Compliance is necessary, but not always sufficient to prevent security breaches

Over the past five days we've seen news of a major breach at U.S.-based credit card processor Global Payments.

Over the past five days we’ve seen news of a major breach at U.S.-based credit card processor Global Payments. While details are still emerging, reportedly up to 1.5 million cards may have been compromised. This story not only highlights the difference between security and compliance, but also reminds us of the fundamentals of dealing with administrative accounts.


VISA reportedly removed Global Payments from its list of approved third parties that process transactions between stores and banks. This implies that Global Payments was considered “PCI compliant” at the time of the breach. This demonstrates the difference between compliance and security. While complying with various requirements and regulations is necessary, it is not always sufficient. Security risks must be understood and addressed separately from compliance programs, as the consequences can be very real – a lesson Global Payments likely learned quickly as its stock dropped 9% before trading on its stock was halted, according to a Wall Street Journal article from March 30.


Gartner Analyst Avivah Litan reported that the hackers may have taken over an administrator account that was accessed by guessing the answers to the “knowledge-based authentication” questions. What stands out here is Global Payments’ apparent lack of understanding of basic Privileged Identity Management principles. Not only should administrative accounts be secured to a higher standard than normal user accounts, but they should be treated fundamentally differently than standard user accounts:



  • To ensure proper tracking, control and accountability, users should not be able to access these accounts directly, but only once authenticated and logged in to a “personal” identity.

  • Because privileged accounts are nearly always shared, having “knowledge-based questions” that enable access is a profoundly flawed practice.

In addition, even privileged accounts should follow the principle of “least privilege.” While Global Payments may never reveal this amount of detail, I wonder if the compromised accounts truly required the privileges to both access unencrypted credit card data and to export that data from the systems.


That Global Payments was found to be in compliance with PCI requirements by a certified assessor will hopefully spark discussions on whether PCI requirements require sufficient protections for privileged accounts. In addition, organizations should determine their security needs according to their tolerance for risk, rather than relying on requirements or standards to tell them what is necessary to protect their business.

Written by

Russell Miller

Russell Miller has spent over five years in network security in various roles from ethical…

Published in

Security

View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!

  • http://www.sheistocktips.com/ SHRISTOCKTIPS

    SHRISTOCKTIPS has
    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website. http://goo.gl/sMgZ7n

    Regards

    SHRISTOCKTIPS TEAM

  • king lear

    testing comment functionality, please do not publish this

  • http://www.rachelmacik.com Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • http://www.linkedin.com/in/michelehudnall Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.
    https://www.netiq.com/communities/data-center-solutions/accelerating_business_overhauling_service_management/

    Nice Post and Timely!

    @HudnallsHuddle

    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.