So you've had a conversation with the merchant.
The merchant's got their IT people wandering around,
looking for a breach they probably don't believe
exists because it's their system, and they're going to quite precious about it.
Emotions are at play here, aren't they?
Oh, they treat it like their own child.
Yeah, absolutely.
If it happened to me, it would be, yeah, it'd be horrible.
In fact, it is horrible.
Your child's, it was actually, I'd say,
how I got into information security many years ago,
and this was before PCI, was that somebody hacked my web server.
And it's like, how did, this would be when hacking was a thing.
It was like, and I was like, ah, yeah.
I was mortified.
So I get that mortified people are running around thinking
that's not my system that's being hacked,
yeah?
Yeah, and when it happens, you feel assaulted,
and some people are embarrassed by it.
They want to hide it.
They don't want to admit it happened.
They said, it can't be me.
All those victim status things that come into play.
I have to say I literally remember spending time as a card brand,
then we got a merchant in, and we said, we think you've got a data breach.
We haven't got a conclusive point of compromise,
a POC, but, it's so near the threshold.
We think you should go and look at things before you have a breach,
before it becomes a big breach.
And the merchant swore to us there was nothing that --- and
eventually it turned out they'd had a breach.
But it's just that whole like, no, it can't happen to me.
So, you've had the phone call, there are people in the merchant doing things,
you're now,
are you running to the airport with a grab bag or is this a controlled ---?
Quite often we are getting onsite as fast as possible either to
stop the bleeding or to grab volatile evidence that could be
destroyed in normal business practices.
So time is critical.
The PFI guidelines have mandates of when we have to be onsite.
I believe it's five days after we engage,
we have to have a preliminary report to the card brands that say,
hey, we've been onsite.
We've done a preliminary investigation.
We see that there is probably evidence of a breach here.
Within five days?
Within five days, yes.
So, within five days, you've got to get onsite,
do some initial analysis, and write your short report up.
Yeah, so we're hustling.
You're hustling.
Yeah, you are running to the airport with a grab bag.
Okay, so you arrive at the merchant's facility with your badge, PFI badge.
Yep, PFI badge.
What happens next?
Well, we meet with the merchant and have a quick meeting to go over it,
what we discussed on the phone.
They're probably meeting us for the first time at that point.
We discuss the scope; we have them show us around the premise; make
sure that we've identified everything that is likely in scope; and then
we start the process of acquiring the data.
And we try to be unintrusive as possible.
So walk me through what acquiring the data means.
Basically, we'll go in,
and we need to take forensic images of the hard drives of the
machines or download the memory of the machines,
the POS terminals or the servers that had the breach on them,
and it's a pretty simple process.
It can get complicated if it gets more technical.
But generally, we'll plug in an external drive,
with some software on a thumb drive, and we'll spend maybe 10,
15 minutes at a machine getting it prepped.
And then we start our forensic cloning software that's
going to take an image of that device.
And that can run in the background, and if it's a POS terminal,
it can go right back into service while that's running.
And are you working to the same standard of law enforcement?
Are you actually working with things, like EnCase or those familiar tools,
that will give you an audible record of everything that happens?
Are you working at that level?
Yeah, we are using forensic-grade software tools.
EnCase, FTK, X-Ways,
all those type of tools we're using and using write blockers,
things like that, to protect the integrity of the data.
So you're doing exactly what law enforcement will,
a law enforcement forensic investigator will be doing.
You're working at the same level.
Yeah, we're trained as forensic investigators,
so we're very much aware of the chain of custody of
evidence and things like that to make sure that evidence is
the exact evidence from the case.
Because that might be quite confusing to some merchants that
they think it's like a technical thing.
You just go in and you just copy something and wander off again.
But you're actually working to some set of procedures, basically.
That is correct, and it does take some time.
It's not, depending on the size of the systems and the age,
the worst thing for a PFI is to go in and see USB 1.1 ports.
You know you're going to be there for a while.
Because it's a slow extract.
Yeah, I hope you brought lunch.
It can take some time.
But at this stage, everything's still running.
You haven't told the merchant to stop trading,
you've not turned their web server off, you're trying to get evidence,
yeah?
Yes.
We're trying to get evidence in a way that is minimally
disruptive to their business practices.
And I guess from a merchant that should be quite reassuring.
Because if I was a merchant,
I think my biggest worry was that I'd stop trailing with these
forensic people running around my organization.
We try to be as careful as we can about not disrupting the flow of business.
We understand that they're in business, and if we're disrupting things,
they're not making money.