Emerald Business Systems Blog


Infosecurity USA – Firms failing on PCI DSS

Posted in PCI,POS,Restaurant,Retail by ebs4pos on December 10, 2009

A huge 81% of organizations that are subject to the Payment Card Industry’s Data Security Standard PCI DSS were found to be non-compliant prior to a data breach, according to a new study.But according to telco Verizon Business’ Risk team, which published the findings, a “fairly new” threat in the shape of RAM scrapers is increasingly being used by online thieves to bypass PCI DSS rules requiring credit card data to be encrypted anyway.The company’s 2009 Data Breach Investigations Report found that 74% of security incidents were the result of external attacks. Such events resulted in a huge 285 million records being compromised over the last year – mainly via online systems.Only 20% of data breaches were caused by insiders, 32% by business partners and 39% by multiple parties. Some 67% of the incidents occurred because the attacker exploited errors made by the victim, while a further 64% were the result of hacking and 38% of malware.But in its 2009 Supplemental Report called Anatomy of a Data Breach, Verizon Business also pointed to the rising threat of RAM scrapers.RAM scrapers work by scouring the volatile random access memory in point-of-sale terminals, which process, store or transmit PINs and other credit card data in unencrypted form. When the program detects such information, it captures it and uploads it to servers that are usually controlled by malicious external sources but sometimes belong to trusted partners.While the technology has been around for a few years, its usage has now increased to the extent that it came in at number 14 in Verizon’s 15 most common type of security attack. Keylogging and spyware software ranked number one, followed by backdoors and SQL injections.RAM scrapers are often used in conjunction with other malware such as backdoors and command-and-control programs and have to date mainly been discovered in systems belonging to the retail and hospitality sectors.

via Infosecurity USA – Firms failing on PCI DSS.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


%d bloggers like this: