Heartland Breach Case Study
According to experts, PCI controls present a baseline protection which is strong and which ought to be present for any layered or risk-based approach to security. However, regulations such as PCI standards are not enough to protect companies from data security breaches. The best way for someone to protect their customer data is for them to cancel the processing of payments but then there won’t a business. Even with these regulations and standards installed, one day a hacker may infiltrate your system and steal your data. These regulations are not enough to protect your data thus the only thing one can do is avoid being caught by a security breach off guard. The only thing and the best thing to do is to minimize as much as possible the consequences. These regulations are not enough because standards such as PCI have a high chance of suffering from the regulatory affliction. It takes many years for a standard to be developed by a standard body. The rules for compliance are formulated with good intentions but present an opportunity of being an opiate for members corner offices. They have the tendency of giving people a false sense of security. These regulations can safeguard from liability but safeguard against the loss of data is not clear (Chuvakin, 2012).
These regulations are not enough to protect against security breaches and thus it is important to try out new solutions such as anti-cybercrime techniques which may include the end to end encryption, network layer security, and tokenization. Rather than focusing majorly on securing endpoints, the main areas where most breaches originate from, exempting payment transactions is the precise area where the focus on the limited cyber security defense is put. For instance the case of the Heartland breach, it was found that once the infiltrators hacked their way into Heartland’s network, nothing could keep them from accessing or installing malicious software in the system and compromising data for many of the consumers. Adhering to anti-cybercrime techniques is more critical because nowadays customers are more digitally engaged than ever before. Retailers need to go beyond the basic requirements put forth by PCI compliance. They need to install cyber security controls which present powerful intrusion detection tools which will identify attacks early and provide solutions to them. Cyber security should be of major importance in such cases as compared to PCI compliance and other regulations such as these. Nowadays, hackers need only to penetrate the system, and once that is accomplished, there is no telling what they can do or access, thus putting customer data at risk. Companies should formulate anti-cybercrime control measures as these will help prevent major losses such as the one suffered by Heartland (Update: Heartland breach shows why compliance is not ..., 2017).
The following are some of the security control measures which may prove very helpful: point to point encryption, network layer security, and analytics. The first step in protecting customer data before they can be attacked by cyber theft tools is the implementation of the point to point encryption between the payment processor and the credit card terminal. To this step, companies can add the tokenization technology where payment information cannot be sent directly. Given the case where hackers can breach the data and sell it, the tokenization system will prevent them from accessing anything valuable. Next is network layer security. The addition of powerful infiltration detection tools is very necessary for identifying potential attacks and acting on them rather than relying on the basic PCI control requirements. Continuous scanning of the network for viruses and malware is also important for example, if a device is infected, it can be discovered and shut down before causing damage. Finally is analytics. Security tools tend to generate a lot of data which show what is happening in the network. However, this data is not valuable unless companies use analytic tools which assist in filtering out noise and help interpret the data history and help turn complex data into actionable and valuable insight. These security controls offer a comprehensive solution to increase data security and reducing card fraud.
To secure data, there need to be effective security monitoring tools which will collect data, analyze it, and correlate security data. Intrusion detection systems alone are not enough for these tasks. To fully monitor and protect data, companies require the assistance of monitoring software such as Spiceworks IT and PRTG Network Monitor among others. These kinds software offer an all-inclusive monitoring solution. They traffic all devices, systems, and infrastructure in a system. They are given what is connected to a company’s infrastructure at all times, monitor vulnerable systems which have a possibility of being exploited. This monitoring software would prove very helpful to companies as they would monitor systems and help prevent data breaches which in turn may lead to major losses. There are numerous monitoring tools and software which can be used, but it takes a pro to be able to decide for a company the best one (Caldwell, 2013).
References
Caldwell, T. (2013). Security at the data level. Network Security, 2013(5), 6-12. doi:10.1016/s1353-4858(13)70059-x
Chuvakin, A. (2012). Managing a PCI DSS Project to Achieve Compliance. PCI Compliance, 231-251. doi:10.1016/b978-1-59-749948-4.00012-6
Update: Heartland breach shows why compliance is not ... (n.d.). Retrieved May 13, 2017, from http://www.bing.com/cr?IG=94730F7040714DB28B81A0A92278DA74&CID=1085FC2BE2E66BB916AEF6AAE3766A4F&rd=1&h=nuwDmzpvlSt7O5sGlAlQX4qZmdbmmXDwJ-rbkdumzZY&v=1&r=http%3a%2f%2fwww.computerworld.com%2farticle%2f2522625%2fsecurity0%2fupdate--heartland-breach-shows-why-compliance-is-not-enough.html&p=DevEx,5064.1
Hope you enjoyed the case study, be sure to follow me for more tech and hunting related articles chinden