1. Security A Payments Perspective Terry Dooley EVP & CIO SHAZAM Network

2. Agenda What’s HappeningWhat’s ChangingPayment Security MythsIndustry ProtectionsNew ChallengesEmerging Risks

3. What’s Happening

4. PhishingVishing Smishing Data Compromises You don’t need to teach an old dog new tricks!

5. What’s Happening You get the phone call, text, or email Yes it still works! New sunglasses Insurance payment Facebook virtual money Transactions submitted in seconds

6. What’s Happening Data Theft Phishing Vishing Smishing Consumer provides card or account data Data feed to counterfeiters real time Initial test transactions begin simultaneously in different countries Based on data compromised, target is most likely card-not- present

7. Source Verizon 2014 Data Breach Investigations Report What’s Happening Most skimming occurred on ATMs and gas pumps due to how relatively easy they can be approached and tampered with. Nearly all victims are U.S. organizations. Industries most commonly affected by POS intrusions are restaurants, hotels, grocery stores, and other brick-and-mortar retailers. Most skimming occurred on ATMs and gas pumps due to how relatively easy they can be approached and tampered with. While phishing numbers are slightly lower in 2013, 8 percent of users will click an attachment and fill out a web form. Most are skeptical of clicking an attachment, but 18 percent will visit a link within a phishing email.

8. What’s Changing

9. Payment credentials compromised Small dollar test transactions — slow flowing, wanting the 3 digit code on the back of the card More significant purchases, transactions escalate Fraud Goals High valueMerchandise Approach Low velocityValidation Compromise PhishingSmishing

10. Payment Security Myths

11. Technology Investment If I invest in the latest security technology can I get rid of other security technologies? Technology Integration I have a firewall, IDS, IPS, logging servers, and a SEIM, do I just plug them in and they work? Human Resources How many technologies can a security department manage, train, and become experts on? If I invest in this technology can I reduce the need to add more positions? The Ripple Effect

12. Industry Protections

13. Perimeter Defenses: Neural Engines: Data Protection: Consumer Account Bank/Debit/Credit WAPS Malware Detection Document Inspection SEIMS Velocity GeographicDevice Usability Encryption Tokenization Dual Control

14. New Challenges

15. Mobile devices Cloud computing and personal usage exploding Alternative payment apps Intelligence vs. stupidity

16. Emerging Risks

17. Compromises are no longer about the immediate theft and use of the data Thieves are installing key loggers, malware, and rats, among other items and letting them simmer for months before using There’s not a single security approach or technology that’ll prevent or mitigate the value of stealing account and card data as long as transactions can occur without authentication

18. Emerging Risks Silver Bullet? EMV Tokenization Layered Defenses No Fraudulent Transactions EMV prevented? Yes – counterfeit No – Internet Target Breach EMV prevented?No

19. Thank you! QUESTIONS? 515-558-7502 tdooley@shazam.net