SECURITY CHECK – HEARTLAND PAYMENT SYSTEMS

EASy Security Project: Part 2-- Analysis of the Security Incident using COBIT (DS5:  Ensure Systems Security)

5.1- MANGE SECURITY MEASURES

WE THINK THIS BREACH WOULD NOT HAVE HAPPENED IF THE SECURITY MEASURED WERE CORRECTLY MEASURED AND EVERY ASPECT WAS TAKEN UNDER CONSIDERATION WHILE CREATING THE SECURITY MEASURES AND CONSTANTLY MONITORING THE SECURITY MEASURE AND UPDATING AS NEEDED. ACCORDING TO BRIAN KREBS OF THE WASHINGTON POST “A PIECE OF MALICIOUS SOFTWARE PLANTED ON THE COMPANY'S PAYMENT PROCESSING NETWORK THAT RECORDED PAYMENT CARD DATA AS IT WAS BEING SENT FOR PROCESSING TO HEARTLAND BY THOUSANDS OF THE COMPANY'S RETAIL CLIENTS.” IF THE SECURITY MEASURES WERE MANAGED PROPERLY AND PUT INTO PLACE IN THE RIGHT AREAS (OR ALL AREAS FOR THAT MATTER) THE MALICIOUS CODE COULD NOT HAVE BEEN PLANTED WITHIN THE ORGANIZATION INFRASTRUCTURE. IT SECURITY SHOULD BE MANAGED SUCH THAT SECURITY MEASURES ARE IN LINE WITH BUSINESS REQUIREMENTS. AN IT SECURITY PLAN SHOULD INCLUDE TRANSLATING RISK ASSESSMENT, IMPLEMENTING THE IT SECURITY PLAN,, MONITORING THE SECURITY PLAN, AND ALIGNING THE IT SECURITY PLAN WITH ALL POLICIES AND PROCEDURES WITHIN THE ORGANIZATION.

5.2-IDENTIFICATION AND AUTHENTICATION ACCESS IF STRONG AUTHENTICATION METHODS ARE

PRACTICED AND ARE CHANGED ON A ROTATIONAL BASIS (I.E. USERNAMES, PASSWORDS, AUTHENTICATION METHODS AND SECURITY) IT MAKES IT HARDER FOR PEOPLE ON THE OUTSIDE TO DISGUISE THEMSELVES AS REGULAR A USER TO BREACH INTERNAL OPERATIONS. ACCESS TO AND USE OF IT COMPUTING AND INFRASTRUCTURE RESOURCES SHOULD BE RESTRICTED BY THE IMPLEMENTATION OF STRONG IDENTIFICATION, AUTHENTICATION, AND AUTHORIZATION MECHANISMS AND TECHNIQUES.

5.3-SECURITY OF ONLINE ACCESS TO DATA

THIS IS PROBABLY THE MOST IMPORTANT APPROACH TO GO ALONG WITH OUR SECURITY INCIDENT. NOT ONLY DOES NETWORK ACCESS FROM INTERNAL OPERATIONS NEED TO BE SECURE, BUT FROM OUTSIDE THE COMPANY BOUNDARIES AS WELL. THERE SEEMS TO ALWAYS BE A WAY FOR INTRUDERS TO INFILTRATE AN ORGANIZATIONS NETWORK FROM OUTSIDE THE COMPANY AND THE STRONGEST SECURITY MEASURES NEED TO BE IMPLEMENTED TO TRY AND STOP THIS. THIS NEEDS TO ALSO BE MONITORED ON A 24/7 BASIS. TRAFFIC NEEDS TO BE ANALYZED CONSTANTLY AND ANY SUSPICIOUS BEHAVIOR SHOULD BE LOGGED AND INVESTIGATED. ACCORDING TO ROBERT HB BALDWIN JR., PRESIDENT AND CHIEF FINANCIAL OFFICER OF HEARTLAND “HEARTLAND WAS ALERTED IN THE LATE AUTUMN TO SUSPICIOUS ACTIVITY SURROUNDING PROCESSED CARD TRANSACTIONS BY VISA AND MASTERCARD AND HIRED FORENSIC AUDITORS WHO UNCOVERED MALICIOUS SOFTWARE THAT COMPROMISED DATA IN THE COMPANY'S NETWORK, BALDWIN SAID.” THIS SHOULD HAVE BEEN SEEN AS AN OUTSIDE OR INSIDE INTRUDER BY HEARTLAND INC. ITSELF.

5.4-USER ACCOUNT MANAGEMENT

THE MANAGEMENT AND SUPERVISORS OF HEARTLANDS INFRASTRUCTURE TEAMS SHOULD HAVE ESTABLISHED STRICT PROCEDURES FOR USER ACCOUNT CONTROL. REQUESTING, ESTABLISHING, ISSUING, SUSPENDING, AND CLOSING USER ACCOUNTS FOR EMPLOYEES WILL ENSURE ALL USER ACCOUNTS ARE BEING MANAGED AND WILL KEEP INTRUDERS FROM HIGH JACKING STRAY USER ACCOUNTS TO STEAL DATA. FORMAL APPROVALS NEED TO BE ISSUED INVOLVING ALL CHANGES TO USER ACCOUNTS AND ALL THIRD-PARTY ACCESS TO INTERNAL USER ACCOUNTS NEEDS TO BE DONE CONTRACTUALLY. THIS WILL ENSURE SECURITY OF HEARTLANDS EMPLOYEE USER ACCOUNTS.

5.5 MANAGEMENT REVIEW OF USER ACCOUNTS

ONE OF THE MALWARE SOURCES OF THE SECURITY BREACH RESULTED FROM A BASIC SQL INJECTION ERROR. THIS PUTS INTO QUESTION THE CONTROL THAT CONFIRMS ACCESS RIGHTS. A REVIEW OF USER ACCOUNTS AND WHAT OBJECTS THEY ARE AUTHORIZED TO ACCESS MAY HAVE ALERTED HEARTLAND SECURITY AUDITORS TO THE BREACH EARLY WHEN THE SQL WAS ACCESSED. THE ABSENCE OF THIS CONTROL ALLOWED THE SQL/BREACH TO GO UNDETECTED, ONLY TO BE ALERTED MUCH LATER BY THE CREDIT CARD COMPANIES’ FRAUD CONTROL PROCESSES, WHICH IN TURN NOTIFIED HEARTLAND. PERIODIC COMPARISONS OF RESOURCES WITH RECORDED ACCOUNTABILITY SHOULD BE COMPLETED TO HELP REDUCE THE RISK OF FRAUD OR UNAUTHORIZED ALTERATION OF SOFTWARE CODE/SQL.

5.6 USER CONTROL OF USER ACCOUNTS

IF HACKERS GAINED ACCESS TO A USER’S ACCOUNT THAT HAD ACCESS TO IMPLANT THE MALWARE THAT CAUSED THE BREACH, THIS CONTROL COULD HAVE PROVIDED INFORMATION MECHANISMS TO NOTIFY THE USER OF ABNORMAL ACTIVITY OR UNUSUAL TIME STAMPS ON ACTIVITY. THIS AGAIN MAY HAVE ALERTED THE USER THE FIRST TIME HE/SHE LOGGED IN AFTER THE UNUSUAL ACTIVITY OCCURRED, STATING A CHAIN REACTION TO ALERT SECURITY, 3RD PARTY CREDIT CARD COMPANIES, AND AUTHORITIES. SYSTEMATIC CONTROLS ON USER ACTIVITY, ESPECIALLY DATA BASE ACTIVITY MAY HAVE HELPED TO MITIGATE THIS INCIDENT.

5.7-SECURITY SURVEILLANCE

THIS SHOULD BE PUT INTO PLACE TO RECOGNIZE PATTERNS BASED ON HISTORICAL DATA. THE IMPLEMENTATION OF THE MALICIOUS CODE, AND THE CONSEQUENCES OF THE MALICIOUS CODE, SHOULD HAVE BEEN DETECTED, DESTROYED, AND CONSTANTLY MONITORED. THIS WOULD HAVE ENSURED IT NEVER TO HAPPEN AGAIN. EFFECTIVE AND EFFICIENT INVESTIGATION OF THE SECURITY BREACH WAS PUT INTO PLACE. HEARTLAND CALLED U.S. SECRET SERVICE AND HIRED TWO BREACH FORENSICS TEAMS TO INVESTIGATE, WHICH IS WHEN THE MALICIOUS CODE WAS SURFACED. THE IT SECURITY ADMINISTRATION OF HEARTLAND SHOULD HAVE ENSURED THAT SECURITY ACTIVITY IS LOGGED AND ANY INDICATION OF SECURITY MISHAPS NEED TO BE REPORTED.

5.9 CENTRAL IDENTIFICATION AND ACCESS RIGHTS MANAGEMENT

GLOBAL ACCESS TO DATA, IN THIS CASE SENSITIVE CREDIT CARD DATA WAS POSSIBLE. CONTROLS TO INSURE ACCESS RIGHTS TO DATA AND ENSURE OWNERSHIP IN A CENTRAL IDENTIFICATION PROCESS MAY HAVE PREVENTED EXECUTION AND ACCESS TO THIS DATA. IN THIS INCIDENT, IT WAS POSSIBLE FOR INTRUDERS TO ACCESS THE SYSTEM AND IMPLANT CODE, IF A CENTRAL SYSTEM AUTHORIZATION ROUTINE HAD BEEN IN PLACE THIS MAY HAVE NOT BEEN POSSIBLE. THIS CONTROL ENABLES IDENTITY OF A SYSTEM AND DATA OWNERSHIP AND MANAGEMENT IN A UNIQUE AND CENTRAL MANNER.

5.10-VIOLATION AND SECURITY ACTIVITY REPORTS SYSTEM ABUSE AND SECURITY VIOLATIONS CANNOT

GO UNDETECTED AND SECURITY BREACHES CANNOT CONTINUE FOR A PROLONGED PERIOD OF TIME. THE MALICIOUS CODE AND THE DAMAGE THAT IT CAUSED WENT ON FOR ABOUT 2 WEEKS. THIS SHOULD NOT HAVE HAPPENED. THE SECURITY BREACH SHOULD HAVE BEEN DETECTED, LOGGED, AND THE SECURITY INCIDENTS NEEDED TO BE REVIEWED AND EXCEPTIONS FOLLOWED UP TO FIND ROOT CAUSES. APPROPRIATE REPORTING AND ESCALATION NEED TO BE PUT IN PLACE. THE BREACH SHOULD HAVE BEEN DETECTED EARLY AND FOLLOWED UP ON TO ENSURE NO MORE DAMAGE WAS DONE AND FIXES NEED TO BE PUT INTO PLACE TO ENSURE IT WOULD NOT HAPPEN AGAIN.

5.11 INCIDENT HANDLING

INSTEAD OF HEARTLAND MERELY MEETING THE REQUIRED PCI REQUIREMENTS, THE COMPANY SHOULD HAVE FOCUSED ON IMPLEMENTING AN END TO END INCIDENT HANDLING PROCEDURE. INCLUDING END TO END SECURITY AND ENCRYPTION OF ALL SENSITIVE DATA. THUS, ENSURING AN APPROPRIATE EFFECTIVE AND TIMELY RESPONSE TO INCIDENTS SUCH AS THIS ONE. HEARTLAND CLAIMED TO MEET AND EXCEED ALL REQUIRED PCI STANDARDS, TAKING A LOT OF TIME TO CREATE REPORTS AND IMPLEMENT TO SPECIFICATION. THE OPPORTUNITY COST WAS FOCUSING LESS ON END TO END SECURITY, ENCRYPTION AND IMMEDIATE INCIDENT REPORTING, MONITORING AND PROCEDURES. THE HEARTLAND INCIDENT ALSO SHOWED THAT COMPLIANCE WITH STANDARDS SUCH AS PCI IS MEANINGLESS UNLESS THERE IS A WAY OF MONITORING THAT COMPLIANCE ON A CONTINUOUS BASIS AND QUICKLY RESPONDING TO INCIDENTS.

5.12 REACCREDITATION

THE SOFTWARE THAT WAS PLANTED WENT UNDETECTED FOR WEEKS. WITH REACCREDITATION YOU ARE PREFORMING UPDATES TO THE FORMALLY APPROVED SECURITY LEVEL AND THE ACCEPTANCE OF RESIDUAL RISK. WITH UPDATING THE SECURITY LEVELS AND ACCEPTANCE OF RISK THEY MAY HAVE BEEN ABLE TO PREVENT THIS INCIDENT IF REACCREDITATION WAS DONE MORE OFTEN. WHEN YOU REEVALUATE YOUR SECURITY YOU FIND HOLES THAT MAY OF HAVE BEEN OVERLOOKED. HOWEVER NOT ONLY CAN YOU FIND FLAWS WITH YOUR SECURITY BUT BUY TAKING AN EXTRA LOOK AT THINGS HEARTLAND MAY HAVE BEEN ABLE TO FIND THE SOFTWARE THEMSELVES.

5.14 TRANSACTION AUTHORIZATION IF MORE CRYPTOGRAPHIC TECHNIQUES FOR VERIFYING

TRANSACTIONS WERE USED IT COULD OF HAVE STOPPED THE SOFTWARE FROM BEING ABLE TO RECORD USEFUL DATA OR COULD HAVE POSSIBLY STOPPED THE SOFTWARE FROM RECORDING ANYTHING AT ALL. WITH PROPER AUTHENTICITY YOU CAN ENSURE THAT ONLY THE CORRECT PEOPLE CAN HAVE ACCESS TO SENSITIVE INFORMATION. ALSO WITH CRYPTOGRAPHIC TECHNIQUES YOU HAVE A BETTER CHANCE OF ENSURING THAT USER’S CLAIMED IDENTITY IS VALID. THE SOFTWARE THAT WAS USED EVES DROPPED ON THE TRANSACTION AFTER IT WAS AUTHENTICATED. HOWEVER WITH STRONGER CRYPTOGRAPHIC TECHNIQUES THE INFORMATION THAT WOULD BE RECORDED COULD MEAN NOTHING WITHOUT THE CRYPTOGRAPHIC KEY.

5.15 NONREPUDIATION

WITH TRYING TO MAKE TRANSACTIONS SECURE AS POSSIBLE YOU NEED TO ENSURE THAT WHERE APPROPRIATE TRANSACTIONS CANNOT BE DENIED BY EITHER PARTY TO PROVIDE NONREPUDIATION OF ORIGIN OR RECEIPT, PROOF OF SUBMISSION AND RECEIPT OF TRANSACTIONS. THIS IS EITHER DONE WITH DIGITAL SIGNATURES OR A DATA HASH. THE ONE PROBLEM WITH DIGITAL SIGNATURES IS IF THEY ARE NOT SAFEGUARDED BY THE ORIGINAL OWNER THEY COULD FALL IN THE WRONG HANDS AND CAN BE FORGED WHICH IS A MAJOR CONCERNED.

5.16 TRUSTED PATH

WHEN DEALING WITH CREDIT CARD INFORMATION YOU NEED TO INSURE THAT THE SENSITIVE DATA IS ONLY EXCHANGED OVER A TRUSTED PATH. WITH HEARTLAND THIS TRUSTED PATH WAS BREACHED AND ALLOWED THE SOFTWARE TO RECORD THE TRANSACTIONS THAT WERE BEING SENT TO BE PROCESSED. TO ENSURE THAT THE PATH IS NOT BREACHED STRONG ENCRYPTION NEEDS TO BE USED BETWEEN USERS AND SYSTEMS. HEARTLAND ALSO NEEDS TO ENSURE THAT THERE TRUSTED PATH CANNOT BE SPOOFED OR CORRUPTED.

5.17 PROTECTION OF SECURITY FUNCTIONS IT’S OBVIOUS THAT THE PROTECTION AND THE SECURITY

FUNCTIONS OF HEARTLAND WHERE BREACHED BY DATA-STEALING PROGRAMS PLANTED BY THE THIEVES. THE GOAL OF ACHIEVING END-TO-END PROTECTION IS A CHALLENGING ONE WITH SO MANY DIVERSE ENDPOINTS IN A TRANSACTION LIFECYCLE POINT OF SALE POS, DATABASES, MAINFRAMES, AND PAYMENT NETWORKS ALL OF WHICH NEED TO BE PROTECTED FROM CORRUPTION, KEY MANAGEMENT IS A CRITICAL ASPECT OF ALL ENCRYPTION SYSTEMS AND THROUGH OUR PARTNERSHIP WITH THALES WE ARE ABLE TO ENHANCE OUR END-TO-END ENCRYPTION SOLUTION TO PROTECT KEY MANAGEMENT FUNCTIONS AND OTHER CRYPTOGRAPHIC OPERATIONS IN A TAMPER RESISTANT AND SECURITY CERTIFIED ENVIRONMENT – AN ESSENTIAL REQUIREMENT IN THE PAYMENTS MARKET.”

5.18 CRYPTOGRAPHIC KEY MANAGEMENT VOLTAGE TECHNOLOGY INTEGRATION ALLOWS CUSTOMERS TO

APPLY HARDENED DATA PROTECTION MEASURES AT VIRTUALLY ANY POINT ALONG THE DATA PATH TO HELP ACHIEVE THE GOAL OF END-TO-END PROTECTION. BY HELPING TO REDUCE THE TIME AND COMPLEXITY OF DEPLOYING DATA PROTECTION AND BY SIGNIFICANTLY LIMITING THE SCOPE OF SECURITY AUDITS, THE BURDEN OF DEMONSTRATING REGULATORY AND INTERNAL COMPLIANCE IS DRAMATICALLY REDUCED. WITH TYPE OF SECURITY THE THIEVES WOULDN’T HAVE BEEN ABLE TO READ THE DATA THAT THEY STOLE.

END-TO-END ENCRYPTION IS INCREASINGLY THE LEADING METHOD OF SECURING DATA THROUGHOUT THE PAYMENT STREAM AND FOR ENTERPRISE SECURITY APPLICATIONS. FOR ORGANIZATIONS SUBJECT TO PCI DSS (PAYMENT CARD INDUSTRY DATA SECURITY STANDARD), USING HARDWARE SECURITY MODULES (HSM) SOLUTIONS FURTHER REDUCES THE SCOPE OF PCI AUDITS.

5.19 MALICIOUS SOFTWARE PREVENTION, DETECTION AND CORRECTION

WITH HEARTLAND END-TO-END ENCRYPTION, HEARTLAND IS RAISING THE BAR IN RETAIL PAYMENTS SECURITY, BEYOND EXISTING SECURITY MANDATES, BY DEPLOYING END-TO-END ENCRYPTION TO PROTECT CARDHOLDER AND SENSITIVE AUTHENTICATION DATA THROUGHOUT THE PAYMENT PROCESS THE VOLTAGE SOLUTIONINTEGRATED JUST WORKS AND, IN A MATTER OF WEEKS RATHER THAN MONTHS, DELIVERED THE DATA PROTECTION AND KEY MANAGEMENT THAT HEARTLAND NEEDS TO MOVE THE PAYMENTS INDUSTRY FORWARD.

5.20 FIREWALL ARCHITECTURES AND CONNECTIONS WITHPUBLIC NETWORKS

WHEN HEARTLAND WAS BREACHED THEIR FIREWALL ARCHITECTURE WERE OBVIOUSLY NOT UP TO PAR WHERE IT SHOULD HAVE BEEN.

AS A SERVICE TO THE INDUSTRY AND GENERAL PUBLIC, THE COMPANY MAINTAINS THE VOLTAGE DATA BREACH INDEX AND MAP WHICH IS CONTINUOUSLY UPDATED WITH GLOBAL DATA BREACH INFORMATION. HEARTLAND NOW IS ACTIVE IN THE STANDARDS COMMUNITY AND IS A PCI SECURITY STANDARDS COUNCIL.

VOLTAGE HAS ALSO BEEN ISSUED SEVERAL PATENTS BASED UPON BREAKTHROUGH RESEARCH IN MATHEMATICS AND CRYPTOGRAPHIC SYSTEMS. CUSTOMERS INCLUDE GLOBAL 1000 COMPANIES IN BANKING, RETAIL, INSURANCE, ENERGY, HEALTHCARE AND GOVERNMENT.

  THE ORGANIZATION MUST BECOME PCI-DSS COMPLIANT. FOR

MERCHANTS LOOKING FOR A GOOD PLACE TO START, FOUR ESSENTIAL ACTIONS WILL GET YOU STARTED ON PCI COMPLIANCE AND HELP WITH THE MOST COMMON VULNERABILITIES FOUND ON COMPUTER NETWORKS TODAY:

1. DO NOT ALLOW UNSECURE ACCESS FROM THE INTERNET OR WIRELESS NETWORKS TO YOUR COMPUTERS.

2. BLOCK INTERNAL COMPUTERS AND DATA TRANSFER PROTOCOLS TO THE INTERNET EXCEPT TO THE SITES AND PORTS NECESSARY FOR BUSINESS FUNCTIONS.

3. MAKE SURE THAT THE POS SOFTWARE STORING CREDIT CARDS IS SECURE.

4. MAKE SURE THAT THE LEVEL OF SECURITY IN PLACE IS VERIFIABLE FOR MOUNTING A DEFENSE.