This document discusses business security insights and highlights key points from the 2012 Verizon Breach Report. It summarizes that small and medium businesses are now the preferred targets for payment card and authentication data theft. Over two-thirds of breaches investigated in 2011 were at small and medium businesses. While outside threats were responsible for most breaches, inside threats like data loss, remote access issues, and human error also pose risks. The document outlines different technical, physical, network, endpoint, and operational security layers businesses should implement and maintain to protect themselves, as well as issues like compliance, costs of prevention versus remediation, and the role of insurance.

1. Business Security Insights
Earl.Chen@BankofAmerica.com Lawrence.Godfrey@e-hps.com JHenbest@ptcllc.com Alberto@SureTech.com

2. What do I need to protect?
o Credit Card Data / Personal Info
(Identities)
o Files
o Business Data
2

3. 2012 Verizon Breach Report – Targeted Data
For SMB’s Payment Card Data and Authentication Data is the data most targeted.
3

4. 2012 Verizon Breach Report – Target Organization
The preferred target now seems to be the SMB’s (small and medium businesses).
570 of the 855 investigations, over 66% of the total investigations.
4

5. Outside Threats
Outside/External threats responsible for
98% of data breaches investigated in
2011
2012 Verizon Breach Report
5

6. Security Stories
Examples
6

7. Hacking 30 Years Ago
7

8. Hacking Today
Source: www.fbi.gov
http://www.fbi.gov/news/stories/2010/octo
ber/cyber-banking-fraud/cyber-banking-
fraud/?searchterm=cyber%20theft
8

9. 2012 Verizon Breach Report – How do they get in?
Much as it has in the past, the most common malware infection
vector continues to be installation or injection by a remote
attacker.
This covers scenarios in which an attacker breaches a system
VIA REMOTE ACCESS and then deploys malware or injects code
via web application vulnerabilities.
9

10. Security Experiences
Examples
10

11. Inside Threats
o Data Corruption / Loss (Hardware, Operator
or Programmatic failures)
o Remote Access Tools / Trusted Vendor
Security Holes
o BYOD – Bring your own device
o Human error / Training
o Sabotage
11

12. Other Inside Threats
The other internal threats that needs to be considers are;
– Hard Drive Crash
– Water or fire damage to POS
– No backups or lack of testing backup procedures
12

13. Preparedness, Costs & Risks
How to think of Return on Investment: Is
security a bottom line cost or a profit center?
o What are the financial risks/costs?
 Prevention
 Remediation
o PCI / HIPAA / FINRA / SEC compliance and
liabilities
13

14. PCI-DSS: Why Care? – Protecting your income
 Breach consequences for a Tier 4 merchant
 Actual Mid-West Steakhouse example:
Fines and Costs Breakdown Steakhouse
Visa Fines $ 5,000
MasterCard Fines $ 30,000
Forensic Investigation Costs $ 10,322
Visa card compromise program $ 60,000
Chargebacks $ 202,223
Total Direct Breach Costs $307,545
Please Note: Breached merchant must now adhere to Level/Tier 1 Requirements
14

15. Preparedness, Costs and Risks
Disaster Recovery vs. Business Continuity
o Backup
o Component Redundancy
o Enterprise Redundancy
15

16. Technical Security Layers
Physical
o Checkpoints, locks, and surveillance
o Logging
o Force Majeur (fire, earthquakes, etc.)
Network Equipment location/locks
o Intrusion prevention
o Intrusion detection
o Access Management and ease of use
EndPoint
o FireWall
o AntiVirus: how did AntiVirus lose the war? Where is the battle
now?
o OS Updates / Security Patches
16

17. Basic Elements of Physical Security
Questions to consider…
Can a visitor to your business pickup a notebook computer and slip out the
door easily? What about a cell phone with email records?
Is the door to the server room always locked?
Are employees trained to ensure guests do not wander?
Are employees appropriately limited on where they can go?
www.ptcllc.com
17

18. Basic Elements of Physical Security
o Deterrence
o Access Control
o Detection
o Identification
www.ptcllc.com
18

19. www.ptcllc.com
19

20. Basic Elements of Network Security:
o Secure Passwords
o Perimeter Firewalls
o Intrusion Prevention
What to watch:
o Intrusion Detection
o Logging
o Alerting
Monitor, monitor, monitor…
Always look to improve and enhance as new threats are discovered…
www.ptcllc.com
20

21. www.ptcllc.com
21

22. Effective network segmentation - PCI DSS requires it to minimize the scope
of review…
www.ptcllc.com
22

23. POS Network Wireless Network Office Network
www.ptcllc.com
23

24. Intrusion Prevention
www.ptcllc.com
24

25. Basic Elements of Endpoint Security:
o Secure Passwords
o OS and Security Patches
o Antimalware Protection
o Client Firewalls
o Mobile Devices
www.ptcllc.com
25

26. Recent study by Imperva (data security firm in California) and Technion-Israel
Institute of Technology found success rate of the top 40+ antivirus products to be…
Less than 5%
Symantec – Not called Antivirus software any longer…. Now Norton Internet
Security and Symantec Endpoint Protection
Trend Micro, McAfee, and others are doing the same.
They are losing the war and they know it.
Source: NY Times, Outmaneuvered at Their Own Game, Antivirus Makers Struggle to Adapt – 12/31/2012
www.ptcllc.com
26

27. Operator Security Layers
Operational Controls:
o People: non business use, using default passwords etc.
o The Myth of Secure Passwords
o Reset Password holes (questions, email)
o Password manager
o Backup
o Training
o Auditing
o Data Integrity Tools
o Policies, Training, Enforcement
 User Training
 Data Silos (Credit Cards, Financial, Customer, Operations)
Insurance
o What can insurance do for me?
27

28. 28

29. 29

30. What is next for my business?
o Security is
complex, multilayered and
ever changing.
o Being aware of the issues that
relate to your business is the
first step.
o Any solution will require
trusted partners and an eye to
integration of multiple
solutions.
30

31. Thank you for attending.
Earl.Chen@BankofAmerica.com Lawrence.Godfrey@e-hps.com JHenbest@ptcllc.com Alberto@SureTech.com
31