Could Global Payments Breach Finally Kill KBA Questions?
Written by Evan SchumanWhen reports started surfacing Friday (March 30) that more than 10 million card numbers may have been compromised in a breach at processor Global Payments in early March, Gartner security analyst Avivah Litan published a delightful early detail: It seems that the cyberthieves gained access by taking over a New York taxi company’s administrative account “by answering the application’s knowledge-based authentication (KBA) questions correctly.”
We’ve been here before. Asking “security” questions based on easily discoverable or guessable answers is no longer a good idea for general consumer access, but for administrative access? You’re really protecting super-user privileges by asking for their favorite ice cream flavor? (A major telco used that protection and discovered vanilla is awfully popular. And one gang last year specialized in basic research, including “everything from Social Security number to oldest sibling’s nickname and city where the victim was married.”)
(Related Story: Visa Kicks Global Payments Off Its PCI Compliant List. Catch-22 Is In Full Force.)
Before we delve into the lack of security with KBA, let’s quickly review the preliminary Global Payments details. The first report came from Krebs On Security and pointed to Visa/MasterCard alerts “warning banks about specific cards that may have been compromised. The card associations stated that the breached credit-card processor was compromised between Jan. 21, 2012, and Feb. 25, 2012. The alerts also said that full Track 1 and Track 2 data was taken—meaning that the information could be used to counterfeit new cards.”
Krebs and Litan both reported that activity seemed to be focused on parking garages in the New York City metro area. (Litan added that cyberthieves initially seemed to be “a Central American gang.”) No initial info suggested that any major retailers were identified as a common point of purchase, which really makes this appear to be a pure Global Payments headache.
Global Payments issued its own statement Friday (March 30) that it had “identified and self-reported unauthorized access into a portion of its processing system.”
But a quote in that statement from CEO Paul Garcia, intended to be reassuring, was anything but. Quoth Garcia: “It is reassuring that our security processes detected an intrusion. It is crucial to understand that this incident does not involve our merchants or their relationships with their customers.”
Let’s take this one frightening sentence at a time. Although it’s nice Garcia is reassured that the company detected the intrusion after the fact—after potentially more than 10 million card numbers were grabbed—it’s safe to say that retailers would have been a heck of a lot more reassured had Global Payments prevented the intrusion instead. Or maybe stopped it after 8,000 or even 80,000 instances. Heck, even 800,000 or 8 million would have been an improvement.
-Marc
March 31st, 2012 at 11:50 am
Integrating strong, managed security processes has always demanded more security-focused employees. Companies look at anything security-related as non value overhead. If they’re forced into a compliance mandate, such as PCI, it usually translates into a do-the-minimim approach, put on existing IT employees who are already over utilized doing production support (primary) work. Companies don’t consider risk -the probability, frequency and impact. Once a breech happens the response is usually in the form of an internal witch hunt and massive over-spending on a poorly planned, rushed solution to ad-hoc the gap. Companies will eventually recognize the difference between IT support and IT security, the need for both and the need to integrate both for successful implementation, management and monitoring of threat targets. As it stands now, any penny split between hiring overhead security staff and stock dividend will always go to the shareholders. It’s akin to eating yourself for breakfast.
April 4th, 2012 at 5:43 pm
I think the death of KBA questions has been dying for quite sometime and unfortunately businesses and consumers are having to pay the price before companies take action. It’s amazing that social media and gaming companies around the globe have adopted technologies that allow their users to telesign into their account using the telephone while enterprises, financial institutions, etc sit around and let things like this happen…..