Okay.
What happens next?
So, you've done your initial report.
You've sent it off to a few people.
The merchant's hopefully now closed the breach down?
Yes.
Hopefully, it'll all be contained in that window,
and we, as the PFI, start writing up the details of the case.
We work with the merchant on the recommendations that we provide to them
to make sure that they're hardening their network,
not just to the PCI standard,
but so that they can really understand their
network and where their weakness are.
So now you're in education mode, yeah?
Correct.
Exactly.
We want our merchants to never have to go through this again.
I get that.
Do you go back onsite to validate the instance being contained?
Rarely.
Mainly we provide the recommendations, and we'll have a follow-up call and ask,
what's your status on these remediation steps that we've recommended to you?
Right.
That whole process then might be one month,
as long as that or shorter than that?
Again, it depends on the size of the merchant.
Some merchants, you'll be done in one week.
It's a small breach.
You've seen it before.
They only have a few systems to look at.
I've had other cases that went on for six months,
and there were many, many terabytes of data to go through.
Because I guess what you're looking for is criminals tend
to gain a foothold and then spread, don't they?
Yeah.
They love to get their beachfront,
and it's actually rare that we don't find some other piece of malware,
an admin shell on an e-commerce site or some hidden remote access
application or even a reconfiguring of the merchants own remote access
so that they have some way of getting back in.
And so we have to be very wary of those.
Great.
And that's the end of the process, basically.
You send your report, you send you bill, and that's it.
Well, we have a follow-up call with the merchants,
their acquirer, any legal counsel that they've chosen to employ.
We have a final call where we advise the card brands of,
hey, this merchant has done all the necessary steps.
We believe they have remediated this breach or it's contingent upon them
doing all of the other requirements that we recommended.
Are you there to find fault?
No.
We are there simply to gather the evidence and report the facts.
We're not there to give anybody a black eye or say,
your IT doesn't know what they're doing or anything like that.
We are simply there to gather the facts.
We report what we find.
We don't embellish it.
We don't color it any one way.
We just report the facts.
Do you also have to report, was the merchant compliant with PCI DSS at the time?
We do.
We do a PCI DSS of the 12 requirements.
These are not, they're not,
we don't do a complete in-depth analysis as a QSA would do if they came onsite.
But we do a brief analysis of the firewall to make sure that they've
got a good rule set in place; check their passwords to make sure
they're using complex passwords and not password,
password type of things, which we do still see from time to time,
unfortunately; and just all through those requirements.
We'll look at their security policy,
and we even provide a template for them if they're
struggling to comply with that.
Right,
and are you looking to see which requirements weren't in
place that allowed the breach to happen?
Is that ---?
Correct.
We'll look and see maybe they were using default passwords on a router.
We'll note that that step wasn't in place and whether
that contributed to the breach or not.