WEBVTT 00:00:00.025 --> 00:00:00.766 Okay. 00:00:00.766 --> 00:00:02.991 What happens next? 00:00:02.991 --> 00:00:04.859 So, you've done your initial report. 00:00:04.860 --> 00:00:06.284 You've sent it off to a few people. 00:00:06.285 --> 00:00:09.895 The merchant's hopefully now closed the breach down? 00:00:09.895 --> 00:00:10.412 Yes. 00:00:10.412 --> 00:00:14.375 Hopefully, it'll all be contained in that window, 00:00:14.375 --> 00:00:18.817 and we, as the PFI, start writing up the details of the case. 00:00:18.818 --> 00:00:22.156 We work with the merchant on the recommendations that we provide to them 00:00:22.156 --> 00:00:24.514 to make sure that they're hardening their network, 00:00:24.514 --> 00:00:27.505 not just to the PCI standard, 00:00:27.505 --> 00:00:29.778 but so that they can really understand their 00:00:29.778 --> 00:00:31.655 network and where their weakness are. 00:00:31.656 --> 00:00:33.042 So now you're in education mode, yeah? 00:00:33.043 --> 00:00:33.748 Correct. 00:00:33.748 --> 00:00:34.454 Exactly. 00:00:34.454 --> 00:00:39.455 We want our merchants to never have to go through this again. 00:00:39.455 --> 00:00:40.514 I get that. 00:00:40.514 --> 00:00:45.676 Do you go back onsite to validate the instance being contained? 00:00:45.676 --> 00:00:46.336 Rarely. 00:00:46.336 --> 00:00:54.107 Mainly we provide the recommendations, and we'll have a follow-up call and ask, 00:00:54.107 --> 00:00:59.448 what's your status on these remediation steps that we've recommended to you? 00:00:59.449 --> 00:00:59.977 Right. 00:00:59.977 --> 00:01:03.819 That whole process then might be one month, 00:01:03.819 --> 00:01:06.516 as long as that or shorter than that? 00:01:06.516 --> 00:01:09.363 Again, it depends on the size of the merchant. 00:01:09.363 --> 00:01:12.977 Some merchants, you'll be done in one week. 00:01:12.977 --> 00:01:14.826 It's a small breach. 00:01:14.826 --> 00:01:16.080 You've seen it before. 00:01:16.080 --> 00:01:18.833 They only have a few systems to look at. 00:01:18.834 --> 00:01:21.553 I've had other cases that went on for six months, 00:01:21.553 --> 00:01:27.226 and there were many, many terabytes of data to go through. 00:01:27.226 --> 00:01:31.137 Because I guess what you're looking for is criminals tend 00:01:31.137 --> 00:01:34.648 to gain a foothold and then spread, don't they? 00:01:34.648 --> 00:01:35.008 Yeah. 00:01:35.008 --> 00:01:37.173 They love to get their beachfront, 00:01:37.174 --> 00:01:44.178 and it's actually rare that we don't find some other piece of malware, 00:01:44.178 --> 00:01:49.414 an admin shell on an e-commerce site or some hidden remote access 00:01:49.414 --> 00:01:54.262 application or even a reconfiguring of the merchants own remote access 00:01:54.262 --> 00:01:57.873 so that they have some way of getting back in. 00:01:57.874 --> 00:02:01.646 And so we have to be very wary of those. 00:02:01.646 --> 00:02:01.988 Great. 00:02:01.988 --> 00:02:04.730 And that's the end of the process, basically. 00:02:04.730 --> 00:02:08.454 You send your report, you send you bill, and that's it. 00:02:08.454 --> 00:02:11.043 Well, we have a follow-up call with the merchants, 00:02:11.043 --> 00:02:18.073 their acquirer, any legal counsel that they've chosen to employ. 00:02:18.074 --> 00:02:23.684 We have a final call where we advise the card brands of, 00:02:23.684 --> 00:02:27.261 hey, this merchant has done all the necessary steps. 00:02:27.262 --> 00:02:33.623 We believe they have remediated this breach or it's contingent upon them 00:02:33.623 --> 00:02:39.006 doing all of the other requirements that we recommended. 00:02:39.006 --> 00:02:40.591 Are you there to find fault? 00:02:40.592 --> 00:02:40.843 No. 00:02:40.843 --> 00:02:45.307 We are there simply to gather the evidence and report the facts. 00:02:45.307 --> 00:02:49.554 We're not there to give anybody a black eye or say, 00:02:49.554 --> 00:02:53.721 your IT doesn't know what they're doing or anything like that. 00:02:53.721 --> 00:02:57.296 We are simply there to gather the facts. 00:02:57.296 --> 00:02:59.105 We report what we find. 00:02:59.106 --> 00:02:59.962 We don't embellish it. 00:02:59.962 --> 00:03:01.868 We don't color it any one way. 00:03:01.868 --> 00:03:04.248 We just report the facts. 00:03:04.248 --> 00:03:07.786 Do you also have to report, was the merchant compliant with PCI DSS at the time? 00:03:07.786 --> 00:03:08.702 We do. 00:03:08.702 --> 00:03:12.825 We do a PCI DSS of the 12 requirements. 00:03:12.825 --> 00:03:14.916 These are not, they're not, 00:03:14.916 --> 00:03:21.266 we don't do a complete in-depth analysis as a QSA would do if they came onsite. 00:03:21.266 --> 00:03:25.371 But we do a brief analysis of the firewall to make sure that they've 00:03:25.371 --> 00:03:30.244 got a good rule set in place; check their passwords to make sure 00:03:30.244 --> 00:03:33.046 they're using complex passwords and not password, 00:03:33.046 --> 00:03:37.292 password type of things, which we do still see from time to time, 00:03:37.293 --> 00:03:42.172 unfortunately; and just all through those requirements. 00:03:42.172 --> 00:03:44.726 We'll look at their security policy, 00:03:44.726 --> 00:03:47.711 and we even provide a template for them if they're 00:03:47.711 --> 00:03:51.030 struggling to comply with that. 00:03:51.030 --> 00:03:51.299 Right, 00:03:51.299 --> 00:03:54.024 and are you looking to see which requirements weren't in 00:03:54.024 --> 00:03:55.620 place that allowed the breach to happen? 00:03:55.620 --> 00:03:56.218 Is that ---? 00:03:56.218 --> 00:03:56.631 Correct. 00:03:56.631 --> 00:04:03.089 We'll look and see maybe they were using default passwords on a router. 00:04:03.090 --> 00:04:07.324 We'll note that that step wasn't in place and whether 00:04:07.324 --> 00:04:14.324 that contributed to the breach or not.