Monthly ArchivesJanuary 2009

End to End Encryption is NOT the PCI Silver Bullet! standard

Evan Schuman of StorefrontBacktalk has a pretty shocking article today. Apparently, the Heartland malware hid in the unallocated file space. Right on the heels of my last blog post too. Nuts. Our forensic examiners at VeriSign look for this type of malware during every investigation because it is not a new trick. It surprises me that it was almost missed. Even still, I stand by my original premise which is that the standard (properly implemented) would prevent this. In order to get the malware on there, a software flaw or credential had to be exploited. Both of those vulnerabilities are addressed by PCI-DSS. What is more troubling is the same noise that came out after the Hannaford breach last year. ...

Continue Reading

What CEOs (and CISOs!) Can Learn from Heartland standard

It’s one week later. With limited public announcements, what is this post going to tell you? Well, let’s start off by stating what it won’t tell you. You won’t find any gory details about the breach or the other parties involved. You won’t find anything here that cannot be deduced using public information sources. You won’t find anything here that has not been stated before. So what use is it? How about we assemble some key points and do a little bit of analysis to understand how something like this can be prevented in your company. According to the original press release, the investigation uncovered malicious software that compromised data that crossed Heartland’s network. Before we start attacking PCI and ...

Continue Reading

PCI Compliant Companies Don’t Suffer Breaches standard

We’ve got another one in the news. Heartland Payment Systems recently reported a breach that may have affected up to 100 million cards. That’s a lot. Heartland joins another elite group of companies that suffered a breach, but was also validated as compliant by a QSA. I want to make something very clear in this next paragraph, but before I do, none of the comments here should be tied directly to any incident that has been in the news. We keep our customer lists private unless we get permission to use one as a reference. There is a big misnomer out there that needs to be cleared up. I’ve even written about it before in this blog. In our investigations ...

Continue Reading

This is a unique website which will require a more modern browser to work!

Please upgrade today!