reducing payment system risks in retail delivery - july 20, 2004
DESCRIPTION
TRANSCRIPT
Reducing Payment Systems Risks in the Retail Delivery Channel
NYS Society Of CPA’sTechnology Assurance Committee
July 20, 2004
Presentation Objectives
Assist Auditors who have Retail and DataProcessing Clients by: Identifying dynamic payment methods
and channels. Reviewing risks and mitigation
techniques. Discussing secure payment options for
the “virtual” or web delivery channel.
Point of Sale Crimes
External Domestic – individuals / gangs. Global – individuals / gangs (organized crime type). Attacks can be physical or logical. Published threats of physical attacks available.
Point of Sale Crimes (cont’d)
Internal Disgruntled employees / highly trusted
individuals. Attack can be physical or logical access. Published fraud not readily available.
Retail PaymentDelivery Channels & Methods
ATM Networks Debit and Check Cards. Credit Cards Branded by MC, VISA, Discover, Amex. Third Party Processors. ACH Networks. Electronic Check Truncation. Web Based Methods.
Key Point
Retailers are almost always sponsored into a payment network.
Retailers should check their liability to the sponsor, regarding network rules compliance.
The sponsor may hold the retailer liable for losses or breach of required security procedures.
Check your contract !
How Is Each Method Different ?
ATM cards can be used with a pin. Pin-based allows real time
authorization. Same day settlement/no Float. Secure. Preferred by merchants due to lower
cost. Authorization time can be slower.
Check Cards
ATM cards can be authorized with a pin or signature.
ATM cards often branded with a NYCE, Star and/or MasterCard or VISA logo.
When authorized with a signature, authorization and settlement are batched based.
Check cards are prone to high fraud rates vs. ATM only cards.
Check Cards (cont’d)
At their zenith of popularity. Usage will flatten due to MC/VISA loss in
class action anti-trust suit. Retailers must obtain electronic
authorization. Follow floor limit rules. Follow CVC/CVV counterfeit card
protections.
Check Cards (cont’d)
Hot carding procedures essential. Fraud Risk/Velocity check essential. Not a good idea for internet or MOTO
transactions. Banks love them due to high
interchange.
Check Cards (cont’d)
Retailers win the Walmart anti-trust suit. After 1/1/04, retailers need not accept
them. Learn more about fraud management by
obtaining Visa's Check Card Risk Management Overview (doc# V10524-0698) and Check Card Card Risk Management Brochure.
MasterCard has similar documents.
Third Party Processors & ACH Networks
3rd Party Processors provide data processing, settlement and authorization services to retailers.
Automated Clearinghouse Services (ACH) provide settlement services for the retailer and their processor.
Check cards present a higher risk due to charge back and delayed settlement.
Check Truncation
Electronic capture, transmission and authorization of physical checks.
Faster authorization. Less float and credit risk.
POS Debit Crime - External
Skimming: Magnetic card reader device (about the size
of a Palm Pilot or a duplicate POS device). Debit card is swiped through the “skimmer”
as well as the legitimate POS device. Card data is collected from the magnetic
strip of the card. Make bogus cards from collected data…
make purchases from victims’ accounts.
POS Crime – External (cont’d)
Skimming: Device attached to an legitimate ATM. Captures card data. Camera records customer entering PIN or
thief obtains PIN by “shoulder surfing”. Make bogus cards from captured data.
Create false deposits to inflate account balance. Make withdrawal.
Industry Trends Driving Risk
Merchants prefer PIN-based debit. Accepting PINs saves merchants $$$$
BUT… PIN-based debit means merchants
assume risk of data loss or theft, if they fail to observe card association and network rules.
Industry Trends Driving Risk(cont’d)
Increased network security requirements. FTC adopts Banking Privacy Rules (GLBA). More sophisticated card “skimming”. Retailers begin deploying ATMs in their
stores.
Industry Trends Driving Risk(cont’d)
Exploding pin-based volumes. Check card volumes almost equal credit card
volume. Retailers win Anti-trust suit. Retailers enter the web delivery channel. FTC successfully sues retailer for privacy
violations.
Industry Trends Driving Risk(cont’d)
Expensive, security driven technology changes: New Encryption Algorithms. New Fraud Checking – CVC2. Wireless Technology at the check out lane. Loyalty Cards create more data storage of
non-public cardholder data.
Card Association & Network Requirements
VISA Cardholder Information Security Program (CISP).
ATM Networks require compliance with PIN Security Rules.
Retailers need financial institution sponsors to accept debit.
Implications
Retailers will need expertise in: Card Technology Card Security Retail Encryption Standards Privacy & Identity Management Access Controls Security Audits Needed – VISA CISP
PIN Debit
What Risks Do Retailers Need to
Manage ?
Card Skimming Has Reached Epidemic Proportions
Examples: Breaches of logical security. Installation of a “parasite” or sniffer on
the key pad or controller. Low tech “double swipe technique”. Wireless POS may broadcast data.
What Is The Risk?
Cardholder PIN Security depends upon the retailers implemented Key Management Procedures.
Can you survive… Replacing Citibank’s, Bank of America’s or
any large institution’s cards? The brand damage to your institution? Disconnection from a payment brand ?
What PIN-based Standards Retailers Must Know
Identify Liability to their SponsorIdentify Liability to their ProcessorPractice a Standard of reasonable
care=ANSI Standards x9.8 and X9.24Major ATM Networks(Star, NYCE, Interlink) follow these
standards
Standards for PIN and Key Management
American National Standards Institute (ANSI) published standards for Retail Banking to provide protection of: PIN Issuance. All PIN’ed Transactions during Interchange. Symmetric Cryptographic Keys
used in Retail Banking Payment Infrastructure,
to protect PINs
* Standards are voluntary
Standards for PIN and Key Management Some retailers deploying in store
ATMs to earn surcharge and interchange
Knowledge of
How Does Retail Encryption Work ?
To lock up information to
share with Castle B
Chest
123
45
Chest
12345
Castle BCastle A
Same Key
To lock up information to share with Castle A
PINsPINs
KeysKeysData
Chest 12345
Authenticating the Card Holder - ANS X9.8:
Any Bank Retailer's PIN
PAD
• The PIN is a means of verifying the identity of a customer within an Electronic Funds Transfer (EFT) System.
•The objective of PIN Management is to protect the PIN against unauthorized disclosure and compromise and misuse throughout its life cycle.
•PIN Security depends on sound key management. Maintaining the secrecy of the Cryptographic Keys is of the utmost importance, because the compromise of the key allows the compromise of any PIN ever enciphered under it.
• Using an ANY Bank card at an
Oregon Bank owned ATM.
Customer
E. PEK(P
IN b
lock
)
PIN Verification by the Issuer Host (on-us or not-on-us):
Oregon Bank
Retailer PED
NYCE
Other switches
Star
PULSE
Federal CU
Third Party Processor
(TPP)
FCU cardholder
1) TPP does not verify PIN at ATM, transaction transported to FCU host center.
2) OB performs a PIN translation to transport transaction to network.
3) E.AWK(PIN) 4) Network performs a PIN translation to transport to FCU Issuer.
5) PIN is verified at FCU host center and authorization
Pin Debit Growth
Implications for Retailers Recent Anti –Trust victory spurs volume. Savings due to lower Interchange. ATM Network Rules much more
important. Retailers efforts to comply with ATM
Network Rules, must be meaningful!
Assess the key management health of yourretailer client.
Audit your retail client’s third party processor. Ensure your client does not store magnetic stripe
data (prohibited by VISA due to risk of counterfeit cards).
What can CPAs do to help Retailers Reduce Payments Exposure?
Other Revenue Opportunities for CPAs
Prepare your clients for rules driven change Design and implement a rollout plan to
replace non-compliant POS PAD ATMs and “global” keys.
Secure PIN PAD Management. DUKPT and Triple DES Algorithms.
What else can CPAs do?
Education of all key management operations personnel, for compliant implementation of key life cycle needed.
Understanding of Network Operating Rules and applicable ANS Standards.
Adequate written policies and procedures needed.
Acquisition of applicable PIN and Key Management Standards.
What else can CPAs do?
Review position papers. Best practices for PIN Debit Security.
http://www.nyce.net/pdf/PIN_debit_encryption.pdf Preparing for the Industry Migration to Triple DES.
http://www.nyce.net/pdf/triple_des.pdf Get involved in the ANS Work Group F6. http://www.x9.org to locate the standards and audit
programs
Privacy Risks for Retailers
Why do Retailers Need to Care ? Answer: Collecting Debit, Credit and
Check Payments, require the retailer to acquire and store, non- public, personally identifiable information (NPI).
This triggers FTC liabilities.
Privacy Standards For Retailers
Federal Trade Commission (FTC) Adopts FFIEC Interagency Standards for Customer Information.
April 2000, FTC Fair Information Practice Principles. Merchants now subject to banking rules through
the FTC.
June 26,2000 - FFIEC issues Interagency Standards for customer information (Federal Register, Vol. 65/123/39475).
Regulators expect Banks and Service Providers to develop “Information Security Programs to ensure the security and confidentiality of customer information and protect against any anticipated threats to the security or integrity of such information….”
Privacy Standards For Retailers (cont’d)
Privacy Standards For Retailers (cont’d)
“..protect against unauthorized access to, or use of customer information that could… result in substantial harm/inconvenience
to customer. present a “safety & soundness risk.”
Opt-out exceptions to FTC/GLBA Privacy Risks only: For marketing arrangements. Services if the customer authorizes. For fraud protection/risk reduction. Error resolution.
Privacy Standards For Retailers (cont’d)
No exceptions to encryption mentioned.
Restriction on sharing of data, not intended to be limited to telemarketing only.
Privacy Standards For Retailers(cont’d)
FTC Actions Vs. Non-Compliant Retailer
Guess settles FTC Security Charges; third FTC case targets false claims about Information Security.
Agency alleges security flaws placed consumers' credit card numbers at risk to hackers.
FTC Actions Vs. Non-CompliantRetailer (cont’d)
In the FTC's third case targeting companies that misrepresent the security of consumers' personal information, designer clothing and accessory marketer, Guess Incorporated, has agreed to settle Federal Trade Commission charges, that it exposed consumers' personal information, including credit card numbers to commonly known attacks by hackers.
FTC Actions Vs. Non-CompliantRetailer (cont’d)
Contrary to the company's claims, FTC alleges that Guess did not use reasonable or appropriate measures to prevent consumer information from being accessed at its Web site: Guess.com.
The settlement will require that Guess implement a comprehensive information security program, for Guess.com and its other Web sites.
FTC Actions Vs. Non-CompliantRetailer (cont’d)
"Consumers have every right to expect that a business that says it's keeping personal information secure, is doing exactly that," said Howard Beales, Director of the FTC's Bureau of Consumer Protection. "It's not just good business, it's the law," he said.
FTC Actions Vs. Non-Compliant Retailer (cont’d)
“Information would be secure and protected.” The company's claims included… "This site has security measures in place to protect the loss, misuse and alteration of information under our control" and “all of your personal information, including your credit card information and sign-in password are stored in an unreadable, encrypted format at all times."
FTC Actions Vs. Non-Compliant Retailer (cont’d)
In fact, according to the FTC, the personal information was not stored in an unreadable, encrypted format at all times and Guess' security measures failed to protect against SQL and other commonly known attacks. In February 2002, a visitor to the Web site, using an SQL injection attack, was able to read in clear text credit card numbers, stored in Guess' databases, according to the FTC.
Requirements
Part II of the Proposed Order requires an Infosec Program in writing, that is reasonably designed to protect the security, confidentiality and integrity of personal information, collected from, or about consumers. Designate an employee or employees to
coordinate and be accountable for the Information Security Program.
Requirements (cont’d)
Identify material, internal and external risks to the security, confidentiality and integrity of customer information, that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information and assess the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment must include consideration of risks in each area of relevant operation.
Requirements (cont’d)
Design and implement reasonable safeguards to control the risks identified through risk assessment, and regularly test or monitor, the effectiveness of the safeguards' key controls, systems, and procedures.
Evaluate and adjust its Information Security Program in light of the results of testing and monitoring, any material changes to its operations or business arrangements, or any other circumstances that Guess knows or has reason to know, may have a material impact on its Information Security Program.
Requirements (cont’d)
Perform an assessment and report certifying that: A security program provides protections
that meet or exceed, the protections required by Part II of this order and…
The security program is operating with sufficient effectiveness, to provide reasonable assurance that the security, confidentiality, and integrity of consumer's personal information has been protected.
Enforcing Privacy Promises
It's important that all retailers on-line and off, honor the privacy promises they make to consumers. The FTC has encouraged web sites to post privacy notices and honor the promises in them. Many web sites indeed, (nearly all of the Top 100 Sites) now post their privacy policies. The FTC has already brought a number of cases under Section 5 of the FTC Act, to enforce the promises in privacy statements. The FTC will also investigate claims touting the privacy and security features of products and services.
Enforcing Privacy Promises(cont’d)
Retain the documents for three years after the date that each assessment is prepared.
Submit compliance reports to the FTC. Some states, (California) pass onerous privacy
laws. Encryption on bank-controlled links is a black and
white issue. Other state laws…a wild card. More info: http://www.ftc.gov/privacy/index.html
Revenue Opportunities for CPAs
Assess whether or not your retail clients have a privacy program.
Regulatory Compliance Risk Assessment.
Information Security Assessments.
Check Truncation Act
Emerging Trend Electronically captures MICR Data. MICR Data = A one time debit. MICR Data forwarded to check processor. Check processor forwards to ACH or ATM Switch.
Check Truncation- Business Issues
Changed Float and Availability Schedules.
Time Value of Money. Retailers win: less float, less check
fraud. Checks move electronically in lieu of
trains, planes and automobiles. May facilitate data theft.
Why Bother Encrypting?
It’s an FTC Regulatory Requirement. Check Truncation is premised on increasing
confidence in Electronic Check Acceptance vs. Increasing Check Fraud Risk.
Enticement to steal account holder data, increases dramatically when large numbers of checking account numbers are transmitted and stored in clear text.
Encrypting checking account information, offsets new flavors of old risks. Account takeover (mailbox fraud). Impersonating (spoofing) the
check processor of merchant. These risks could retard product
acceptance if they are not managed and balanced with cost and implementation issues.
Why Bother Encrypting Truncated Check Files if we don’t Encrypt Individual Checks?
Why Bother Encrypting?
Insert a data sniffer between the Store Controller and the Check Processor. Insert a data sniffer between the Check Processor
and the Switch, or the Switch and FI. Use a data program to logically inspect data
packets. Thousands of retail locations create ample
opportunity.
Data sniffers are commonplace. Work clandestinely - without a trace. Not a controlled item. Common to all telecommunications
personnel. Check fraud would be most like be
perpetrated by insiders – technicians.
This risk is no different than the risk in on line POS – where encryption is used
Why Bother Encrypting?
Collect MICR numbers in bulk. Transfer to desktop publishing device
packages. Print on high quality paper.
Check paper can be purchased for $8.00.
Forge large numbers of checks under the bank signature review threshold.
How Could the Check Fraud Occur?
Hardware Encryption. Customer Account/MICR Data. Similar to existing encryption of PIN Block. Leverage existing PIN PAD Infrastructure.
Software encryption. Encrypt same Data as with Hardware
Encryption. Link or End-to-End encryption.
Encrypts the entire message. Processor Indemnification (least desirable).
What are Viable Safeguards ?
How do I Know That Encryption is Really Viable?
Common uses of line encryptors. EFT Switch to settlement ACH banks. ACH processing - debit and credit
applications. Remote Banking and E-Commerce.
Link encryptors used successfully since 1980‘s.
Most common problems are in key synchronization.
These issues are not characterized by users as severe.
Transaction throughput no longer an issue, as processor speeds have increased.
Average cost per node is about $1800.
More Info About Encryptors
Who makes line encryptors?
Racal Cylink Ravlin
Who Makes Line Encryptors?
What about the Telecommunications Protocol? RACAL and Cylink product literature state that
they support: TCP/IP Routers Simple Network Management Protocol Asynchronous Transmission Full Duplex PBX Multiple Data Transfer Rates Frame Relay up to 256 kbps Dial-up Remote Support
Who Makes Line Encryptors?
Can hackers easily defeat encryption? The product literature indicates support for
strong encryption. Triple DES Diffie Hellman
Scant economic incentive for hackers to attempt to attack data, encrypted with strong methods.
Requires over 20 years and several million dollars to decrypt Triple DES or stronger encrypted data.
Implications
Summary
Truncating check data and converting it to electronic format, could facilitate mass theft
of customer information, because the incentive to steal increases when the reward
increases and the risk of detection is minimal.
Privacy Implications for Retailers
The Federal Trade Commission, the nation's consumer protection champion, plays a vital role in protecting consumers' privacy. The agency'spro-privacy agenda emphasizes both enforcement and education.
Any non-cash payment triggers obligations.
Web Payment Channels
Risks retailers need to manage. Account Information Theft. Card not present fraud. Card Skimming/Counterfeit. Fraudulent Applications and Identity Theft.
Web Payment Fraud Trends
Increased card compromises at third party processors and merchants attract payment network and regulatory attention.
VISA launches its Cardholder Information Security Program (CISP).
Merchants must comply or may lose access to the VISA brand.
MasterCard has similar intentions.
4 - Key Characteristics of an Acceptable Web Payment Solution
Prevent Session/Credential Theft or Replay.
Authenticate User. Authenticate Terminal. Authenticate Access Device.
How Does CISP Work?
CISP defines a standard of due care for safeguarding cardholder information.
Compliance Audits for High Risk Merchants.
Self-Assessment for all other. VISA or third party processors will
push requirements to merchants. 12 - key CISP control objectives.
12 - CISP Control Objectives
Install a working firewall. Keep security patches updated. Protect stored data. Encrypt data transmissions using
public networks. Use and update anti-virus software. Restrict access by need-to-know.
12 - CISP Control Objectives
Assign unique IDs. No use of default passwords. User ID tracking and
accountability. Test security systems. Implement a security policy. Restrict physical access to data.
Web Payment Channels
More info on VISA CISP available by email at: [email protected]
Some insurers require security audits as a condition of coverage for fraud & computer crime.
Opportunities for CPAs
Become a Visa Certified Provider. SSAE Type Reviews. Encryption Key Management
Reviews.
Other Business Risks
Regulation E. You must provide adequate
receipts. Time, Locator Number. Amount. Dispute Resolution.
Another Risk with Receipts
Regulation E requires truncation of card and account numbers on receipts.
Beware of Dumpster Diving.
Performance Risk
Do everything you can to promote a higher uptime and authorization rate.
Help your client avoid the “melting ice-cream syndrome.”
Consider DSL, Ethernet and IP-based networks.
Better handle electronic checks, loyalty programs and data mining.
Performance Risk
Caveat. All Ethernet, IP and DSL Networks,
require a firewall. Beware of wireless risks at the POS. More info: http://www/cisecurity.org
Questions ?
Thanks for your attendance!