Data Breaches – Compulsory Disclosure?

EU Justice Minister Viviane Reding, has recently announced that she is formulating a policy that will mandate any business trading in the EU or who targets EU residents, to notify their customers, and the regulatory authorities, if they suffer a data breach. The intention being to ensure that all businesses handling sensitive data take their obligations seriously.

This action follows the recent spate of attacks on some high profile organisations, where millions of personal data records were subject to data hacks.

Following the introduction of the EU e-privacy directive on 26th May 2011, Telecoms, and Internet Service Providers are already subject to mandatory data breach disclosure, and the Minister is now seeking to widen these powers to include all sectors.

The legislation has the power to impose penalties and legal sanctions for any infringement and it is expected that these strong ’incentives‘, will encourage businesses to conduct serious risk assessments regarding their storage of sensitive personal data, and implement appropriate security measures to protect the confidentially and integrity of this information.

It should also be noted that the UK Information Commissioner has regulatory powers to investigate and penalise in cases of deliberate and persistent misconduct.

With all of the increasing media and regulatory interest in data security, how does a business go about protecting its’ key assets, particularly customer databases and avoid a data breach?

How can Sysnet Global Solutions help?
Sysnet offers a Security Assessment service, which provides a unique and flexible approach encompassing Incident Response, Audit, Computer Forensics and Penetration testing.

The assessment will be tailored to the individual needs of the business, and can include reviews of encryption, wireless networking, portable device security, contingency plans, security awareness, system configuration and premises vulnerabilities.

If a business takes card payments, they will fall under the requirements of the Payments Card Industry – Data Security Standards (PCI-DSS) – However the Sysnet Security Assessment service goes into far more detail, so that the customer can feel confident that they are in control of their security position.

Additionally Sysnet offer an on-demand, computer incident response service, whereby in the event of an incident, Sysnet can be on call ready to provide advice and visit the affected site to help contain the incident, offer guidance and if required, conduct a forensic investigation. This service is pre-arranged and also includes an initial visit to the site to help assist in highlighting security vulnerabilities, and offering remediation planning to overcome these weaknesses.

Whilst no business can be wholly safe from a data incident, by following the guidance given by the Sysnet CFS team, businesses can reduce their exposure to receiving such an attack, but also will be in a far better position to respond in a positive and speedy manner, to ensure continuance of trading and minimisation of brand and reputational damage.

Another key area is the storage of unencrypted card data - under PCI-DSS all card data should be securely deleted from computer systems, or if deemed necessary for operational requirements, then the information needs to be stored in a suitable encrypted format. In all too many cases, when a forensic investigation is undertaken following a data breach, card information is located in clear text.

This can be due to a number of circumstances, forgotten databases, legacy systems deemed out of scope for PCI accreditation, or back-up files converting encrypted information into readable format. Whatever the reason, storing unencrypted data will heighten the risk, and invalidate any PCI compliance certification.

To mitigate operating with such vulnerability, Sysnet are able to offer their Cardholder Data Discovery Service, which can scan server, PCs, and storage media for unencrypted card numbers. Once the scan has been completed, and if any residual information has been identified, we can safely erase the data, help prevent it from being stored or if preferred, give guidance as to how the records can be held securely to conform to the PCI-DSS.

Sysnet bring the pragmatic mindset of a forensic investigator together with knowledge of real world hacking to give you the edge in security management. For more information please contact us by calling 0844 562 3147 (UK) or +353 (0)1 495 1300 (Rest of the World) or by completing our Online Enquiry Form or Request a Call Back Form

Sysnet to present at IPSO Data Breach Awareness Workshop on June 14th

Sysnet Global Solutions, a leading worldwide provider of information security and assurance services, will present at the Irish Payment Services Organisation (IPSO) Data Breach Awareness Workshop on June 14th 2011. The event, which takes place in Dublin, will educate and inform delegates of the need to proactively plan and test data breach scenarios. The result being that, in the event of a data breach, the correct actions are taken and the financial and reputational loss are minimised.

Ian Wright, Senior Consultant and Benn Morris, Manager Computer Forensic & Security at Sysnet Global Solutions will present on the topics of describing an incident, overview of the internal and external threats and preparing and planning for a data breach. Ian Wright has over 30 years experience in the banking industry. For the last 5 years he was Head of Fraud for a major UK acquirer. He brings a unique insight into the issues faced by merchants and card processors. After working for West Yorkshire Police Hi-Tech Crime Unit, Benn Morris moved into the private sector conducting forensic investigations, incident response and security assessments for many high profile corporate organisations.

Also presenting at the event are Úna Dillon, Head of IPSO Card Services and Detective Sergeant Matthew Sheridan, Garda Bureau of Fraud Investigations.

The briefing will take place at the Radisson Blue Hotel, Golden Lane, Dublin 2, and will commence at 10.00am and will conclude at 1.00pm.

To register a place at this workshop, please click here or go to the IPSO website www.ipso.ie and follow the link.

Sysnet launch Newsletter, Sysnet Secure

Sysnet officially launch their newsletter, Sysnet Secure. To celebrate the launch, an iPad will be won as a prize by one lucky reader.

To view the newsletter, please click here.

Common Cyber Crimes facing the Payments Industry

There is little doubt that an Account Data Compromise (ADC) would be detrimental to the operational effectiveness of any business. However, to organised criminal groups it can be an easy way in which to generate funds for criminal gain. In the 21st century, it can be easier for a criminal gang to commit cyber crimes, such as raiding the credit card details of a poorly maintained website, than to raid a high street bank.

The favoured methodology of website hackers is to exploit poorly written and unsecured websites and then seek to locate the credit card information held within. By focusing on weaker websites in this way, and ensuring that the total level of card fraud is not too high, many of the hackers simply take the ‘low hanging fruit’ and go unnoticed until it is too late.

Often exploiting the same common vulnerability across multiple different hosts, for example an authentication weakness in a popular shopping cart, allows the hacker to simply trawl the Internet for those websites that use that shopping cart to exploit and collect the reward. No organisation wants to fall foul to cyber crimes and therefore in order for them to protect themselves against a potential information security breach, certain steps should be taken to reduce susceptibility to the most common types of breaches.

Legislation
The unlawful access to a system that is used by a merchant is on the whole in breach of section 1 of the Computer Misuse act and in the real world, stealing of cardholder data is more than likely to be associated with the stealing of PII (Personally Identifiable Information). Therefore, once a data breach has occurred, it can easily escalate from an exercise where the card brands are requesting their card numbers to be returned, to the local law enforcement agency mounting a personal data loss investigation.

Cardholder data breaches, that are the result of cyber crimes, are increasing raising interest within the various law enforcement and data protection agencies around the EU. Although currently each member state takes a different view on how to deal with the consequences of cyber crimes, growing public awareness on the issue could see law enforcement take a heavier, more legal based role in the near future.

Protecting Your Organisation
There are no hard and fast rules to ensure that your website is safe and secure from the persistent threat of cyber crimes. However, there are some actions that organisations can take to help avoid large fines for the misuse and loss of cardholder data. Below are 10 helpful tips for organisations seeking to become more proactive;

1. Get PCI DSS compliant. Look at your merchant agreement with your acquirer, it will state that you need to be PCI DSS compliant;


2. Plan, Plan, Plan – you don’t know when the event might happen but an incident response plan and regular testing of this plan will pay dividends in the event of a breach;


3. Suppliers - know who your suppliers are and also what cardholder data they may or may not be processing on your behalf. They will need to be PCI DSS compliant and could easily be your weak point in the protection of cardholder data;


4. PFI Company – if there is a breach, one may be turning up at your door and asking questions that you might not immediately know the answer to. Pre-appointing a PFI and talking to them about what happens in a breach will iron out any potential problems;


5. PR Response - should the worst happen and your businesses’ reputation is on the line, have a pre-planned public response; a response prepared beforehand is far better than a response drafted in the heat of the moment;


6. Policy – one of the easiest ways to mitigate the risk that a breach represents is to ensure that policies and procedures are robust enough to reduce the chance of a cardholder breach and also have the flexibility to respond if a breach occurs;


7. Data Protection – the legal and compliance authorities are becoming more interested in ensuring that the cardholder data that merchants process and the personal information they obtain is kept within the realms of the merchant, and does not get into the hands of the hackers. Whilst the card brands could fine an organisation for the miss-use and/or loss of cardholder data, the data protection authorities can also stop a merchant processing cardholder data;


8. Acquisition of evidence – should an external party be required to investigate a breach, a lot of time, energy and effort can be saved by allowing the external investigative party to investigate and acquire the data. The more that the data is tampered with before a forensic investigation is carried out, the less information can be found out about what actually happened;


9. Check your liabilities – ensure that you have the correct contracts; it may be that your 3rd party has provided you with a ‘managed’ firewall but what does that mean? You may only find out when a hacker has already taken your customer’s cardholder information away;


10. Don’t Panic –If the worst should happen, act with a clear head and don’t make rushed decisions that could affect the outcome at a later stage.

For further information on our Incident Response, Forensic Security or PCI Forensic Investigator Consultancy Services, please contact one of our Sales representatives by calling 0844 562 3147 (UK) or +353 (0)1 495 1300 (Rest of the World) or by completing our Online Enquiry Form or Request a Call Back Form.

The UK Data Protection Act (1998) requires any organisations that receives, transmits, stores or processes personal information to comply with the eight basic principles contained in Schedule 1 of the Act.

The essence of the eight principles can be summarised as follows:

• Personal data shall be processed fairly and lawfully


• Personal data shall be obtained only for lawful purposes


• Personal data shall be adequate, relevant and not excessive


• Personal data shall be accurate and kept up to date


• Personal data shall not be kept longer than necessary


• Personal data shall be processed in accordance with the rights of data subjects under this Act


• Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing


• Personal data shall not be transferred to a country or territory outside the EU except in specific instances where equivalency of safe-harbour applies

Compliance with the Data Protection Act is a legal requirement for all organisations operating in the United Kingdom which collect, store or process personally identifiable information. Ensuring ongoing compliance with the Act is therefore an essential management activity for any company or organisation which engages is the abovementioned activities.

In addition to potential penalties that may be imposed by the courts or the Information Commissioner’s Office, most modern organisations are reliant on their brand reputation to attract and retain customers and partners in the private sector or to achieve their organsational or statutory goals in the public sector.

As such a breach of data privacy could have far wider consequences than any sanction imposed by the Information Commissioner or any other regulatory body and could compromise a key commercial relationship or prejudice your organisation’s ability to win and retain customers.

Achieving compliance with the Data Protection Act should begin with the selection of an expert third party advisor and is achievable through a regime of analysis and assessment, training and awareness initiatives, organsational support and policy implementation all of which need to be underpinned by appropriate technological architectural and infrastructure investments.

In conjunction with the expert advisor, the next step will be assess your organisation against the eight principles of Schedule One of the Act and determine a remediation plan that will close off any shortcomings identified in the most pragmatic and cost efficient manner.

This is usually achieved by a process involving the following steps:

1. Scoping of private data environment


2. Gap analysis and assessment of current level of compliance


3. Remediation phase to address identified gaps


4. Re-assessment and issue of Report on Compliance

The expert advisor will also recommend how best to deal with subject data requests by data subjects whose personal data your organisation controls.

How can Sysnet Global Solutions help?
Sysnet has a team of information security consultants whom are well versed in the governance, risk and compliance of personal data. Sysnet is able to provide advice on how to protect your data as well as distributing this data in a safe and a secure manner. Our consultants have strong experience in dealing with data protection issues and how the movement and the storage of data can impact your business operational tasks. Not only can Sysnet provide consultancy advice on how to protect your data but also what to do if there is a data breach and how best to contain any unfortunate events that may happen.

For further information on our Information Security Services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.

Overview of the main changes between v1.2.1 and v2.0 of the PCI DSS

Prior to its release, the latest version of PCI DSS has sparked debate as to whether there would be significant changes to the standard.

PCI DSS v2.0 was officially released in October 2010 and demonstrated that changes had been made mainly for clarity to maintain the quality of assessments. There have been numerous changes, many of which seek to be more specific around test procedures that are required. The other main changes to the standard are highlighted below:

• Scoping;
• Inclusion of Virtualisation;
• Storage;
• Time Synchronisation;
• Scanning;
• Wireless and IDS/IPS;
• Evolving Requirements: Applications.

Each of these areas will be broken down below to cover the high level salient changes that have occurred to the PCI DSS.

Scoping
As with any PCI DSS assessment, it is important that proper scoping is conducted. Changes have been made to ensure that the scope has been clearly defined with emphasis on the following points:

1. Requirement to identify all locations of cardholder data flow;
2. Explicit requirement for merchants / service providers to identify and explicitly define all of the locations and flows of cardholder data annually before they begin their assessment;
3. Documentation must be presented that shows how the PCI DSS scope was confirmed and the scoping results so that the assessor can review and accept as evidence if appropriate;
4. Consider all areas of stored electronic and physical media containing cardholder data. This should include (but not be limited to) databases, mail orders, faxes, call recordings, emails, temporary files and log files;
5. “System components” also include any virtualisation components.

Main impact:

• Organisations may need to be more proactive and spend more time understanding where cardholder data is processed, stored or transmitted;
• Expect the QSA to spend more time verifying the scope, specifically the data flows and storage locations;
• Expect to be asked to present evidence of how the controls are adequate to segment the scope, and prove that testing has been conducted outside of this scope to ensure that there is no additional pollution.

Virtualisation
Virtualisation is now officially recognised and therefore all virtualised system components should be reviewed to determine whether they are in scope for PCI DSS. If they are in scope, then the PCI DSS controls will apply depending on the context of the components. For example:

1. Virtualised servers would require all PCI DSS requirements applicable for servers;
2. Virtualised firewalls and routers would require all PCI DSS requirements applicable for firewalls and routers;
3. Virtualised system components would require all PCI DSS requirements applicable for that particular type of system component.

Main impact:

• Including virtualised system components within the scope should not come as a surprise. If virtualisation technologies have not been included in the scope before, then your QSA may spend time reviewing the setup and corresponding documentation for that component;
• Sysnet have always applied the requirements in this manner, so there should be minimal uplift to any customers engaged with our QSA’s.

Storage
Emphasis has been made to prevent access to both truncated and hashed versions of the PAN as well as the PAN itself. With special tools, it takes a trivial amount of time and effort to use these two elements to generate a PAN.

Review the following:

1. Implementation of controls to ensure that the hashed and truncated values cannot be correlated to reconstruct the original PAN;
2. Whether you need to keep both truncated and hashed versions –if you don’t need it, don’t store it.

Main impact:

• Adding additional controls may provide additional expenses;
• It may prove difficult to add additional controls depending on your implementation;
• Storage of both versions may be by design currently, and making this change may prove difficult. Further work would need to be conducted to understand the risk and impact around any change.

Time Synchronisation
It is important to ensure that your clocks are accurate, in order to aid any forensic work. To support this, there must be clear and documented processes for distributing time through your cardholder data environment.

Previously there has been a bias towards using NTP. In the new standard references to any particular technology is removed.

Whatever time synchronisation you decide to use, make sure you use approved sources and have the distribution of time documented appropriately.

Main impact:

• Flexibility to use other time synchronisation technologies that may be more suitable for your environment;

Scanning
This is a very important area to consider. PCI DSS requirement 11.2 is now split into further subtests to explicitly conduct internal (11.2.1) and external (11.2.2) test procedures for vulnerability scanning. Why? In many cases organisations may rely on external vendors to conduct external testing. This change may indicate that organisations fall into trouble when required to demonstrate internal testing.

Don’t neglect internal scanning. Remember to:

• Conduct internal testing at least on a quarterly basis;
• Conduct internal rescans until there is a passing scan;
• Document scanning procedures and provide document evidence of the outcome of both internal and external scans.

Main impact:

• For those who have not conducted internal testing you should start this process as soon as possible. Failure to demonstrate the required internal testing evidence could jeopardise your next PCI compliance review.

Wireless and IDS & IPS
Organisation should not neglect the fact that rogue wireless devices are easy to implement and therefore post a significant threat. A few changes have been made:

• PCI DSS requirement 2.1.1 is split into further test procedures, but something is missing? There is no reference to WPA (or in fact any wireless technology);
• PCI DSS requirement 11.1 includes “physical/logical inspections of system components and infrastructure”;
• PCI DSS v2.0 mandates that IDS/IPS may be configured to monitor the perimeter and all critical points within the cardholder data environment.

Main impact:

• Organisations will need to give consideration to moving to WPA2 some serious thought. Or they will need to bolster the current wireless implementations with enterprise level security rather than just using Pre-Shared Keys (PSK). A better position may be to, ask yourself “Is sending cardholder data over wireless the best way”. Again, if you don’t need it then don’t use it;
• Physical/logical inspections of system components provides greater flexibility to meet the test procedures, especially for small organisations with few resources, who currently may not be knowledgeable in using specialist wireless scanning and IDS/IPS software;
• Wireless IDS/IPS systems at critical points in the CDE, may mean less system management overheads and potentially less false positives.

Evolving Requirements
Two extra requirements that PCI DSS v2.0 has included to spice things up will keep those involved with software development and patching busy:

• PCI DSS requirement 6.2 not only requires the ability to identify security vulnerabilities, but also to assign a risk ranking;
• PCI DSS 6.5 has been refined as a reminder that the requirements apply to all software and not just web applications. Furthermore, 6.5.6 requires addressing of “High” risk vulnerabilities, which have been identified using the new risk ranking processes in PCI DSS requirement 6.2.

Main impact:

• Organisations must start developing risk ranking processes at their earliest opportunity;
• This risk ranking could also work in your favour. The standard risk ranking provided by the vendors may not be appropriate within your environment. This may allow additional time for testing and scheduled rollout rather than reactionary installation;
• Organisations will be required to spend time demonstrating proper secure software development lifecycle for all internally-developed applications within scope for PCI DSS.

How will v2.0 impact on organisations seeking to attain/retain PCI DSS compliance?
To the relief for most organisations, PCI DSS will have minimal impact. The changes made have been for clarity of the test procedures and in recognition of advancing technology and threats. The main points are:

• Organisations should properly scope where their cardholder data is. It is difficult to secure the data if it is not known where it is;
• Expect your QSA to spend more time verifying the scope, reviewing the current technologies (which may now be considered not fit for purpose) and gathering evidence.

Will there be future updates to the PCI DSS?
The PCI DSS now uses a three-year life cycle and the next standard should be released around October 2013. The following diagram is taken from the official Lifecycle for Changes to PCI DSS and PA-DSS demonstrating the phases of the three year cycle.

Based on PCI DSS v2.0, it is envisaged that the new version will:

• Have further improvements in scoping;
• Clarifying assessment procedures;
• Include considerations for advances in technology as well as threats;
• Other areas as we do not yet know what the future holds.

Final reminder to organisations
It is imperative that organisations focus on their business processes and not just the technology. All organisations must understand they are obliged to protect customers cardholder data –PCI DSS applies all year and it is not just for the assessment.

As advances are made to technology, standards and regulations, organisations must not stand still. All organisations should consider undergoing QSA lead “health-checks” throughout the year to accommodate and review the impact of the change, in order to assist them with remaining PCI DSS compliant.

For further information on our PCI compliance services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.

PCI DSS Overview

The Payment Card Industry Standard (PCI DSS) is a compliance standard that governs the processing, storage or transmission of cardholder data. PCI DSS applies to any organisation which processes, stores or transmits cardholder data. Organisations can be classified as a merchant or service provider. An important point to note is that the standard is not just an IT compliance standard it effects all areas of an organisation.

PCI DSS Background
The PCI DSS was founded in December 2004 by 5 major card brands – Visa, MasterCard, American Express, Discover and JCB. The ongoing maintenance and updates to the standard are performed by the Payment Security Standards Council (PCI SSC), an independent organisation, joint funded by all the participating card brands and participating organisations. The PCI DSS is now on its 4th major release which is now at v2.0.

It is important to note that compliance is not a legal requirement but it is driven by the contractual agreements between merchants and acquiring banks that cannot be ignored.

PCI DSS Requirements
The PCI DSS are broken down into 6 domains that have various sections and associated requirements within each section which are as follows:

• Build and Maintain a Secure Network
  
  1. Install and maintain a firewall configuration to protect cardholder data
  
  2. Do not use vendor-supplied defaults for system passwords and other security parameters


• Protect Cardholder Data
  
  3. Protect stored cardholder data
  
  4. Encrypt transmission of cardholder data across open, public networks


• Maintain a Vulnerability Management Program
  
  5. Use and regularly update anti-virus software on all systems commonly affected by malware
  6. Develop and maintain secure systems and applications


• Implement Strong Access Control Measures
  
  7. Restrict access to cardholder data by business need-to-know
  
  8. Assign a unique ID to each person with computer access
  
  9. Restrict physical access to cardholder data


• Regularly Monitor and Test Networks
  
  10. Track and monitor all access to network resources and cardholder data
  
  11. Regularly test security systems and processes


• Maintain an Information Security Policy
  
  12. Maintain a policy that addresses information security

Why should an organisation comply with the PCI DSS?
There are a number of benefits of attaining PCI DSS compliance;

• Provides your customers with assurance that card transactions will be handled securely by your organisation


• Level 1 service providers who achieve PCI DSS compliance can ask to be added to the Visa and


• MasterCard lists of approved service providers


• Avoidance of financial penalties which are divided into two areas:

1. Non–Compliance Costs


2. Data Breach Costs Can include:
   
   o Fines levied by your acquirer for the cardholder data breach
   
   o Elevation to a level 1 merchant, increasing your ongoing compliance costs
   
   o The need to have an onsite QSA assessment which will add significant overhead to the demonstration of compliance
   
   o Consultancy costs for forensic assessments & remediation advice
   
   o Potential liability for consequential losses due to the card data breach
   
   o The fines which may be levied for non-compliance are potentially unlimited

Common Misconceptions
The following are common misconceptions in relation to PCI DSS compliance;

• You can’t fully outsource all your PCI DSS accountability although you can outsource most of the responsibility for the provision of services; remember some areas of the standard will ALWAYS remain in scope.


• Using a PA DSS compliant application – or a PCI PTS compliant PED does not automatically make your company PCI DSS compliant


• A PCI DSS assessment/ SAQ completion is just a snap-shot. Compliance with PCI DSS must be maintained at all times, and evidence of this needs to be available


• PCI DSS is NOT an IT compliance standard, it affects all facets of an organisation

For further information on our PCI compliance services, please contact one of our Sales representatives by calling +353 (0)1 495 1300 or by completing our Online Enquiry Form or Request a Call Back Form.