The Achilles Heel of PCI Compliance

The payments industry has made significant improvements toward complying with the Payment Card Industry Data Security Standard. But, as Verizon Business' Wade Baker explains, it's the maintenance of PCI DSS compliance that seems to pose the biggest challenges.

This week, Verizon Business releases its 2010 Payment Card Industry Compliance Report, a study that analyzes 200 selected PCI assessments conducted in 2008 and 2009 by Verizon's Qualified Security Assessors. The report reviews how companies are attaining and maintaining PCI compliance. Among the key findings this year: Businesses and organizations struggled most with PCI requirements regarding tracking and monitoring access, as well as meeting the demands for system and process testing and the protection of stored cardholder data.

"Companies struggle with anything they have to maintain over time that requires constant attention," says Baker, director of risk intelligence for Verizon and one of the PCI report's authors. "Just because you were validated at a point in time does not mean that's going to remain static all year."

Lack of Diligence

What often leads to breaches at once-PCI-compliant companies, Baker says, is a lack of consistency and diligence. Companies are not maintaining PCI compliance. "If you don't maintain compliance by constantly reevaluating and upgrading systems, that compliance will erode over time. It erodes down to the point where they are weak, and that's when a breach occurs," he says.

Of organizations Verizon reviewed or assessed for the report, only 22 percent were consistently compliant with PCI requirements from one year to the next. "They gain compliance and they're validated in year one, and then by year two they've lost a little bit," Baker says. "That's a very interesting trend."

Baker is quick to point out that the companies Verizon found that had been breached were not PCI compliant at the time, but had been PCI compliant at some point in the past.

Most payments companies, he says, are doing a better job at staying compliant, but improvements in corporate mindsets are needed. "Certain attacks are going down, and I think a lot has to do with the PCI DSS. But other types of attacks are going up," Baker says.

In Verizon's Data Breach Investigations Report, which also was recently released, Verizon notes that while the number of data base breaches has dropped, the compromise of records has increased. "Personal information in records, like medical records, has value to criminals," Baker says. "But there is a lot of positive momentum in that range, as well," to better protect consumer information.

PCI Common Sense

The vast majority of breaches are preventable, Baker says. Only a small percentage of breaches require sophisticated controls. "Following the security basics, Security 101 and 102, consistently and comprehensively across the organization is rule No. 1," Baker says. "And that would knock out many of these breaches."

Verizon notes that 90 percent of all breaches could have been prevented with something simple, like changing a password. Chris Novak, who works in Verizon's forensics unit, said during his presentation at the PCI Community Meeting in September, that only 15 percent of breaches are high-tech. "The majority of the breaches we see are of moderate complexity," he said. SQL injections top the list and are the most easily prevented, Novak says.

Baker also points to the exploitation of default credentials or stolen credentials as ranking high on the compromise list. "An attacker just goes and starts hammering away at an application and tries 'admin' and 'password' and other combinations that are set at the factory on certain devices and systems," Baker says. "All too often, just trying that a few times allows the attacker in, and then he can do whatever he wants to do from that point on."

False Sense of Computer Security

A team of security analysts found that most leading anti-spyware and anti-virus software fail to detect commonly used keyloggers.

Keyloggers are designed to silently record all of one's computer activity. They are commonly used for parents to monitor their children's computer activity. Now they are being used for criminal activity ranging from spying on individuals, identity theft and data theft.

The security team at SpyReveal tested the leading anti-spyware and anti-virus software against ten of the most popular keyloggers. The results were astonishing! Most of the leading security software used to combat viruses and spyware failed to detect 70% of the keyloggers. While most failed to detect any keyloggers at all, SpyReveal successfully detected all keyloggers.

Computer users are receiving a false sense of security when installing various security applications. With the explosion in online banking, the proliferation of identity theft is greater than ever. Many users install an anti-spyware solution with the expectation of being safe from identity theft. Unfortunately, they are still at an extremely high risk for identity theft and data logging.

"More and more news stories are being published of hackers who have obtained credit card records by using keyloggers", said Mr. Hankinson, SpyReveal's co-founder. "Yet, we still see major players in the security industry continue to fail at this specific type of problem."

Still don't think you or your business is at risk? Take for example Verizon's 2009 Data Breach Investigations Supplemental Report which states "Keyloggers and spyware.... played a crucial role in larger breach scenarios in which hundreds of millions of records were compromised."

"Consumers and businesses should not rely on a single solution for security. Each has a specific purpose. We want consumers to realize that even though their anti-spyware software says 'Nothing Found', that any keylogger could still be present, recording credit card information or business intellectual property," Mr. Hankinson added.

It is important for users to purchase security solutions that are designed for a dedicated purpose to receive the highest degree of protection, without being too narrow. With software like SpyReveal, you can rest assured that you are protected from most keyloggers available on the open market.

Security review: Good riddance to 2009

Network World - Looking back at 2009, I'm sure I will not be alone in celebrating the end of the year with gusto. 2009 was a difficult year for most, with a slow recovery and challenging business conditions. Let's see how I did predicting security trends in 2009:

Host-based security. I predicted that host-based security would rise in importance with the release of Windows 7. It is still too early to tell if Windows 7 will shift the discussion in security, but so far this prediction has not come true. Perhaps it represented wishful thinking.

Mobile security concerns and solutions grow. I predicted the emergence of a trojan on a mobile platform and the increased importance of security for mobiles. The iPhone worm and other security incidents validate this prediction.

Encryption grows. At-rest encryption did in fact grow, coming as standard in most desktop operating systems and being widely adopted by companies as a default policy. E-mail encryption is still a challenge, according to last year's prediction. I'll count this one as a successful prediction

No news is bad news. While no new major malware outbreaks made huge headlines, the silent spread of stealthy keyloggers, trojans and botnets continued. As predicted, more computers fell prey to these silent threats while the lack of headlines is broadly and incorrectly seen as "success" against malware. computerworld

Why should I worry about my privacy on the Internet?

Viruses, spam, worms, Trojan horses, spyware, adware, keyloggers, zombies, phishing schemes. Sometimes it seems that danger is always lurking on the Internet, in your email inbox, and maybe even on your computer. But are you and your personal information really at risk? And are the consequences really that bad?

From time-worn email cons allegedly originating from Nigeria to keylogger programs that capture everything you type, scams, fraud, and cons do abound on the Web. And the perpetrator may not be a suspicious-looking email or software hidden on your hard disk. It could be that new friend you met in a chat room or on a social networking site who befriends you and over time gathers your personal and financial information.

What can happen if you're the victim of a scam? You could be locked out of your online account and be unable to access your email. But there can be even greater consequences. You could be the victim of identity theft. Alibaba

Keyloggers Could Be Responsible for Leaked Webmail Credentials

More likely than phishing argues security researcher

A security researcher rebuts Microsoft and Google's claims that a massive industry-wide phishing operation was responsible for stealing the recently leaked webmail credentials. New arguments point to the discovered lists being the work of keyloggers.

A few days ago, Microsoft confirmed the authenticity of a list containing over 10,000 Hotmail usernames and passwords, which was discovered in plain sight on Pastebin. A Windows Live Hotmail team member noted that the document is likely the result of a phishing attack, a theory reinforced by the findings of Acunetix's Chief Technology Officer, who analyzed the leaked data.

A second list was discovered by BBC News reporters and contained similar data pertaining to Gmail, Yahoo! Mail and AOL accounts, as well as mailboxes provided by several ISPs. A Google spokesperson noted that the company independently found a third list and also invoked the same attack scenario.

However, the phishing theory doesn't fit well with Mary Landesman, a senior security researcher at Web security company ScanSafe, who argues that some form of malware with keylogging capabilities is more likely to be the culprit. "I believe a data theft trojan might have been involved," she says.

Ms. Landesman notes that ScanSafe researchers came across a cache of stolen credentials gathered by such a trojan a few months ago. "The stolen data was organized by the victim's Windows Live ID (where applicable), followed by usernames and passwords (and the URL) for secure websites the victims visited. This was listed by browser type (either Firefox or Internet Explorer) and included any FTP usernames and passwords," she explains and goes on to speculate that the Hotmail list might have been extracted from such a master document.

The leaked document contains only usernames beginning with A and B, suggesting that it’s only a sample probably used by the attacker to advertise the whole list for sale to spammers. The security researchers have found several signs that are not consistent with a phishing scheme. SoftPedia