Trustwave offered eightactions that should be taken immediately by hospitality companies toreduce their security risks and better protect the financial andpersonal data of their clientele.

Establish firewalls that properly filter incoming and outgoing data traffic
Upgrade to Payment Application- (PA) DSS-validated applications and ensure they are configured in accordance with the PCI DSS
Periodically reboot payment systems to deactivate hidden viruses
Enforce strong username/password policies for system access
Properly secure remote access applications
Review system activity logs daily
Disable Windows file sharing if not required (if required,grant access to shared folders only to specific user accounts securedwith strong passwords)
Ensure anti-virus/anti-malware software is installed and updated consistently

Access point vulnerability

Trustwaveanalyzed the cause of breaches it had investigated. The Chicago-basedglobal security firm found that over half of the problems originated inthird-party access to businesses' electronic payment systems.
Tolimit the possibility of weaknesses resulting from third-party accessto data, Trustwave wrote a white paper entitled Protecting CardholderData for Hospitality Businesses Accepting Payment Cards throughMultiple Channels: Hotels, Motels and Lodging. It suggests businessesobserve the following best practices:

Choose compliant service providers recommended by Visa Inc. or MasterCard Worldwide
Use PA DSS-compliant payment applications
Require PCI DSS compliance in contracts with third parties handling cardholder data
Maintain strict policies and procedures for remote access to networks

"It's the hospitality industry today, but obviously wehave many other businesses that follow that model," Sheppard said. Forexample, grocery store chains commonly use payment gateways toaggregate all card data from individual stores within the franchise tocentral data storage locations. He stressed that these franchise modelsare a target because, once attackers break into a system, they hop fromone franchise location to the next to steal card data.

Accordingto Genser, Trustwave expects the number of breached hospitalitybusinesses to increase. She indicated that hotel owners often switchhotel brands. "If they switch brands with a compromised network, it caninfect other brands and their respective networks. Due to a lack ofdata security resources, many hotel owners or operators are unawarethat they have fallen victim to a security breach."

The alert and the white paper can be obtained from Trustwave's Web site at www.trustwave.com. In June 2009, the company will present a webinar on the subject of data security in the hospitality industry.

Merrick Sues Over CardSystems

Source: Finextra
Complete item: http://www.finextra.com/fullstory.asp?id=20067

Description:
Merrick Bank has launched a multi-million dollar lawsuit against Savvis, accusing the vendor of erroneously telling it that CardSystems Solutions complied with Visa and MasterCard security regulations less than a year before the payment processor's systems were hacked, compromising up to 40 million credit card accounts.

Atlanta-based CardSystems - now owned by Pay By Touch - (actually, I believe Planet Payment bought Pay By Touch's portfolio which included the former cardsystems) - identified a security incident in May 2005 that exposed more than 40 million credit cards to hackers.

The following year the company agreed to settle federal charges that it failed to protect the financial data of millions of consumers. The US Federal Trade Commission (FTC) said the breach "led to millions of dollars in fraudulent purchases".

The FTC concluded CardSystems created unnecessary risks to the information by storing it and failed to ensure that its network was secure from attacks.

Merrick, which is an acquiring bank for around 125,000 merchants, has now filed a federal complaint claiming the breach cost it around $16 million in payments to Visa and MasterCard for using a processor that did not meet their standards as well as payouts to affected banks and legal fees.

Before the breach Merrick agreed to use CardSystems for processor and independent sales services if it proved compliance with Visa and MasterCard security requirements.

The processor asked Savvis to assess and certify its compliance and got the all clear, and consequently the Merrick contract.

Less than a year later the security breach occurred. Merrick says hackers were able to get hold of the data because CardSystems kept unencrypted card information on its servers - in contravention of the regulations for which Savvis certified it.

E-Secure-IT
https://www.e-secure-it.com

Wednesday, May 27, 2009

Tuesday, May 26, 2009

Here's the article:

EMV definitely works, but…

Discover® Small Business WatchSM: Small Business Economic Confidence Drops Sharply after 3-Month Climb

Disqus for ePayment News

Discover^® Small Business Watch^SM:

Small Business Economic Confidence Drops Sharply after 3-Month Climb