1. Data Breaches in Payments Systems- Roles and Best Practices for the Public and Private Sector Response Don Rhodes Director Risk Management Policy American Bankers Association Risk Management

2. Agenda ▪ Corporate Account Takeover ▪ Zeus Trojan ▪ Best Practices ▪ ABA Efforts Risk Management

3. Spear Phishing

4. Risk Management Spear Phishing

5. Risk Management Spear Phishing

6. Risk Management Banking Trojans in the News Silver Tail Systems

7. Risk Management What Happened in Kentucky? County treasurer had Zeus malware on his PC Criminals stole credentials and logged in to bank accounts from treasurer’s PC  Reconnaissance used to plan theft  Mule recruitment pretending to be CareerBuilder  Created mules as fictitious employees  Mules receive $9700 and sent $9200 to Ukraine via Western Union More than 25 <$10,000 wire transfers /Total of $415k stolen Silver Tail Systems

8. Risk Management Business Exploit

9. Risk Management Best Practices 1. Understand what data is most sensitive to your business 2. Know where this sensitive data resides 3. Understand your risk model 4. Select the appropriate controls based on policy, risk, and where sensitive data resides 5. Manage security centrally 6. Audit security to constantly improve http://www.rsa.com/ ©2009 RSA Security Inc.

10. Risk Management Best Practices http://www.ftc.gov/infosecurity/

11. Risk Management ABA Efforts ▪ National Card Fraud Task Force ▪ Information Security Working Group ▪ Risk Management Forum April 28-30, Renaissance Vinoy, St. Petersburg, FL

12. Data Breaches in Payments Systems- Roles and Best Practices for the Public and Private Sector Response Don Rhodes Director Risk Management Policy American Bankers Association drhodes@aba.com 202-663-7513 Risk Management