Heartland's Breach: Lessons Learned (w/ Video)

Earlier this year, Heartland Payment Systems announced a major security breach that sent a few shockwaves through the financial world, not just because of its impact on Heartland, but also because of what the incident revealed about the sophistication of the Russian hackers who perpetrated this fraud. Heartland's CSO Kris Herrin talked to me about it at our recent Bank Summit in Pasadena, CA.You can watch a video interview with Herrin below.

InformationWeek also covered a recent Herrin talk here.

The impact was bone-rattling, especially given that Heartland had recently (and repeatedly) pass PCI compliance tests. More to the point, the company's share price went from slightly over $15 per share before the incident down to $8 per share after. Visa dropped Heartland as an approved vendor.

Heartland was not alone. The Russian hackers had breached 300 financial institutions. But it wasn't just a rogue group of hackers; this is a sophisticated organization, run much like any other corporation. It outsources its malware development to India because it isn't core to its business. It runs a help desk. Customers can customize their attack, selecting method and target from a list of pull-down offerings. They make guarantees. They share threat intelligence among other groups of hackers.

Heartland and others have been working on some solutions that should help. One of the biggest issues, according to Herrin, is that credit card information is unencrypted from the swipe at a merchant location all the way back to the card issuer's bank. There are potentially dozens of points in between that can be compromised. He told the summit crowd that there had been 10 major security improvements in the credit card business in the past 40 years; and exactly zero in magnetic stripe technology. Now, the stripe will be encrypted -- this is in test phase now.

There are others working on authentication technology as well -- magnetic stripe authentication and chip and PIN solutions. This would complement end-to-end encryption, Herrin said.

The other initiative is among industry players. While there is a financial industry information sharing council (FFISAC), it isn't specific to payment processors and, according to Herrin, the sharing isn't anonymized -- some of the card brands are fearful about fines given what they would be sharing. Now, the processors are joined in their own council and have signed NDAs and begun sharing techniques and intelligence at extremely technical levels. This council includes banks and merchant associations.

Fritz Nelson is an Executive Editor at InformationWeek and the Executive Producer of TechWebTV. Fritz writes about startups and established companies alike, but likes to exploit multiple forms of media into his writing.

Follow Fritz Nelson and InformationWeek on Twitter, Facebook, YouTube and LinkedIn:

Twitter @fnelson @InformationWeek@IWpremium

Facebook Fritz Nelson Facebook Page InformationWeek Facebook Page

YouTube TechWebTV

LinkedIn Fritz Nelson on LinkedIn InformationWeek