Reducing Payment System Risks in Retail Delivery - July 20, 2004


Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Reducing Payment System Risks in Retail Delivery - July 20, 2004

  1. 1. Reducing Payment Systems Risks in the Retail Delivery Channel NYS Society Of CPA‟s Technology Assurance Committee July 20, 2004
  2. 2. Presentation Objectives Assist Auditors who have Retail and Data Processing Clients by:  Identifying dynamic payment methods and channels.  Reviewing risks and mitigation techniques.  Discussing secure payment options for the “virtual” or web delivery channel.
  3. 3. Point of Sale Crimes  External  Domestic – individuals / gangs.  Global – individuals / gangs (organized crime type).  Attacks can be physical or logical.  Published threats of physical attacks available.
  4. 4. Point of Sale Crimes (cont‟d)  Internal  Disgruntled employees / highly trusted individuals.  Attack can be physical or logical access.  Published fraud not readily available.
  5. 5. Retail Payment Delivery Channels & Methods  ATM Networks Debit and Check Cards.  Credit Cards Branded by MC, VISA, Discover, Amex.  Third Party Processors.  ACH Networks.  Electronic Check Truncation.  Web Based Methods.
  6. 6. Key Point  Retailers are almost always sponsored into a payment network.  Retailers should check their liability to the sponsor, regarding network rules compliance.  The sponsor may hold the retailer liable for losses or breach of required security procedures.  Check your contract !
  7. 7. How Is Each Method Different ?  ATM cards can be used with a pin.  Pin-based allows real time authorization.  Same day settlement/no Float.  Secure.  Preferred by merchants due to lower cost.  Authorization time can be slower.
  8. 8. Check Cards  ATM cards can be authorized with a pin or signature.  ATM cards often branded with a NYCE, Star and/or MasterCard or VISA logo.  When authorized with a signature, authorization and settlement are batched based.  Check cards are prone to high fraud rates vs. ATM only cards.
  9. 9. Check Cards (cont‟d)  At their zenith of popularity.  Usage will flatten due to MC/VISA loss in class action anti-trust suit.  Retailers must obtain electronic authorization.  Follow floor limit rules.  Follow CVC/CVV counterfeit card protections.
  10. 10. Check Cards (cont‟d)  Hot carding procedures essential.  Fraud Risk/Velocity check essential.  Not a good idea for internet or MOTO transactions.  Banks love them due to high interchange.
  11. 11. Check Cards (cont‟d)  Retailers win the Walmart anti-trust suit.  After 1/1/04, retailers need not accept them.  Learn more about fraud management by obtaining Visa's Check Card Risk Management Overview (doc# V10524-0698) and Check Card Card Risk Management Brochure.  MasterCard has similar documents.
  12. 12. Third Party Processors & ACH Networks  3rd Party Processors provide data processing, settlement and authorization services to retailers.  Automated Clearinghouse Services (ACH) provide settlement services for the retailer and their processor.  Check cards present a higher risk due to charge back and delayed settlement.
  13. 13. Check Truncation  Electronic capture, transmission and authorization of physical checks.  Faster authorization.  Less float and credit risk.
  14. 14. POS Debit Crime - External  Skimming:  Magnetic card reader device (about the size of a Palm Pilot or a duplicate POS device).  Debit card is swiped through the “skimmer” as well as the legitimate POS device.  Card data is collected from the magnetic strip of the card.  Make bogus cards from collected data…  make purchases from victims‟ accounts.
  15. 15. POS Crime – External (cont‟d)  Skimming:  Device attached to an legitimate ATM.  Captures card data.  Camera records customer entering PIN or thief obtains PIN by “shoulder surfing”.  Make bogus cards from captured data.  Create false deposits to inflate account balance.  Make withdrawal.
  16. 16. Industry Trends Driving Risk  Merchants prefer PIN-based debit.  Accepting PINs saves merchants $$ BUT…  PIN-based debit means merchants assume risk of data loss or theft, if they fail to observe card association and network rules.
  17. 17. Industry Trends Driving Risk (cont‟d)  Increased network security requirements.  FTC adopts Banking Privacy Rules (GLBA).  More sophisticated card “skimming”.  Retailers begin deploying ATMs in their stores.
  18. 18. Industry Trends Driving Risk (cont‟d)  Exploding pin-based volumes.  Check card volumes almost equal credit card volume.  Retailers win Anti-trust suit.  Retailers enter the web delivery channel.  FTC successfully sues retailer for privacy violations.
  19. 19. Industry Trends Driving Risk (cont‟d)  Expensive, security driven technology changes:  New Encryption Algorithms.  New Fraud Checking – CVC2.  Wireless Technology at the check out lane.  Loyalty Cards create more data storage of non-public cardholder data.
  20. 20. Card Association & Network Requirements  VISA Cardholder Information Security Program (CISP).  ATM Networks require compliance with PIN Security Rules.  Retailers need financial institution sponsors to accept debit.
  21. 21. Implications Retailers will need expertise in:  Card Technology  Card Security  Retail Encryption Standards  Privacy & Identity Management  Access Controls  Security Audits Needed – VISA CISP
  22. 22. PIN Debit What Risks Do Retailers Need to Manage ?
  23. 23. Card Skimming Has Reached Epidemic Proportions  Examples:  Breaches of logical security.  Installation of a “parasite” or sniffer on the key pad or controller.  Low tech “double swipe technique”.  Wireless POS may broadcast data.
  24. 24. What Is The Risk?  Cardholder PIN Security depends upon the retailers implemented Key Management Procedures.  Can you survive…  Replacing Citibank‟s, Bank of America‟s or any large institution‟s cards?  The brand damage to your institution?  Disconnection from a payment brand ?
  25. 25. What PIN-based Standards Retailers Must Know  Identify Liability to their Sponsor  Identify Liability to their Processor  Practice a Standard of reasonable care= ANSI Standards x9.8 and X9.24  Major ATM Networks (Star, NYCE, Interlink) follow these standards
  26. 26. Standards for PIN and Key Management  American National Standards Institute (ANSI) published standards for Retail Banking to provide protection of:  PIN Issuance.  All PIN‟ed Transactions during Interchange.  Symmetric Cryptographic Keys used in Retail Banking Payment Infrastructure, to protect PINs * Standards are voluntary
  27. 27. Standards for PIN and Key Management  Some retailers deploying in store ATMs to earn surcharge and interchange  Knowledge of
  28. 28. How Does Retail Encryption Work ? Castle A Castle B Same Key Data To lock up information To lock up information to to share with Castle B share with Castle A
  29. 29. Authenticating the Card Holder - ANS X9.8: • The PIN is a means of verifying the identity of a customer within an Electronic Funds Transfer (EFT) System. •The objective of PIN Management is to protect the PIN against unauthorized disclosure and compromise and misuse throughout its life cycle. •PIN Security depends on Customer sound key management. Maintaining the secrecy of the Cryptographic Keys is of the utmost importance, because Any Bank the compromise of the key Retailer's PIN PAD allows the compromise of any PIN ever enciphered under it. • Using an ANY Bank card at an Oregon Bank owned ATM.
  30. 30. PIN Verification by the Issuer Host (on-us or not-on-us): Other switches 3) E.AWK(PIN) 4) Network performs a PIN translation to transport to Third Party FCU Issuer. Processor (TPP) Star NYCE 2) OB performs a PIN 5) PIN is verified at translation to transport FCU host center transaction to network. and authorization FCU cardholder Oregon PULSE Bank Federal CU Retailer PED 1) TPP does not verify PIN at ATM, transaction transported to FCU host center.
  31. 31. Pin Debit Growth  Implications for Retailers  Recent Anti –Trust victory spurs volume.  Savings due to lower Interchange.  ATM Network Rules much more important.  Retailers efforts to comply with ATM Network Rules, must be meaningful!
  32. 32. What can CPAs do to help Retailers Reduce Payments Exposure?  Assess the key management health of your retailer client.  Audit your retail client‟s third party processor.  Ensure your client does not store magnetic stripe data (prohibited by VISA due to risk of counterfeit cards).
  33. 33. Other Revenue Opportunities for CPAs  Prepare your clients for rules driven change  Design and implement a rollout plan to replace non-compliant POS PAD ATMs and “global” keys.  Secure PIN PAD Management.  DUKPT and Triple DES Algorithms.
  34. 34. What else can CPAs do?  Education of all key management operations personnel, for compliant implementation of key life cycle needed.  Understanding of Network Operating Rules and applicable ANS Standards.  Adequate written policies and procedures needed.  Acquisition of applicable PIN and Key Management Standards.
  35. 35. What else can CPAs do?  Review position papers.  Best practices for PIN Debit Security.   Preparing for the Industry Migration to Triple DES.   Get involved in the ANS Work Group F6.  to locate the standards and audit programs
  36. 36. Privacy Risks for Retailers  Why do Retailers Need to Care ?  Answer: Collecting Debit, Credit and Check Payments, require the retailer to acquire and store, non- public, personally identifiable information (NPI).  This triggers FTC liabilities.
  37. 37. Privacy Standards For Retailers  Federal Trade Commission (FTC) Adopts FFIEC Interagency Standards for Customer Information.  April 2000, FTC Fair Information Practice Principles.  Merchants now subject to banking rules through the FTC.
  38. 38. Privacy Standards For Retailers (cont‟d)  June 26,2000 - FFIEC issues Interagency Standards for customer information (Federal Register, Vol. 65/123/39475).  Regulators expect Banks and Service Providers to develop “Information Security Programs to ensure the security and confidentiality of customer information and protect against any anticipated threats to the security or integrity of such information….”
  39. 39. Privacy Standards For Retailers (cont‟d)  “..protect against unauthorized access to, or use of customer information that could…  result in substantial harm/inconvenience to customer.  present a “safety & soundness risk.”
  40. 40. Privacy Standards For Retailers (cont‟d)  Opt-out exceptions to FTC/GLBA Privacy Risks only:  For marketing arrangements.  Services if the customer authorizes.  For fraud protection/risk reduction.  Error resolution.
  41. 41. Privacy Standards For Retailers (cont‟d)  No exceptions to encryption mentioned.  Restriction on sharing of data, not intended to be limited to telemarketing only.
  42. 42. FTC Actions Vs. Non-Compliant Retailer  Guess settles FTC Security Charges; third FTC case targets false claims about Information Security.  Agency alleges security flaws placed consumers' credit card numbers at risk to hackers.
  43. 43. FTC Actions Vs. Non-Compliant Retailer (cont‟d) In the FTC's third case targeting companies that misrepresent the security of consumers' personal information, designer clothing and accessory marketer, Guess Incorporated, has agreed to settle Federal Trade Commission charges, that it exposed consumers' personal information, including credit card numbers to commonly known attacks by hackers.
  44. 44. FTC Actions Vs. Non-Compliant Retailer (cont‟d)  Contrary to the company's claims, FTC alleges that Guess did not use reasonable or appropriate measures to prevent consumer information from being accessed at its Web site:  The settlement will require that Guess implement a comprehensive information security program, for and its other Web sites.
  45. 45. FTC Actions Vs. Non-Compliant Retailer (cont‟d) "Consumers have every right to expect that a business that says it's keeping personal information secure, is doing exactly that," said Howard Beales, Director of the FTC's Bureau of Consumer Protection. "It's not just good business, it's the law," he said.
  46. 46. FTC Actions Vs. Non-Compliant Retailer (cont‟d) “Information would be secure and protected.” The company's claims included… "This site has security measures in place to protect the loss, misuse and alteration of information under our control" and “all of your personal information, including your credit card information and sign-in password are stored in an unreadable, encrypted format at all times."
  47. 47. FTC Actions Vs. Non-Compliant Retailer (cont‟d) In fact, according to the FTC, the personal information was not stored in an unreadable, encrypted format at all times and Guess' security measures failed to protect against SQL and other commonly known attacks. In February 2002, a visitor to the Web site, using an SQL injection attack, was able to read in clear text credit card numbers, stored in Guess' databases, according to the FTC.
  48. 48. Requirements  Part II of the Proposed Order requires an Infosec Program in writing, that is reasonably designed to protect the security, confidentiality and integrity of personal information, collected from, or about consumers.  Designate an employee or employees to coordinate and be accountable for the Information Security Program.
  49. 49. Requirements (cont‟d)  Identify material, internal and external risks to the security, confidentiality and integrity of customer information, that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information and assess the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment must include consideration of risks in each area of relevant operation.
  50. 50. Requirements (cont‟d)  Design and implement reasonable safeguards to control the risks identified through risk assessment, and regularly test or monitor, the effectiveness of the safeguards' key controls, systems, and procedures.  Evaluate and adjust its Information Security Program in light of the results of testing and monitoring, any material changes to its operations or business arrangements, or any other circumstances that Guess knows or has reason to know, may have a material impact on its Information Security Program.
  51. 51. Requirements (cont‟d)  Perform an assessment and report certifying that:  A security program provides protections that meet or exceed, the protections required by Part II of this order and…  The security program is operating with sufficient effectiveness, to provide reasonable assurance that the security, confidentiality, and integrity of consumer's personal information has been protected.
  52. 52. Enforcing Privacy Promises It's important that all retailers on-line and off, honor the privacy promises they make to consumers. The FTC has encouraged web sites to post privacy notices and honor the promises in them. Many web sites indeed, (nearly all of the Top 100 Sites) now post their privacy policies. The FTC has already brought a number of cases under Section 5 of the FTC Act, to enforce the promises in privacy statements. The FTC will also investigate claims touting the privacy and security features of products and services.
  53. 53. Enforcing Privacy Promises (cont’d)  Retain the documents for three years after the date that each assessment is prepared.  Submit compliance reports to the FTC.  Some states, (California) pass onerous privacy laws.  Encryption on bank-controlled links is a black and white issue.  Other state laws…a wild card.  More info:
  54. 54. Revenue Opportunities for CPAs  Assess whether or not your retail clients have a privacy program.  Regulatory Compliance Risk Assessment.  Information Security Assessments.
  55. 55. Check Truncation Act  Emerging Trend Electronically captures MICR Data. MICR Data = A one time debit. MICR Data forwarded to check processor. Check processor forwards to ACH or ATM Switch.
  56. 56. Check Truncation- Business Issues  Changed Float and Availability Schedules.  Time Value of Money.  Retailers win: less float, less check fraud.  Checks move electronically in lieu of trains, planes and automobiles.  May facilitate data theft.
  57. 57. Why Bother Encrypting?  It‟s an FTC Regulatory Requirement.  Check Truncation is premised on increasing confidence in Electronic Check Acceptance vs. Increasing Check Fraud Risk.  Enticement to steal account holder data, increases dramatically when large numbers of checking account numbers are transmitted and stored in clear text.
  58. 58. Why Bother Encrypting Truncated Check Files if we don‟t Encrypt Individual Checks?  Encrypting checking account information, offsets new flavors of old risks.  Account takeover (mailbox fraud).  Impersonating (spoofing) the check processor of merchant.  These risks could retard product acceptance if they are not managed and balanced with cost and implementation issues.
  59. 59. Why Bother Encrypting?  Insert a data sniffer between the Store Controller and the Check Processor.  Insert a data sniffer between the Check Processor and the Switch, or the Switch and FI.  Use a data program to logically inspect data packets.  Thousands of retail locations create ample opportunity.
  60. 60. Why Bother Encrypting?  Data sniffers are commonplace.  Work clandestinely - without a trace.  Not a controlled item.  Common to all telecommunications personnel.  Check fraud would be most like be perpetrated by insiders – technicians. This risk is no different than the risk in on line POS – where encryption is used
  61. 61. How Could the Check Fraud Occur?  Collect MICR numbers in bulk.  Transfer to desktop publishing device packages.  Print on high quality paper.  Check paper can be purchased for $8.00.  Forge large numbers of checks under the bank signature review threshold.
  62. 62. What are Viable Safeguards ?  Hardware Encryption.  Customer Account/MICR Data.  Similar to existing encryption of PIN Block.  Leverage existing PIN PAD Infrastructure.  Software encryption.  Encrypt same Data as with Hardware Encryption.  Link or End-to-End encryption.  Encrypts the entire message.  Processor Indemnification (least desirable).
  63. 63. How do I Know That Encryption is Really Viable?  Common uses of line encryptors.  EFT Switch to settlement ACH banks.  ACH processing - debit and credit applications.  Remote Banking and E-Commerce.
  64. 64. More Info About Encryptors  Link encryptors used successfully since 1980„s.  Most common problems are in key synchronization.  These issues are not characterized by users as severe.  Transaction throughput no longer an issue, as processor speeds have increased.  Average cost per node is about $1800.
  65. 65. Who makes line encryptors?  Racal  Cylink  Ravlin
  66. 66. Who Makes Line Encryptors?  What about the Telecommunications Protocol?  RACAL and Cylink product literature state that they support:  TCP/IP  Routers  Simple Network Management Protocol  Asynchronous Transmission  Full Duplex  PBX  Multiple Data Transfer Rates  Frame Relay up to 256 kbps  Dial-up  Remote Support
  67. 67. Who Makes Line Encryptors? Can hackers easily defeat encryption?  The product literature indicates support for strong encryption.  Triple DES  Diffie Hellman  Scant economic incentive for hackers to attempt to attack data, encrypted with strong methods.  Requires over 20 years and several million dollars to decrypt Triple DES or stronger encrypted data.
  68. 68. Implications Summary Truncating check data and converting it to electronic format, could facilitate mass theft of customer information, because the incentive to steal increases when the reward increases and the risk of detection is minimal.
  69. 69. Privacy Implications for Retailers  The Federal Trade Commission, the nation's consumer protection champion, plays a vital role in protecting consumers' privacy. The agency's pro-privacy agenda emphasizes both enforcement and education.  Any non-cash payment triggers obligations.
  70. 70. Web Payment Channels  Risks retailers need to manage.  Account Information Theft.  Card not present fraud.  Card Skimming/Counterfeit.  Fraudulent Applications and Identity Theft.
  71. 71. Web Payment Fraud Trends  Increased card compromises at third party processors and merchants attract payment network and regulatory attention.  VISA launches its Cardholder Information Security Program (CISP).  Merchants must comply or may lose access to the VISA brand.  MasterCard has similar intentions.
  72. 72. 4 - Key Characteristics of an Acceptable Web Payment Solution  Prevent Session/Credential Theft or Replay.  Authenticate User.  Authenticate Terminal.  Authenticate Access Device.
  73. 73. How Does CISP Work?  CISP defines a standard of due care for safeguarding cardholder information.  Compliance Audits for High Risk Merchants.  Self-Assessment for all other.  VISA or third party processors will push requirements to merchants.  12 - key CISP control objectives.
  74. 74. 12 - CISP Control Objectives  Install a working firewall.  Keep security patches updated.  Protect stored data.  Encrypt data transmissions using public networks.  Use and update anti-virus software.  Restrict access by need-to-know.
  75. 75. 12 - CISP Control Objectives  Assign unique IDs.  No use of default passwords.  User ID tracking and accountability.  Test security systems.  Implement a security policy.  Restrict physical access to data.
  76. 76. Web Payment Channels  More info on VISA CISP available by email at:  Some insurers require security audits as a condition of coverage for fraud & computer crime.
  77. 77. Opportunities for CPAs  Become a Visa Certified Provider.  SSAE Type Reviews.  Encryption Key Management Reviews.
  78. 78. Other Business Risks  Regulation E.  You must provide adequate receipts.  Time, Locator Number.  Amount.  Dispute Resolution.
  79. 79. Another Risk with Receipts  Regulation E requires truncation of card and account numbers on receipts.  Beware of Dumpster Diving.
  80. 80. Performance Risk  Do everything you can to promote a higher uptime and authorization rate.  Help your client avoid the “melting ice- cream syndrome.”  Consider DSL, Ethernet and IP-based networks.  Better handle electronic checks, loyalty programs and data mining.
  81. 81. Performance Risk  Caveat.  All Ethernet, IP and DSL Networks, require a firewall.  Beware of wireless risks at the POS.  More info: http://www/
  82. 82. Questions ? Thanks for your attendance!