Payment Card Data Theft: Tips For Small Business

For small businesses looking to reduce their exposure to data theft the good news is the advantage of being small.

Nothing frightens me more than walking into a local business and watching them swipe my credit card through a card reader connected to a desktop or laptop computer. Unprotected cables lay exposed between the card reader, system, and other network or peripheral devices. So many attack vectors -- all low-hanging fruit for an enterprising criminal targeting payment card data.

Based on my experience investigating payment card data theft, a number of questions immediately come to mind:

• Is unencrypted card data transmitted through any of those cables?
• Is the card-processing software configured correctly and up-to-date?
• Has the computer’s operating system been hardened?
• Is the computer running antivirus and is it up-to-date?
• Do the company outsource IT management and is there a remote management port open to the Internet?
• Do the company browse the Internet or read email on that computer?

I’m not worried about my own card being compromised. I know that as long as I’m using a major brand, and not a debit card connected to my checking account, that I’ll have little to no liability. I am however, concerned for the vendor. In the nine years I’ve performed incident response investigations, I’ve spoken with dozens of compromised small business owners. Time and time again, they have told me they cannot afford to decline payment card transactions, nor can they pay for an investigation that may cost thousands or tens-of-thousands of dollars.

The good news is that small businesses have the advantage of being, well -- small.

With fewer terminals and backend systems, small businesses are not as dependent upon a large and complex POS or back office system. The lack of a complex POS or back office system would allow a small business owner to move to newer and more secure platforms and/or outsource and transfer the risk and costs associated with data theft to the service provider. Moving to a more secure platform and/or reducing the size of the environment through outsourcing would reduce the likelihood that a small business will be the source of card data theft and be required to finance a costly investigation.

Here are some recommendations to follow that will help reduce your small business’s exposure to payment card data theft:

Do not maintain a Payment Card Industry (PCI) environment or maintain the smallest PCI environment possible.

• Consider the use of a mobile or tablet device to process card data. The operating system for many of these devices is more secure than the desktop operating system running on many traditional POS systems. An ideal example would be a non-jailbroken iPad or iPhone that you solely use for card transactions, and a PCI DSS (Data Security Standard) compliant mobile card reader, such as Square or Stripe.
• Consider using a cellular network for card transactions instead of your wired or wireless network. This will prevent you from processing card data on the same LAN or WiFi network that is used by your business or customers.

If you must process transactions using a traditional Point of Sale (POS) system:

• Start by reconsidering this requirement. Unless all of the services provided with a compliant mobile card reader fall far short of your accounting or inventory management requirements, it may not be worth the added risk. Attackers have repeatedly proven that traditional POS systems, even when properly configured and fully patched, are vulnerable.
• Use a standalone POS PIN Pad that connects via plain old telephone system (POTS). This removes the computer and your network from the equation, but may not be a long-term solution as telecom providers move to decommission POTS.
• Keep the system fully patched, harden the configuration/eliminate unnecessary services, and run antivirus.
• Ensure all POS software is up to date and configured as directed by the vendor, since the default settings may not be secure.
• Do not outsource the maintenance of these devices to a company that will directly access remote management ports over the Internet.

Important best practices for all systems:

• Protect the physical security of all systems that store, process, or transmit cardholder information. All security is lost if an attacker can alter or replace your equipment. 
• Do not allow systems in you PCI environment to connect to the Internet, aside from the connections required to process card transactions or patch the system.
• Do not allow systems in your PCI environment to connect to any systems on your network that are not necessary for processing card transactions or patching.

What about small businesses that conduct business online? In my experience, self-hosted solutions, whether reliant on internally developed or commercial off the shelf (COTS) software, are a significant risk. Attackers are adept at exploiting vulnerabilities in internet-facing applications used to process PCI data.

Small business owners should consider using a PCI DSS compliant provider when handling online transactions. This process can be made transparent to the customer. It transfers the risks and costs associated with data theft to the service provider.

Following these recommendations will not magically solve the problem of cardholder data theft. After all, small businesses aren’t the only targets. We’ve seen plenty of large retailers, banks, and payment processors fall victim to attacks. However, these steps will transfer risk away from small businesses that cannot (and should not) bear the burden of operating a secure PCI environment.

While some of these solutions may increase transaction costs, it’s likely that some or all of the cost will be offset by the reduced cost of managing systems, networks, and by the reduced risk of having to conduct a costly investigation.

 

Chris Nutt is the Director of Incident Response and Malware of Mandiant. He has nine years of experience in enterprise incident response, working with the federal government, defense industrial base, and Fortune 100 companies. He has extensive experience in incident ... View Full Bio