Feb 16 2023

What is the tokenization process and why it is so important?

Category: Information Security,pci dss — DISC @ 10:27 am
https://www.hackread.com/what-is-tokenization-process/

A large number of e-commerce payment platforms use effective payment gateway tools and effectively integrate them with an acceptable payment strategy. Today’s e-commerce websites need to integrate anti-fraud tools, renew bank cards, integrate multiple gateways, and manage alternative payment methods.

It is important to get these complex integrations right and bring them together into one functioning system; choosing the right tokenization partner is the key to success in these processes.

What is the tokenization process and why is it needed?

Tokenization is an important process of replacing sensitive data, such as credit card numbers, with unique identifying information while preserving all important data information; a tokenization solution is a form of using a unique security key to provide an appropriate level of security to important confidential data.

Think of tokenization as a secret code that uses a key to retrieve an encrypted message. Some versions of the credit card number store the last four digits; however, the remaining digits of the credit number are random.

In this case, you can safely store the token in the database. Anyone with access to this token cannot use it to compromise your credit card account. For these tokens to be used to process credit card transactions, they must be re-linked to the original credit card numbers. Typically, this mapping is performed by a secure third party. All this is done to ensure full security.

Blockchain technology is a technology that most people associate only with cryptocurrencies. This attribution is not entirely incorrect, as the blockchain was created for the Bitcoin cryptocurrency. However, much has changed since 2009 (the year Bitcoin appeared), and the scope of blockchain technology continues to actively expand.

One of the key applications of this technology today is tokenization, a secure form of digitization based on the blockchain technology mentioned above. The process of tokenization consists of assigning a specific value to a symbol, which can exist materially or immaterially, and is a digital “token” that stores data. With this efficient solution, you can securely buy and sell your assets online.

Examples of this use of tokens include the value of the stock market. Most of us associate stocks and bonds with paper-based notices of ownership of those assets, but tokenization allows us to replace those paper notices with digital versions. The implementation of traditional solutions in the digital world simplifies and optimizes a large number of important processes, making them significantly more efficient.

The terms “token” and “cryptocurrency” are often confused and used interchangeably; not surprisingly, both concepts are closely related to blockchain technology. The key difference between cryptocurrencies and tokens is that cryptocurrencies are a means of payment, whereas tokens cannot; they can be compared to a kind of chip.

A token is created using smart contracts on a specific blockchain network and can perform various key functions. Each blockchain network can contain an unlimited number of tokens.

On the other hand, a smart contract is a kind of computer program embedded in a certain blockchain network that automatically enforces the terms contained in it. Both tokens and cryptocurrencies can be transferred on the blockchain network; however, token transaction fees depend on the cryptocurrency.

What information must be provided for tokenization?

Tokenization is commonly used to protect credit card numbers, a process mandated by the Payment Card Industry Council (PCI). However, there are many different use cases, tokenization terminology allows you to learn a variety of effective tools that provide active growth in the field of security for business organizations for which it is important to reliably protect confidential data.

Consider personal or personally identifiable information. HIPPA, General Data Protection Regulation (GDPR) requires confidential processing, anonymization, and secure storage of personal data. Organizations and various business environments should use tokenization capabilities when the business needs to securely store confidential information, such as:

  • ID number;
  • Date of birth;
  • Gender or race;
  • Driver’s license;
  • Credit card number;
  • Valid phone number;
  • Bank account number;
  • Social insurance number;
  • Current residential address of clients;

Due to the universality of tokens, they are divided into several types that perform different functions. One of the key differences is between mutual tokens and non-splitting tokens. For example, payment tokens are used to make payments. Their function is mainly to ensure the safety of investors. Issued security tokens are protected by law and represent specific stocks, bonds, or other assets of genuine interest.

Are my tokens safe?

Undoubtedly, there are many advantages to using tokens, but is it safe to store data? Security is considered one of the most important benefits of tokenization. Stability, irreversibility of transactions, and elimination of intermediaries are just some of the characteristics that affect security when using blockchain technology.

In addition, the security of tokenization is provided by smart contracts that allow parties to trade directly. For example, selling real estate in the form of tokens does not require a notary or a real estate agent. Everything is done quickly and directly.

Note that each contracting party must ensure that personal tokens are properly stored and protected from loss to properly act as guarantors of successful transactions. Tokenization is a form of business digitization based on blockchain technology.

The potential of tokenization is huge and has yet to be fully explored. Tokens are divided into different types. The most common use of tokens is to digitize different types of assets, such as physical assets, digital assets, projects, company shares, shares, or loans.

What are the different types of tokenization processes?

When it comes to PCI tokens, there are three key types of tokenization: gateway tokenization, end-to-end tokenization, and payment service tokenization. Gateway tokenization. When you do e-commerce, you most likely get paid through a payment gateway.

Most gateways have technology that allows you to securely store your credit card in the system, then issue a refund and delete your card data. The downside is that each gateway provides its token scheme. This means that you cannot use this gateway. Changing gateways is often a time-consuming and expensive process of moving customer data to a new gateway for secure processing. 

In some cases, the gateway may not allow these actions. End-to-end tokenization. Some independent tokenization providers have their technology that sits between your e-commerce site and the gateway. These end-to-end token providers allow you to use your existing gateway integration code.

One of the key advantages of this type of tokenization is that it uses existing technology and can be adapted at a very fast pace. It also has the advantage of modularity. Unlike gateway tokenization, modularity can be actively used for more than just credit card payments. You can use the tokenization model to connect to most APIs and tokenize data other than credit card data.

End-to-end tokenization is an evolution of gateway tokenization. This gives payment solutions the freedom to route transactions to different gateways in real-time, avoiding costly and time-consuming transfers of card data between different payment platforms.

Tokenization processes of various important payment services

A key tokenization strategy is the payment service model. This model offers a single API that, when integrated, can route payments to multiple gateways. The payment service model is best suited for companies with more complex payment needs.

This model works well when a company needs to pay in several regions or several different currencies or through several gateways. A disadvantage of the payment service model is that existing gateway embed code cannot be reused.

In addition to reduced PCI coverage and increased security, the tokenized payment service model has unique key benefits from its active use. The payment services model not only simplifies your embed code but also takes control of your tokens away from the payment gateway. Unlike gateway tokenization, tokens provided by third parties can be actively used with supported gateways. 

Tokens issued by payment gateways cannot be used against competing alternative gateways. Security and compliance alone are reasons enough to implement a popular solution like the tokenization of various assets that are important to you, your company, and your customers.

The truth is that key security requirements for online payments are difficult to implement on your own. In particular, startups often choose to sacrifice security for time to market. Accepting online payments makes your business a target for cybercriminals. Hiring security experts and implementing effective tokenization processes can save your business environment valuable time and money in the long run.

Keep these practical tips in mind. Choose a reliable tokenization partner, test the tokenization, what level of protection you can achieve by working on the integration, and find a vendor that can integrate multiple gateways, methods, and services into a single integration. One of the key technologies needed to connect all payment solutions is tokenization.

A trusted provider fully controls tokens, provides redundancy, reduces PCI coverage, and improves the security standards in place in your business environment.

What can be tokenized?

The use cases for tokenization can grow endlessly. Since anything can be digitized, tokenization is often used in professional life. These are various business projects that can demonstrate the most practical examples of using tokenization.

Digitization of the company involves the creation of tokens that are closely related to a specific project. Tokenization techniques that add value to tokens can be used as an indispensable tool for automating processes in companies and as a means of financing them. Real estate tokenization is becoming more and more popular worldwide due to the following features: transaction speed, lack of intermediaries, and security.

The process of property tokenization involves issuing tokens on the blockchain network and linking them to certain properties. Thus, the investor becomes a co-owner or owner of a certain asset, the shares of which can be represented in tokens.

Using blockchain technology and a specially designed platform, it is also possible to assign unique numbers to gems and certain forms of ore to determine their authenticity.

Raw materials registered with digital numbers can then be identified by verifying their origin, properties, and associated processes. NFT tokens have the unique potential to revolutionize both the physical and digital art markets. Each NFT token has a unique, non-tradable value that allows you to express your interest in the rights to a work of art, making investing in art an easy and fast process.

What is the tokenization process and why it is so important?

Digital Finance: Security Tokens and Unlocking the Real Potential of Blockchain

Blockchain and the Future of Finance

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Dec 14 2022

Payment Giant Exposed 9 Million Credit Card Transaction Records

Category: pci dss — DISC @ 10:25 am
Payment Giant Exposed 9 Million Credit Card Transaction Records

In a recent find, security researcher Jeremiah Fowler and the Website Planet research team discovered an open and unprotected database that contained 9,098,506 records of credit card transactions. 

What’s worse, the trove of personal and financial was left exposed on a misconfigured server without any password or security authentication.

The owner of the database was identified as Cornerstone Payment Systems, a credit card processing company based in California. Upon being informed, they took swift action to restrict public access the very same day, thanking the researchers for reporting the exposure. 

Cybercrimes related to credit and financial data are especially dangerous because access to data such as partial credit card numbers, account or transaction information, names, contacts, and donation comments allow threat actors to establish a target profile.

These criminals are then able to launch highly targeted phishing campaigns or social engineering attacks. It is estimated that 98% of cyber attacks involve some form of social engineering.

The Exposed Data

In this data leak, the Personally Identifiable Information (PII) included merchants, users, and customer names, partial credit card numbers, type of card, expiration date, physical addresses, and email addresses, security or access tokens, phone numbers, and more.

Furthermore, information regarding the transaction was also included such as donation details, recurring payments, and comments. The donation details had the dollar amount and what the donation was for such as payments for goods or services, and any other transaction.

Additionally, electronic check payment data included bank names and check numbers. The notes also had authorization tokens and if the payment was declined, or accepted, and reasons for the decision.

Cybercriminals would be able to use such information to reach out to customers while pretending to be legitimate merchants or organizations. This sensitive information warrants that criminals can build a relationship of trust with their victims to obtain additional payment information or a Social Security Number (SSN) or other information for nefarious purposes. 

Cornerstone Payment Systems Exposed 9 Million Credit Card Transaction Records
Screenshot 1 shows transaction records from an anonymous donor – Screenshot 2 shows transaction records including personal data (Provided to Hackread.com by Website Planet)

Moreover, according to Website Planet’s blog post, since many of the transactions in this database were made for donations or recurring payments to religious organizations, charity campaigns, or nonprofit groups, the criminals could target victims based on their beliefs or the causes that they support.

Many of the transaction comments the researchers saw were for religious, pro-life/anti-abortion, anti-COVID mandates, and other conservative or religious causes. It is not uncommon for hacktivists to take a vigilante stance and attack targeted individuals.

Therefore, it is essential for organizations that collect and store PII to use encryption and take other security measures to protect their sensitive data online. It is also just as necessary for the potentially affected individuals to be notified and advised to practice extra caution in all their online interactions.  

Disclosure of Certain Credit Card Complaint Data

Tags: Credit Card Transaction Records

Sep 02 2022

Researchers analyzed a new JavaScript skimmer used by Magecart threat actors

Category: Cyber Threats,pci dss — DISC @ 8:33 am

Researchers from Cyble analyzed a new, highly evasive JavaScript skimmer used by Magecart threat actors.

Cyble Research & Intelligence Labs started its investigation after seeing a post on Twitter a new JavaScript skimmer developed by the Magecart threat group used to target Magento e-commerce websites.

In Magecart attacks against Magento e-stores, attackers attempt to exploit vulnerabilities in the popular CMS to gain access to the source code of the website and inject malicious JavaScript. The malicious code is designed to capture payment data (credit/debit owner’s name, credit/debit card number, CVV number, and expiry date) from payment forms and checkout pages. The malicious code also performs some checks to determine that data are in the correct format, for example analyzing the length of the entered data.

In this specific case, the researchers discovered that when a user visits the compromised website, the skimmer loads the payment overlay and asks the user to enter the payment information.

The skimmer is obfuscated and embedded in the JavaScript file “media/js/js-color.min.js”

Magecart skimmer

nce the victim has entered its payment data in the form, the JavaScript file collects them and then sends the Base64-encoded data to the URL included in the JavaScript using the POST method

Cyble experts noticed that upon executing the JavaScript, it checks if the browser’s dev tool is open to avoid being analyzed.

“Online shopping activity is constantly on the rise due to its ease of use, digital transformation, and the sheer convenience. Skimmer groups continue to infect e-commerce sites in large numbers and are improving their techniques to remain undetected.” concludes the report. “Historically, Magento e-commerce websites have been the most highly targeted victims of skimmer attacks. While using any e-commerce website, ensure that you only use known and legitimate platforms.”

Researchers analyzed a new JavaScript skimmer used by Magecart threat actors

Data Privacy: A runbook for engineers

Tags: data protection, JavaScript skimmer, Magecart threat actors

Jul 25 2022

PCI DSS: Which PCI SAQ is Right for My Business?

Category: pci dss — DISC @ 12:25 pm
PCI DSS: Which PCI SAQ is Right for My Business?

Organisations that fall within Levels 2–4 of the PCI DSS (Payment Card Industry Data Security Standard) can attest to compliance with an SAQ (self-assessment questionnaire).

You will fall into one of those levels if your organisation processes fewer than six million card transactions per year.

There are several types of questionnaire, and in this blog we help you understand which one is right for you.

What is a PCI SAQ?

Organisations that are subject to the PCI DSS must demonstrate that they have taken appropriate steps to secure the payment card data that they hold.

There are two ways to do this: with a PCI SAQ or an RoC (report on compliance). Each payment brand (American Express, Discover, JCB, MasterCard and Visa) has its own requirements, so they establish the eligibility criteria for SAQ or RoC.

The PCI SAQ is the less rigorous method and is typically used for organisations that process fewer than six million transactions annually.

Once it’s completed, the PCI SAQ is signed off by an officer of the merchant or service provider, validating the organisation’s compliance practices.

PCI SAQ types

There are several types of PCI SAQ that apply in certain circumstances. It’s essential that organisations choose the correct assessment. They are as follows:

SAQ A

For merchants that outsource their entire card data processing to validated third parties. This includes e-commerce merchants and mail/telephone order merchants. 

It applies where: 

  • The merchant’s website is hosted and managed by a PCI-compliant third-party payment processor; or 
  • The merchant’s website provides an iframe (inline frame) or URL that redirects customers to a PCI-compliant third-party payment processor. 

Nearly all online merchants aim for SAQ A, because it is the simplest, least time-consuming assessment.

SAQ A-EP

For e-commerce merchants that don’t receive cardholder data but do control the method through which data is redirected to a third-party payment processor. 

It applies where: 

  • The merchant’s website creates a payment form and “direct posts” payment data to a PCI-compliant third-party payment processor; or 
  • The merchant’s website provides an iframe or URL that redirects a consumer to a PCI-compliant third-party payment processor, but some elements of the payment page originate from the merchant website. 

SAQ B

For merchants that only process credit card data via imprint machines or via a standalone dial-out terminal. 

Card imprint machines are non-electronic machines that make an imprint of the payment card, transferring the imprint onto a carbon paper receipt, which is then stored by the merchant. 

Dial-out terminals are electronic machines that use chip and PIN and swipe cards, or require users to manually key in information. To be eligible for SAQ B, a merchant’s standalone dial-out terminal must be connected to a phone line and nothing else. 

SAQ B-IP

For merchants that don’t store card data in electronic format but use IP-connected POI (point-of-interaction) devices. These merchants may handle either card-present or card-not-present transactions.

SAQ C-VT

For merchants that process cardholder data via a virtual payment terminal rather than a computer system. A virtual terminal provides web-based access to a third party that hosts the virtual terminal payment-processing function. 

SAQ C

For merchants that process cardholder data via POS (point-of-sale) systems or other payment application systems connected to the Internet. 

To be eligible for SAQ C, a merchant must operate isolated payment application systems that are connected to the Internet and don’t store electronic cardholder data. 

SAQ D

For those that don’t fit into any of the above categories. It is often referred to as ‘Report on Compliance Light’, because it requires organisations to go through all 12 PCI DSS requirements, albeit on a reduced scale. 

There are separate forms for merchants and service providers. 

SAQ P2PE-HW

For merchants that use card-present transactions, meaning it is not applicable to organisations that deal in e-commerce. 

Merchants that use a PCI-validated P2PE (point-to-point encryption) solution and have implemented it successfully are eligible for SAQ P2PE-HW. 

Identify the right SAQ with IT Governance

Hopefully you’ve now identified which SAQ applies to you, but how do you go about completing the form?

That’s where our PCI DSS Documentation Toolkit can help. It contains all the template documents you need to ensure complete coverage of your PCI DSS requirements.

All you need do is fill in the sections that are relevant to your organisation.

The toolkit also contains a document checker to help you select and edit the appropriate policy, so that you can create and amend documents as needs arise.

The toolkit supports all self-assessment questionnaires, regardless of your specific payment scenario.

It’s fully aligned with the PCI DSS, so you can be sure that your policies are accurate and compliant with the Standard.

PCI DSS Subscription Program

PCI DSS: An Integrated Data Security Standard Guide 

DISC InfoSec

#InfoSecTools and #InfoSectraining

#InfoSecLatestTitles

#InfoSecServices

Ask DISC an InfoSec & compliance related question

Tags: pci dss, PCI SAQ

May 12 2022

Putting PCI-DSS in Perspective

Category: pci dss — DISC @ 12:47 pm
Putting PCI-DSS in Perspective
Putting PCI-DSS in Perspective

Much attention and excitement within the security world has recently been focused on the lucrative surge in crypto-mining malware and hacks involving or targeting cryptocurrency implementations themselves. Yet the volume of ‘real world’ transactions for tangible goods and services currently paid for with cryptocurrency is still relatively niche in comparison to those that are being paid for every minute of the day with the pieces of plastic we know as payment cards.

According to the British Retail Consortium, in the UK, card payments overtook cash for the first time ever last year. An upward trend assisted no doubt by the increasingly ubiquitous convenience of contactless micropayments. No coincidence either perhaps that contactless related card fraud in the UK also overtook cheque-based fraud in the first half of 2017.

For the foreseeable future, card payment channels are likely to present a continued risk to both businesses and individuals for the exact same reason that bank robber Willie Hutton gave us in the last century for his chosen means of income. In today’s digital economy, however, agile cyber criminals will not only ‘go’ as Mr. Hutton suggested “where the money is” but will swiftly adapt and evolve their tactics to ‘go where the insecurity is.’ Hence, whilst according to a range of sources EMV chip cards have cut counterfeit fraud at ‘point of sale’ (POS) in the UK by approximately a third since the technology was introduced and similar improvements are now being cited for its more recent adoption in the US, a marked and plausibly corresponding uptake in online ‘card not present’ (CNP) fraud continues to rise.

The Payment Card Industry Data Security Standard (PCI-DSS) has formally existed since 2004 to help reduce the risk of card fraud through the adoption and continued application of a recognized set of base level security measures. Whilst many people have heard of and will often reference PCI-DSS, the standard isn’t always as well understood, interpreted, or even applied as best it could be. A situation not entirely helped by the amount of myths, half-truths, and outright FUD surrounding it.

The PCI Security Standards Council website holds a wealth of definitive and authoritative documentation. I would advise anyone seeking either basic or detailed information regarding PCI-DSS to start by looking to that as their first port of call. In this blog, however, I would simply like to call out and discuss a few common misconceptions.

MYTH 1: “PCI JUST DOESN’T APPLY TO OUR BUSINESS/ ORGANIZATION/VERTICAL/SECTOR.”

It doesn’t matter if you don’t consider yourself a fully-fledged business, if it’s not your primary activity, or if card payments are an insignificant part of your overall revenue. PCI-DSS applies in some form to all entities that process, store, or transmit cardholder data without exception. Nothing more to say about this one.

MYTH 2: “PCI APPLIES TO OUR WHOLE ENVIRONMENT, EVERYWHERE, AND WE SIMPLY CAN’T APPLY SUCH AN OBDURATE STANDARD TO IT ALL.”

Like many good myths, this one at least has some origin in truth.

Certainly, if you use your own IT network and computing or even telephony resources to store, process or transmit cardholder data without any adequate means of network separation, then yes, it is fact. It could also rightly be stated that most of the PCI-DSS measures are simply good practice which organizations should be adhering to anyway. The level of rigor to which certain controls need to be applied may not always be practical or appropriate for areas of the environment who have nothing to do with card payments, however. A sensible approach is to, therefore, reduce the scope of the cardholder data environment (CDE) by segmenting elements of network where payment related activity occurs. Do remember though, that wherever network segmentation is being used to reduce scope it must be verified at least annually as being truly effective and robust by your PCI assessor.

Whilst scoping of the CDE is the first essential step for all merchants on their road to compliance, for large and diverse environments with a range of payment channels, such an exercise in itself is rarely a straightforward task. It’s advisable for that reason to initially consult with a qualified PCI assessor as well as your acquirer who will ultimately have to agree on the scope. They may also advise on other ways of reducing risk and therefore compliance scope such as through the use of certified point-to-point encryption solutions or the transfer of payment activities away from your network altogether. Which takes us directly on to discussing another area of confusion.

MYTH 3: “OUTSOURCING TRANSFERS OUR PCI RISK.”

Again, there is a grain of truth here but one that is all too frequently misconstrued.

Outsourcing your payment activity to an already compliant payments service provider (PSP) may well relieve you of the costs and associated ‘heavy lifting’ of applying and maintaining all of the necessary technical controls yourself. Particularly where such activity is far-removed from your core business and staff skill sets. As per Requirement 12.8 in the standard, however, due diligence needs to be conducted before any such engagement, and it still remains the merchant’s responsibility to appropriately manage their providers. At the very least via written agreements, policies and procedures. The service provider’s own compliance scope must, therefore, be fully understood and its status continually monitored.

It is important to consider that this doesn’t just apply to external entities directly processing payments on your behalf but also to any service provider who can control or impact the security of cardholder data. It’s therefore likely to include any outsourced IT service providers you may have. This will require a decent understanding of the suppliers Report or Attestation of Compliance (ROC or AOC), and where this is not sufficient to meet your own activity, they may even need to be included within your own PCI scope. Depending on the supplier or, service this may, of course, be a complex arrangement to manage.

MYTH 4: “COMPENSATORY MEANS WE CAN HAVE SOME COMPLACENCY.”

PCI is indeed pragmatic enough to permit the use of compensatory controls. But only where there is either a legitimate technical constraint or documented business constraint that genuinely precludes implementing a control in its original stated form. This is certainly not to be misjudged as a ‘soft option,’ however, nor a way of ‘getting around’ controls which are just difficult or unpopular to implement.

In fact, the criteria for an assessor accepting a compensatory control (or whole range of controls to compensate a single one in some cases) means that that the alternative proposition must fully meet the intent and rigor of the original requirement. Compensatory controls are also expected to go ‘above and beyond’ any other PCI controls in place and must demonstrate that they will provide a similar level of defense. They will also need to be thoroughly revaluated after any related change in addition to the overall annual assessment. In many cases and especially over the longer term, this may result in maintaining something that is a harder and costlier overhead to efficiently manage than the original control itself. Wherever possible, compensatory controls should only be considered as temporary measure whilst addressing the technical or business constraint itself.

MYTH 5: “WE BOUGHT A PCI SOLUTION SO WE MUST BE COMPLIANT, RIGHT?”

The Payment Application Data Security Standard (PA-DSS) is another PCI Security Standards Council controlled standard that exists to help software vendors and others develop secure payment applications. It categorically does not, however, follow that purchasing a PA-DSS solution will in itself ensure that a merchant has satisfactorily met the PCI-DSS. Whilst the correct implementation or integration of a PA-DSS verified application will surely assist a merchant in achieving compliance, once again it is only a part of the overall status and set of responsibilities.

IT security vendors of all varieties may also claim to have solutions or modules that although they may have nothing directly to do with payments themselves have been specifically developed with PCI-DSS compliance in mind. They are often sold as PCI-related solutions. If deployed, used and configured correctly, many of these solutions will no doubt support the merchant with their compliance activity whilst tangibly reducing cardholder data risk and hopefully providing wider security benefits. No one technology or solution in itself will make you PCI compliant, however, and anyone telling you (or your board) that it does either does not understand the standard or is peddling ‘snake oil.’ Or both.

MYTH 6: “WE’RE PCI-DSS COMPLIANT SO THAT MEANS WE MUST BE ‘SECURE,’ RIGHT?”

PCI-DSS should certainly align and play a key part within a wider security program. It should and cannot be an organizations only security focus, however. Nor should being compliant with any standard be confused with some unfeasible nirvana of being completely ‘secure’ whatever that may mean at any given point in time. There have, after all, been plenty examples of PCI-compliant organizations who have still been harshly and significantly breached. Some reports of high profile incidents have voiced scathing comments about the potentially ostensible nature of the breached organization’s PCI compliance status, even questioning validity of the standard itself. Such derision misses some key points. In the same way that passing a driving test does not guarantee you will never be involved in an accident, reasonably speaking, it will certainly decrease those chances. Far more so than if nobody was ever required to take such a test. PCI or any other security compliance exercise should be viewed with a similar sense of realism and perspective.

Applying PCI-DSS controls correctly, with integrity and unlike a driving test re-assessing them annually, must surely help to reduce the risk of card payment fraud and breaches. More so than if you weren’t. Something that is to everyone’s benefit. It cannot possibly, however, protect against all attacks or take into account every risk scenario. That is for your own wider security risk assessment and security program to deal with. Maybe yes, it’s all far from perfect, but in the sage fictional words of Marvel’s Nick Fury, “SHIELD takes the world as it is, not as we’d like it to be. It’s getting damn near past time for you to get with that program.”

About the Author:Angus Macrae is a CISSP (Certified Information Systems Security Professional) in good standing, a CCP (NCSC Certified Professional for the IT Security Officer role at Senior Practitioner level) and PCIP (PCI SSC Payment Card Industry Professional.) He is currently the IT security lead for King’s Service Centre supporting the services of King’s College London, one of the worlds’ top 20 universities

PCI-DSS QSA Certification – Practice Questions 2022: Questions that will help you practice and advance your knowledge on the PCI-DSS QSA

👇 Please Follow our LI page…


DISC InfoSec

#InfoSecTools and #InfoSectraining

#InfoSecLatestTitles

#InfoSecServices

Tags: pci compliance, pci dss

Jan 04 2022

Attackers abused cloud video platform to inject an e-skimmer into 100 Real Estate sites

Category: pci dss — DISC @ 10:24 am
Attackers abused cloud video platform to inject an e-skimmer into 100 Real Estate sites

Threat actors used an unnamed cloud video platform to install an e-skimmer on more than 100 real estate websites belonging to the same parent company.

In e-skimming attacks, attackers inject malicious JavaScript code into e-stores to financial data while visitors are purchasing products. Researchers from Palo Alto Networks documented a supply chain attack in which the attackers abused a cloud video platform to inject an e-skimmer hidden into video.

Every website importing the video from the platform was compromised due to the presence of the e-skimmer.

“With Palo Alto Networks proactive monitoring and detection services, we detected over 100 real estate sites that were compromised by the same skimmer attack.” reads the analysis published by Palo Alto Networks. “After analysis of the sites we identified, we found that all the compromised sites belong to one parent company. All these compromised sites are importing the same video (accompanied by malicious scripts) from a cloud video platform.”

The security firm helped the cloud video platform and the real estate firm in removing the e-skimmer.

The researchers have discovered that the cloud video platform allows users to create their players that could be customized by adding JavaScript code. The JavaScript customizations could be included in a file that is uploaded to the platform.

“In this specific instance, the user uploaded a script that could be modified upstream to include malicious content.We infer that the attacker altered the static script at its hosted location by attaching skimmer code. Upon the next player update, the video platform re-ingested the compromised file and served it along with the impacted player.” continues the analysis.

The attackers were able to modify the static script at its hosted location by attaching e-skimmer code. By updating the player update, the video platform provided the compromised file and served it along with the customized player.

The software skimmer is highly polymorphic and elusive, experts pointed out that it is continuously updated by the authors.

e-skimmer

The e-skimmer allows attackers to gather sensitive and financial information, including names, emails, phone numbers, and credit cards data.

Stolen data were uploaded to the server https://cdn-imgcloud[.]com/img.

The researchers shared Indicators of Compromise (IoCs) for these attacks.

“The skimmer itself is highly polymorphic, elusive and continuously evolving. When combined with cloud distribution platforms, the impact of a skimmer of this type could be very large,” Palo Alto Networks concludes.

RFID Blocking Sleeves, Set With Color Coding. Identity Theft Prevention RFID Credit Card Holders by Boxiki Travel (Set of 12 Credit Card Protectors + 3 Passport Holders)

Tags: Credit Card Skimmer, e-skimmer, skimmer

Dec 27 2021

The ultimate guide to PCI DSS compliance

Category: Information Security,pci dss — DISC @ 11:56 am

The ultimate guide to PCI DSS compliance

Luke Irwin  

If your business handles debit or credit card data, you’ve probably heard of the PCI DSS (Payment Card Industry Data Security Standard).

It’s an information security framework designed to reduce payment card fraud by requiring organisations to implement technical and organisational defence measures.

We explain everything you need to know about the PCI DSS in this blog, including who it applies to, the benefits of compliance and what happens if you fail to meet its requirements.

Who needs PCI DSS compliance?

Any merchant or service provider that processes, transmits or stores cardholder state is subject to the PCI DSS.

  • Merchants are organisations that accept debit or credit card payments for goods or services.
  • Service providers are businesses that are directly involved in processing, storing or transmitting cardholder data on behalf of another entity.

Some organisations can be both a merchant and a service provider. For instance, an organisation that provides data processing services for other merchants will also be a merchant itself if it accepts card payments from them.

Benefits of PCI DSS compliance

The most obvious benefit of PCI DSS compliance is to reduce the risk of security incidents. When organisations implement its requirements, they shore up the most common weaknesses that attackers exploit.

According to the 2020 Trustwave Global Security Report, the majority of data breaches involving cardholder data were CNP (card-not-present) attacks. This indicates that e-commerce platforms are the most vulnerable, but this is only half the picture.

Data protection isn’t just about preventing cyber attacks; information can also be exposed by mistakes the organization makes. Such errors can also result in violations of the GDPR (General Data Protection Regulation) and other data protection laws.

PCI DSS compliance can help organisations prevent regulatory errors and the effects associated with it.

Is PCI DSS compliance mandatory?

The PCI DSS is a standard not a law, and is enforced through contracts between merchants, acquiring banks that process payment card transactions and the payment brands.

Compliance is mandatory for all organisations that process, store or transmit cardholder data. Covered organisations that fail to meet their requirements could face strict penalties.

Notably, the Standard doesn’t simply levy a one-off fine for non-compliance. Instead, organisations can be penalised between $5,000 (about €4,300) and $100,000 (about €86,000) a month until they achieve compliance.

Organisations can also face other punitive measures from their acquiring bank. For example, the bank might increase its transaction fees or terminate the relationship with the merchant altogether.

How do I achieve PCI DSS compliance?

The PCI DSS contains 12 requirements that organisations must meet if they are to achieve compliance.

They are combination of technical solutions, such as data encryption and network monitoring, alongside processes and policies to ensure that employees manage sensitive data effectively.

Those processes include steps such as changing default passwords, restricting physical access to locations where cardholder data is stored and creating an information security policy.

How do you know if you are PCI compliant?

To demonstrate that your organisation is PCI DSS compliant, organisations must audit their CDE (cardholder data environment).

There are three types of audit:

The type of audit you must conduct, and your exact PCI DSS compliance requirements, will vary depending on your merchant or service provider level. This information is based on the number of card transactions processed per year.

Level 1 merchants are those process more than 6 million transactions per year, or those whose data has previously been compromised. They must complete the following each year:

  • RoC conducted by a QSA or ISA.
  • Quarterly scan by an ASV.

Level 2 merchants are those that process 1 million to 6 million transactions per year. They must complete the following each year:

  • RoC conducted by a QSA or ISA, or an SAQ (SAQ D) signed by a company officer (dependent on payment brand).
  • Quarterly scan by an ASV

Level 3 merchants are those that process 20,000 to 1 million transactions per year. They must complete the following each year:

  • SAQ signed by a company officer.
  • Quarterly scan by an ASV (dependent on SAQ completed).

Level 4 merchants are those that process fewer than 20,000 transactions per year. They must complete the following each year:

  • SAQ signed by a company officer.
  • Quarterly scan by an ASV (dependent on SAQ completed).

The audit requirements for service providers are more straightforward. Level 1 encompasses any organisation that process and/or store more than 300,000 transactions per year. They are required to conduct a RoC by a QSA or ISA and have an ASV conduct quarterly scans.

Service providers that transmit and/or store fewer than 300,000 transactions per year must complete either an RoC conducted by a QSA or an ISA, or an SAQ D signed by a company officer. They must also have an ASV conduct quarterly scans.

Get started with the PCI DSS

As a QSA company, IT Governance provides services to support organisations at each stage of each organisation’s PCI DSS compliance project. You can find out complete list of PCI DSS services and solutions on our website.

Organizations looking for help achieving compliance should take a look at our PCI DSS Documentation Toolkit.

It contains everything you need to implement the Standard’s requirements, including template documents and a document checker to ensure you select and amend the appropriate records.

The toolkit supports all self-assessment questionnaires, regardless of your specific payment scenario.

It’s fully aligned with the PCI DSS, so you can be sure that your policies are accurate and compliant. All you have to do is fill in the sections that are relevant to your organization.

PCI DSS Implementation Training Course | Qualified Security Assessor Company

PCI DSS: A pocket guide, sixth edition

PCI DSS: A pocket guide, sixth edition | IT Governance USA

Tags: PCI, pci dss

Jul 22 2021

3 Signs It’s Time to Rethink Your PCI Pen Testing Strategy

Category: Information Security,pci dss,Pen Test — DISC @ 12:03 pm

Download pdf: 3 sign it’s time to rethink your PCI PenTesting Strategy

Learn more about PenTest as a Service

Procuring Penetration Testing Services by Crest

Tags: PCI Pen Testing Strategy

Jun 30 2021

NFC Flaws in POS Devices and ATMs

Category: pci dss — DISC @ 1:25 pm
NFC Flaws in POS Devices and ATMs

Now Rodriguez has built an Android app that allows his smartphone to mimic those credit card radio communications and exploit flaws in the NFC systems’ firmware. With a wave of his phone, he can exploit a variety of bugs to crash point-of-sale devices, hack them to collect and transmit credit card data, invisibly change the value of transactions, and even lock the devices while displaying a ransomware message. Rodriguez says he can even force at least one brand of ATMs to dispense cash though that “jackpotting” hack only works in combination with additional bugs he says he’s found in the ATMs’ software. He declined to specify or disclose those flaws publicly due to nondisclosure agreements with the ATM vendors.

What is an NFC Chip? - STMicroelectronics

Tags: NFC flaws, pci dss, POS devices

May 22 2021

Air India data breach impacts 4.5 million customers

Category: Data Breach,Information Privacy,pci dss,Security Breach — DISC @ 4:19 pm
Air India data breach impacts 4.5 million customers

Source: Bleepingcomputer

Air India disclosed a data breach after personal information belonging to roughly 4.5 million of its customers was leaked two months following the hack of Passenger Service System provider SITA in February 2021.

The Indian national carrier first informed passengers that SITA was the victim of a cyberattack on March 19.

“This is to inform that SITA PSS our data processor of the passenger service system (which is responsible for storing and processing of personal information of the passengers) had recently been subjected to a cybersecurity attack leading to personal data leak of certain passengers,” Air India said in a breach notification sent over the weekend. 

“This incident affected around 4,500,000 data subjects in the world.”

The airline added that the breach impacted the data of passengers registered between August 2011 and February 2021.

Nevertheless, after investigating the security incident, it was found that no credit card information or password data was accessed during the breach.

However, Air India urges its passengers to change their credentials to block potential breach attempts and ensure their data security.

“The breach involved personal data registered between 26th August 2011 and 3rd February 2021, with details that included name, date of birth, contact information, passport information, ticket information, Star Alliance, and Air India frequent flyer data (but no passwords data were affected) as well as credit cards data,” Air India added [PDF].

“However, in respect of this last type of data, CVV/CVC numbers are not held by our data processor.”

The protection of our customers’ personal data is of highest importance to us and we deeply regret the inconvenience caused and appreciate the continued support and trust of our passengers. — Air India

Data breach impacts Star Alliance members

Almost a dozen more air carriers besides Air India informed passengers that some of their data was accessed during a breach of SITA’s Passenger Service System (PSS), which handles transactions from ticket reservations to boarding.

SITA also confirmed the incident saying that it reached out to affected PSS customers and all related organizations in early March.

At the time, a SITA spokesperson told BleepingComputer that the breach impacts data of passengers from multiple airlines, including:

  • Lufthansa – combined with its subsidiaries, it is the second-largest airline in Europe in terms of passengers carried; Star Alliance member and Miles & More partner
  • Air New Zealand – flag carrier airline of New Zealand
  • Singapore Airlines – flag carrier airline of Singapore
  • SAS – Scandinavian Airlines (disclosure here); 
  • Cathay Pacific – flag carrier of Hong Kong
  • Jeju Air – the first and largest South Korean low-cost airline
  • Malaysia Airlines – flag carrier airline of Malaysia
  • Finnair – flag carrier and largest airline of Finland

Some of these air carriers (including Air India) are part of the Star Alliance, a global airline network with 26 members, including Lufthansa, the largest in Europe.

Star Alliance told BleepingComputer that its members also share customer details relevant to awarding traveling benefits. 

The information is limited to membership names, frequent flyer program membership numbers, and program tier status.

Big Breaches

Tags: Air India data breach

May 06 2021

PCI DSS Documentation

Category: pci dss — DISC @ 7:49 am
May be an image of ‎text that says '‎ם ක PCI DSS Documentation Toolkit‎'‎

The PCI DSS Toolkit Overview

Does your organization process, transmit or store payment card data? If your answer is yes, then you need to comply with the PCI DSS (Payment Card Industry Data Security Standard). The payment Standard helps to ensure the security of transactions and protect your business from potential data breaches and fines.

The PCI DSS places a significant emphasis on documentation with all 12 sections of the Standard requiring documented policies and procedures. The more payment channels your organization accepts, the greater the need for documented policies and procedures to support the applicable requirements. Unsurprisingly, it can all get a little complicated and you may find yourself unsure of what you need to do and how to develop policies and procedures that best reflect your environment.

Let’s comply with PCI with PCI DSS Documentation Toolkit

Covering PCI DSS v3.2.1 the PCI DSS Documentation Toolkit provides guidance documents, tools and templates to help you identify what is required of your organization and develop the documentation you need.

Tags: pci compliance

Mar 24 2021

Billions of FBS Records Exposed in Online Trading Broker Data Leak

Category: Data Breach,data security,pci dss — DISC @ 4:34 pm
Billions of FBS Records Exposed in Online Trading Broker Data Leak

Ata Hakcil led the team of white hat hackers from WizCase in identifying a major data leak on online trading broker FBS’ websites.

The data from FBS.com and FBS.eu comprised millions of confidential records including names, passwords, email addresses, passport numbers, national IDs, credit cards, financial transactions and more.

Were such detailed personally identifiable information (PII) to fall in the wrong hands, it could have been used in the execution of a wide range of cyber threats. The data leak was unearthed as part of WizCase’s ongoing research project that randomly scans for unsecured servers and seeks to establish who are the owners of these servers. We notified FBS of the breach so they could take appropriate action to secure the data. They got back to us a few days later and secured the server within 30 minutes.

What’s Going On

Forex, a portmanteau of foreign currency and exchange, is the process of converting one currency into another for a wide range of reasons including finance, commerce, trading and tourism. The forex trading market averages more than US$5 trillion in daily trading volume. Forex trading may be dominated by banks and global financial services but, thanks to the Internet, the average person can today dabble directly in forex, securities and commodities trading.

In the rush toward online trading though, users have entrusted terabytes of confidential data to online forex trading platforms. With financial transactions being at the core of forex trading, the nature of user data held in these trading databases is highly sensitive. This has made online trading sites a lucrative target for cybercriminals.

FBS, a major online forex trading site, left an unsecured ElasticSearch server containing almost 20TB of data and over 16 billion records. Despite containing very sensitive financial data, the server was left open without any password protection or encryption. The WizCase team found that the FBS information was accessible to anyone. The breach is a danger to both FBS and its customers. User information on online trading platforms should be well secured to prevent similar data leaks.

Billions of FBS Records Exposed in Online Trading Broker Data Leak

Tags: FBS Records Exposed

Feb 10 2021

Web Credit Card Skimmer Steals Data from Another Credit Card Skimmer

Category: pci dss — DISC @ 10:38 am
Web Credit Card Skimmer Steals Data from Another Credit Card Skimmer

Tags: Credit Card Skimmer, credit cards, skimmers

Jul 23 2020

Instacart Customers’ Personal Info Is Being Sold Online

Category: Data Breach,pci dss — DISC @ 11:15 am

Names, credit card data, addresses, and information on transactions as recent as yesterday are being sold online.

As of Wednesday, sellers in two dark web stores were offering information from what appeared to be 278,531 accounts, although some of those may be duplicates or not genuine. As of April, Instacart had “millions of customers across the US and Canada,” according to a company spokesperson.

Source: Instacart Customers’ Personal Info Is Being Sold Online



Personal info of 200K+ Instacart users being sold on the dark web; Instacart says it wasn’t breached
httpv://www.youtube.com/watch?v=IA2kSg7-ACM






PCI DSS – Data Security Standard

Download a Security Risk Assessment Steps paper!

Subscribe to DISC InfoSec blog by Email

Take an awareness quiz to test your basic cybersecurity knowledge

DISC InfoSec 🔒 securing the business 🔒 via latest InfoSec titles




Tags: PII, PII security

Sep 21 2018

PCI DSS policies address the weakest link – people

Category: pci dss — DISC @ 9:38 am

By Nick Calver @ITG

Drafting detailed data protection policies and documentation is vital for improving security for your customers, stakeholders and brand because it shows your understanding and commitment to the PCI DSS (Payment Card Industry Data Security Standard). From policy, to procedure, to configuration standard, a significant proportion of PCI DSS compliance begins with documentation.

Deploying security technologies can only go so far in protecting an organisation and helping maintain compliance.

Nearly 1 in 5 data breaches caused by human error

Verizon’s 2018 Data Breach Investigations Report identified that almost 1 in 5 data breaches (17%) were the result of human error.

Policies are needed to address the weak link in security – people. If your employees don’t know or understand what’s expected of them, they can put cardholder data at risk, regardless of the other security measures you have in place. Policies play an important role in securing data. They are the foundation for everything else as they provide direction and instruction, and assign responsibility.

What’s in a PCI policy set?

PCI DSS compliance requires that all merchants and service providers document the processes and procedures they put in place. These policies and procedures can then serve as a guide, following the 12 requirements of the PCI DSS, from which you and your QSA (Qualified Security Assessor) can work during your assessment.

The policies might address:

Information security: This details the organisation’s security strategy in relation to the storage, processing and transmission of credit card data. It provides a detailed outline of information security responsibilities for all staff, contractors, partners and third parties that access the CDE (cardholder data environment).

Formal security awareness: This identifies the organisation’s responsibilities when implementing a PCI security awareness training programme and is intended for anyone who has access to the CDE. Staff should take this program during their induction and repeat it at least annually or whenever there is a security incident.

Incident response: This is a set of instructions for detecting, responding to and limiting the effects of an information security event. Without a plan in place, organisations might not detect an attack or fail to follow proper protocol to contain it and recover.

Nothing here should surprise an experienced security professional. The policy requirements are basic information security best practices. Therefore, when structuring your PCI policy set we advise doing so alongside the development of your core information security policy.

PCI DSS Staff Awareness

Increase your employees’ knowledge of the Payment Card Industry Data Security Standard (PCI DSS) and how it affects your organization with the expertise at IT Governance USA Inc.

 





Nov 27 2012

PCI Risk Assessment Tips Offered

Category: pci dss — DISC @ 11:18 am

 

A credit card, the biggest beneficiary of the ...

A credit card, the biggest beneficiary of the Marquette Bank decision (Photo credit: Wikipedia)

Council Issues Guidelines to Address Security Shortcomings

In its just-released guidelines for ongoing risk assessments, the Payment Card Industry Security Standards Council notes three specific areas for improvement.

The guidelines, which are intended for any organization that handles credit or debit card data, offer specific recommendations for risk assessments, such as how to create an internal risk-assessment team and address risk reporting.

But Bob Russo, general manager of the PCI Council, points out that card data is only as secure as the weakest link in the payments chain. Compliance with PCI-DSS is the responsibility of all organizations and businesses that handle card data, he stresses. They must ensure that all links in the payments chain keep card-data protections up-to-date.

“The standard requires an annual risk assessment, because the DSS validation is only a snapshot of your compliance at a particular point in time,” Russo says.

Requirement 12.1.2 of the PCI-DSS states that any organization that processes or handles payment cards must perform a risk assessment at least annually. The PCI Council’s new recommendations include the need for:

  • A formalized risk assessment methodology that fits the culture of the organization;
  • A continuous risk assessment process that addresses emerging threats and vulnerabilities;
  • An approach that uses risk assessments to complement, not replace, ongoing PCI Data Security Standard compliance.

While the PCI Council does not enforce compliance, merchants, processors and others found to be out of PCI compliance after a breach or some other event will likely face steep fines from the card networks.

“Performing a risk assessment at least annually will help you identify the security gaps and address them,” Russo says. “The council received a lot of requests for clarity here. We hope the guidelines help them in their efforts to establish an annual process.”

To find out how to identify and address common threats in a risk assessment by Tracy Kitten …

Related articles




Tags: Payment card, Payment card industry, Payment Card Industry Data Security Standard, PCI Council, pci dss, Risk Assessment

Nov 19 2012

PCI view of Risk Assessment

Category: pci dss,Security Risk Assessment — DISC @ 11:02 pm
Information Security Wordle: PCI DSS v1.2 (try #2)

 

Organizations that need to comply with PCI-DSS need to create their own risk assessment methodology that works for their specific business needs, according to a new report by the Payment Card Industry Security Standards Council (PCI SSC).

PCI Risk Assessment Special Interest Group says When developing their own risk assessment methodology, organizations may consider adapting an industry-standard methodology that is most appropriate for their particular culture and business climate.

 
Key recommendations include:
 
• A continuous risk assessment process enables ongoing discovery of emerging threats and vulnerabilities, allowing an organization to mitigate such threats and vulnerabilities in a proactive and timely manner
 
• Risk assessments must not be used as a means of avoiding or bypassing applicable PCI DSS requirements (or related compensating controls)
 
• Organizations should implement a formalized risk assessment methodology that best suits the culture and requirements of the organization

PCI view of things: 

The announcement
https://www.pcisecuritystandards.org/pdfs/pr_121116_risk_sig.pdf

And the V1 document (also attached)
https://www.pcisecuritystandards.org/documents/PCI_DSS_Risk_Assmt_Guidelines_v1.pdf

Below is my post on Risk management from prespective of ISO 27001 which has an Expert guidance on planning and implementing a risk assessment and protecting your business information

Information Security Risk Management for ISO 27001




Tags: International Organization for Standardization, ISO/IEC 27001, Methodology, Payment card industry, Payment Card Industry Data Security Standard, Risk Assessment, Risk management

Nov 18 2011

Protection of credit card and ATM/debit card transactions

Category: Cybercrime,pci dss — DISC @ 1:16 pm


By Azie Amini
Protection of credit card/ATM card transactions and the latest trends in banking, credit card or internet fraud.

• As we go towards the end of the year, one by one report each credit card missing and get a new one with a new account number (make sure you ask for a new account number, sometimes they send a new card with the same number). When you get each one, call the other credit card company and report the other one missing. Do this for each card so that when you start the new year with new credit cards. (The reason for it is that often thieves want to collect many stolen credit cards and then they sell a batch of hundreds of thousands of credit cards to a buyer. They often wait a year or two to collect many credit cards so often your credit card number is stolen sitting in their files without you knowing. All of a sudden they sell their large list of stolen credit cards and within a few days you will get hit with many transactions so your card is maxed in a very short time) and you will have the headache of having to report each transaction as false and hope your bank will not charge you. So change all your credit cards at least once a year to be safe.

• If any credit card company or bank calls you to report suspicious activities on one of your cards, do NOT give them your card number just tell them to read the number they have and you just say Yes or No. Also if they asked for the 3 digits on the back of your card, do NOT give it to them. They should tell you what info they have and all you say is Yes or No, nothing more. With me when I get calls like that, I tell them that I prefer to dial their toll free telephone number to talk to their fraud dept and see what may be the problem. Always suspect that the person calling is not really from your bank or credit card company but is a crook.

• Frequently check the balance of each banking account you have, as there are a lot of “Wire Transfer” fraud and often you only have 24 hours to stop a wire transfer, if you notice it later your bank may NEVER pay you back even though you did NOT authorize the wire transfer. (I know this sounds strange but I have talked to many lawyers whose clients lost their savings on unauthorized wire transfers and there is NO law to protect the person, the money is GONE). Check your bank balance daily.

• When you look for something on Internet, say using “Google” and you see a website that has all kinds of things posted on it; e.g. airplane tickets, charity stuff, news about movies, etc. Do NOT click on any links, these strange websites that have everything interesting on them are often set up by very smart crooks, very smart, and the links will direct all kinds of spyware (keyboard collection tools say to collect your banking user name and Passwords) loaded into your PC. Just exit and do NOT click on any links!

• Alway download the lastest Microsoft browser, word, Adobe updates, etc. These companies constantly try to add security features to their software. The moment you get an update from Microsoft or Adobe, load it asap. They sent you the updates because they have just fixed a security issue.

• Next time you order checks, do NOT put your first name and just have your initial and last name on them. If someone takes your check book they will not know if you sign your checks with just your initials or your first name but your bank or credit union will know how you sign your checks.

• When you are writing checks to pay on your credit card accounts, DO NOT put the complete account number on the “For” line. Instead, just put the last four or five numbers. The credit card company knows the rest of the number and anyone who might be handling your check as it passes through all the check processing channels won’t have access to it.

• Put your work phone # on your checks instead of your home phone. If you have a PO Box use that instead of your home address. Never have your Social Security Number printed on your checks!. You can add it if it is necessary.

• Place the contents of your wallet on a photocopy machine, do both sides of each license, credit card, etc. You will know what you had in your wallet and all of the account numbers and phone numbers to call and cancel. Keep the photocopy in a safe place. Also, carry a copy of your passport when traveling anywhere.

Very important, when you know your credit cards are stolen do this:
• Call the three national credit reporting organizations immediately to place a fraud alert on your name and Social Security number.
The alert means any company that checks your credit knows your information was stolen and they have to contact you by phone to authorize new credit.
Here are the phone numbers to contact:
Equifax: 1.800.525.6285
Experian: 1.888.397.3742
Trans Union: 1.800.680.7289
Social Security Administration (fraud line): 1.800.269.0271

Related articles and Books

Credit Card Scams II

Fraud Prevention Techniques for Credit Card Fraud

100% Internet Credit Card Fraud Protected




Jul 08 2011

How to protect ourselves from Payment Fraud

Category: Cyber Threats,Cybercrime,pci dss — DISC @ 11:26 pm

Some basic advice has been issued by Apacs, and includes:

    * Don’t let your cards or your card details out of your sight when making a transaction
    * Do not keep your passwords, login details or Pins written down
    * Do not disclose Pins, login details or passwords in response to unsolicited emails
    * Only divulge card details over the phone when you have made the call or when you are familiar with the company
    * Access internet banking or shopping sites by typing the address into your browser. Never enter your personal details on a website you have accessed via a link from an e-mail
    * Shop at secure websites by checking that the security icon is showing in your browser window (a locked padlock or an unbroken key)
    * Always log out after shopping and save the confirmation e-mail as a record of your purchase

      For more advice you can visit:

      Spotting and avoid common scams, fraud and schemes online and offline

      How the scam works and what you need to do about it.

      and

      Online payment Security and Fraud Prevention




      Tags: Australia, Business, Credit card, Financial services, fraud, Internet fraud, Online banking

      Mar 23 2011

      PCI DSS questions answered

      Category: pci dss — DISC @ 10:27 pm

      Where can we find information about PCI DSS compliance that is focused on those of us who are “Mom & Pop” shops?

      Since most small organizations fall into the sell-assessment category, a great resource is the Security Standards Council SAQ (Self-Assessment Questionnaire) section. Specifically these documents:

      SAQ main page

      PCI DSS SAQ instructions and guidelines

      SAQ: How it all fits together

      SAQ A-D and Guidelines

      For remaining 30 PCI DSS questions & answered: Solutions to tough PCI problems





      Next Page »