Ryan Wilk October, 2014 – The Confluence of Many Challenges Ryan Wilk (385) NuData Security 1

Ryan Wilk October, 2014 – The Confluence of Many Challenges Disclaimer The views and opinions expressed during this conference are those of the speakers and do not necessarily reflect the views and opinions held by the Information Systems Security Association (ISSA), the Silicon Valley ISSA, the San Francisco ISSA or the San Francisco Bay Area InfraGard Members Alliance (IMA). Neither ISSA, InfraGard, nor any of its chapters warrants the accuracy, timeliness or completeness of the information presented. Nothing in this conference should be construed as professional or legal advice or as creating a professional- customer or attorney-client relationship. If professional, legal, or other expert assistance is required, the services of a competent professional should be sought. 2

Ryan Wilk October, 2014 – The Confluence of Many Challenges The Challenges I Faced Building an In-House system. 3

Ryan Wilk October, 2014 – The Confluence of Many Challenges Introduction Ryan Wilk Director, Customer Success at NuData Security 4 Managed StubHub’s Transactional eCommerce Trust & Safety Group Founded the Universal Parks & Resorts eCommerce Fraud & Risk Department Previous

Ryan Wilk October, 2014 – The Confluence of Many Challenges Predicting Rather than Detecting 1. Rethinking Risk 2. Creating a Monster 3. Success (and Railings) 4. How Risk in the Market is Changing 5

Ryan Wilk October, 2014 – The Confluence of Many Challenges 6

Ryan Wilk October, 2014 – The Confluence of Many Challenges Learning the Ecosystem What is StubHub StubHub’s Unique Risk What do you do when fraud occurs 7

Ryan Wilk October, 2014 – The Confluence of Many Challenges When fraud occurs: Cancel the ticket? The seller has lost a ticket The buyer has lost a ticket StubHub loses twice 8 StubHub Process

Ryan Wilk October, 2014 – The Confluence of Many Challenges The ATO Problem Containing the issue Number 1 project at StubHub Full development team dedicated Solved in four months 9

Ryan Wilk October, 2014 – The Confluence of Many Challenges Creating a Monster 10

Ryan Wilk October, 2014 – The Confluence of Many Challenges Assessing ATO The account isn’t fraudulent The current user is fraudulent The ideal system knows the intention of the user Recognising the good user 11

Ryan Wilk October, 2014 – The Confluence of Many Challenges Optimizing In House Tools Address Verification Service (AVS) Credit Card Verification Code (CVV2, CVC) Device fingerprinting Rules engines 12

Ryan Wilk October, 2014 – The Confluence of Many Challenges ‘The Monster’ We used a piecemealed group of vendor tools to record things such as: Device ID IP Address – Geolocation Personally Identifiable Information Velocity Paired or grouped indicators Recorded data at key events 13

Ryan Wilk October, 2014 – The Confluence of Many Challenges Key Events Login Add-to Cart Change Address + 44 other event flows Data around 47 events generates a LOT of data. 14

Ryan Wilk October, 2014 – The Confluence of Many Challenges Measuring Success How did we do? 15

Ryan Wilk October, 2014 – The Confluence of Many Challenges Measuring Success Channels: Mobile / Desktop Payment method Chargebacks Fraud rates False positives By the rules engine By fraud analysts 16

Ryan Wilk October, 2014 – The Confluence of Many Challenges Our Results OPEX Optimization Review Time Reduction Queue Volume Reduction Reduced Customer Insult 17

Ryan Wilk October, 2014 – The Confluence of Many Challenges Retrospect 47 flows was excessive The rules used were most effective when looking for the good user, not the bad Expensive solution There are quicker ways that provide more ROI in a shorter time 18

Ryan Wilk October, 2014 – The Confluence of Many Challenges Changes in the Industry 19

Ryan Wilk October, 2014 – The Confluence of Many Challenges How the fraud prevention market is changing Prediction is beating detection Seeking good users who are now behaving differently more effective than seeking bad general traits Behavior is being used as an uplift to passwords Vendor solutions are more entwined – its easier Discreet vendors, they are more tightly integrated 20

Ryan Wilk October, 2014 – The Confluence of Many Challenges 21 Disclaimer The views and opinions expressed during this conference are those of the speakers and do not necessarily reflect the views and opinions held by the Information Systems Security Association (ISSA), the Silicon Valley ISSA, the San Francisco ISSA or the San Francisco Bay Area InfraGard Members Alliance (IMA). Neither ISSA, InfraGard, nor any of its chapters warrants the accuracy, timeliness or completeness of the information presented. Nothing in this conference should be construed as professional or legal advice or as creating a professional-customer or attorney-client relationship. If professional, legal, or other expert assistance is required, the services of a competent professional should be sought. Thank you Ryan Wilk (385) NuData Security