So, we've talked about what to do if you get breached.
We've talked about e-comm attacks.
We talked about point-of-sale attacks and the general,
what I call, the old-fashioned infrastructure attacks.
We got some good lessons learned out of that.
I'm going try and wrap up some of the lessons learned that I remembered.
Chip in if I get any of those wrong.
So, in point of sale, it was remote access.
Remote access was like the way that most people were breaking in.
That's correct.
In e-commerce, there was quite a lot remote access we talked about as well.
What else was the cool thing?
It was about patching shopping carts?
Patching shopping carts, making sure you're up to date,
especially if you're running one of those open-source shopping carts.
You also need to be monitoring your logs.
Your logs are there for a reason,
and it's part of PCI compliance to be monitoring those logs,
and very few merchants are doing that.
But it's impossible.
They are this big.
I mean, you can't monitor those logs.
You can't, it's really difficult when you try to go in once a month and do it.
It needs to be done on a fairly regularly basis,
and the bigger of a target you are,
the more resources you need to devote to monitoring those logs.
Would you recommend people outsource that?
That is a viable option for doing that.
Absolutely.
But that strikes me as a skill that's quite hard to do in an organization.
Yeah, there are companies out there, including SecurityMetrics,
that offer things like SIM analysis where you can outsource that whole process,
and if your IT staff doesn't have that technical capability,
then you can get it done that way.
But even just basic log monitoring.
Not necessarily sitting down for hours and hours
like a forensic analyst would do.
But just going to through and looking at your network traffic and making
sure it looks legitimate or looking at your POS traffic.
Make sure that your payments are going to the right gateways.
Make sure your firewall rules are adequately configured,
and you're looking at your firewall logs from time to time.
Right, so just general health care,
what we call just general good IT security health checks effectively.
Just the boring stuff that no one likes doing is what you're asking for.
Yeah.
Basically, you're looking to see if you've got,
for example, NetBIOS traffic on your outside network.
You know you've got a problem.
You don't have to know what it is necessarily,
but you know that traffic should not be going through your outside firewall.
We talked about things like shopping cart admin screens and
content management system admin screens.
Good two-factor authentication on those.
Yeah.
Make sure you're protecting those.
Make sure you're not sending the access code to the same
machine that sent the request code.
And then from the client-side attacks,
I think your key message I heard was look at your website
like your customers look at your website.
Look at what's running on your payment page.
And my key message is learn how to use Content Security Policy
and Subresource Integrity because they're there in the browser
designed to help protect against this.
I actually don't think we've reached the end of this.
I think they'll be more stuff built into the browser because we're
in an untenable position now that basically,
we're here talking about payment cards.
That client software could steal usernames and passwords.
It could steal my medical records and an insurance,
I mean it could steal anything you put in a form.
So I think we're at the start of journey of that.
And then in infrastructure,
we talked again about remote access and about segmentation.
So, I'm going to ask you the real, the hardest question of the day now,
which is this.
If there's one piece of advice you could give to a merchant, what would it be?