Heartland's Breach: Lessons Learned (w/ Video) - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Infrastructure // PC & Servers
Commentary
10/15/2009
01:47 PM
Fritz Nelson
Fritz Nelson
Commentary
Connect Directly
Facebook
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Heartland's Breach: Lessons Learned (w/ Video)

Earlier this year, Heartland Payment Systems announced a major security breach that sent a few shockwaves through the financial world, not just because of its impact on Heartland, but also because of what the incident revealed about the sophistication of the Russian hackers who perpetrated this fraud. Heartland's CSO Kris Herrin talked to me about it at our recent Bank Summit in Pasadena, CA.

Earlier this year, Heartland Payment Systems announced a major security breach that sent a few shockwaves through the financial world, not just because of its impact on Heartland, but also because of what the incident revealed about the sophistication of the Russian hackers who perpetrated this fraud. Heartland's CSO Kris Herrin talked to me about it at our recent Bank Summit in Pasadena, CA.You can watch a video interview with Herrin below.

InformationWeek also covered a recent Herrin talk here.

The impact was bone-rattling, especially given that Heartland had recently (and repeatedly) pass PCI compliance tests. More to the point, the company's share price went from slightly over $15 per share before the incident down to $8 per share after. Visa dropped Heartland as an approved vendor.

Heartland was not alone. The Russian hackers had breached 300 financial institutions. But it wasn't just a rogue group of hackers; this is a sophisticated organization, run much like any other corporation. It outsources its malware development to India because it isn't core to its business. It runs a help desk. Customers can customize their attack, selecting method and target from a list of pull-down offerings. They make guarantees. They share threat intelligence among other groups of hackers.

Heartland and others have been working on some solutions that should help. One of the biggest issues, according to Herrin, is that credit card information is unencrypted from the swipe at a merchant location all the way back to the card issuer's bank. There are potentially dozens of points in between that can be compromised. He told the summit crowd that there had been 10 major security improvements in the credit card business in the past 40 years; and exactly zero in magnetic stripe technology. Now, the stripe will be encrypted -- this is in test phase now.

There are others working on authentication technology as well -- magnetic stripe authentication and chip and PIN solutions. This would complement end-to-end encryption, Herrin said.

The other initiative is among industry players. While there is a financial industry information sharing council (FFISAC), it isn't specific to payment processors and, according to Herrin, the sharing isn't anonymized -- some of the card brands are fearful about fines given what they would be sharing. Now, the processors are joined in their own council and have signed NDAs and begun sharing techniques and intelligence at extremely technical levels. This council includes banks and merchant associations.

Fritz Nelson is an Executive Editor at InformationWeek and the Executive Producer of TechWebTV. Fritz writes about startups and established companies alike, but likes to exploit multiple forms of media into his writing.

Follow Fritz Nelson and InformationWeek on Twitter, Facebook, YouTube and LinkedIn:

Twitter @fnelson @InformationWeek@IWpremium

Facebook Fritz Nelson Facebook Page InformationWeek Facebook Page

YouTube TechWebTV

LinkedIn Fritz Nelson on LinkedIn InformationWeek

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
News
How to Create a Successful AI Program
Jessica Davis, Senior Editor, Enterprise Apps,  10/14/2020
News
Think Like a Chief Innovation Officer and Get Work Done
Joao-Pierre S. Ruth, Senior Writer,  10/13/2020
Slideshows
10 Trends Accelerating Edge Computing
Cynthia Harvey, Freelance Journalist, InformationWeek,  10/8/2020
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
[Special Report] Edge Computing: An IT Platform for the New Enterprise
Edge computing is poised to make a major splash within the next generation of corporate IT architectures. Here's what you need to know!
Slideshows
Flash Poll