Archives

• Robust penetration tests are critical to data security

  • PCI Compliance

  February 18, 2015

  

  One of the most effective ways a company can determine the security of a card processing platform is to undergo a penetration test. These are required for PCI compliance, and merchants conduct them annually to identify vulnerabilities to preempt malicious hacking attempts. In a standard penetration test, administrators make their best effort to compromise a network in the manner of cybercriminals, thereby revealing which areas might be sensitive to a breach. 

  Mark Burnette of Net Security says penetration tests allow merchants to use the tools of hackers to help fortify existing systems. Rather than waiting for criminals to discover vulnerabilities in your payment card processing system, penetrating them yourself first can allow companies to double down on security. 

  "In the … more

• What merchants need to know about the new credit card fraud liability rules

  • EMV

  February 11, 2015

  

  New rules for retailer credit card fraud are slated to go into effect on October 1, representing the first major sea change in credit fraud liability in years. But what do merchants need to know to make sure that they're ready for this change?

  According to the financial news website The Street, come this October, U.S. retailers looking to better manage risk after a new shift in fraud liability will need terminals compliant with Europay-MasterCard-Visa (EMV) "smart cards," which are designed to better curb instances of counterfeiting. This shift in determining where liability lies if fraud occurs is just one step in a much larger process of pushing for a more widespread of EMV throughout the U.S.

  While card issuers — predominantly banks — used to … more

• Marriott franchise hit by another string of breaches

  • Credit Card Terminals

  February 10, 2015

  

  Many of the Marriott Hotel locations whose credit processing systems were compromised in 2013 experienced a similar breach in the second half of last year. After several banks and credit institutions investigated incidents of fraud on credit and debit accounts, investigative reporter Brian Krebs followed the payments to the series of hotels, 14 in total. 

  The locations in question are run by franchise operator White Lodging Services, and the breach was traced to hacked point of sale systems. The compromises mostly occurred at restaurants and bars at the hotels, between September 2014 and January 2015, according to Jeff Goldman at eSecurity Planet. 

  "We recently were made aware of the possibility of unusual credit card transactions at a number of hotels operated by one of our … more

• New "Ghost" vulnerability prompts warning from Homeland Security Department

  • PCI Compliance

  February 09, 2015

  

  A new vulnerability called "Ghost" has emerged as a threat to computer systems, cautions PCI Security Standards. The United States Department of Homeland Security has issued a warning to users of Linux GNU C Library operating versions prior to 2.18. By remotely executing a code, hackers can take control of a system to install malware, manipulate files and carry out other illegal activities with stolen credentials, reports Mobile Payments Today. 

  The warning was released through the United States Computer Emergency Readiness Team, and PCI Security Standards Council made suggestions for companies to protect their secure payment card data in light of the new threat:

  First, companies should work with IT departments to find systems, servers and pieces of hardware that run a targeted … more

• Less than one-third of retailers remain compliant between audits

  • PCI Compliance

  February 09, 2015

  

  Businesses that use credit card merchant services are held to PCI compliance standards, but many of them only do the legwork in advance of an audit. With the spate of headline-grabbing breaches, it's easy to see why this is bad business practice. According to Verizon's 2015 PCI Report, only 28.6 percent of retailers remain compliant with PCI standards in the periods between audits. This means that some companies are keeping up with standards imposed on credit card security for only a brief window of time, leaving them open to vulnerabilities for the remainder of the year. 

  "We see compliance going down day by day, month by month, after the assessment," said Rodolphe Simonetti, managing director for Verizon's compliance consulting. "Compliance is supposed to be … more

by Ty Hardison

Share this Post