Let's talk about nonstandard point of sale.
Again,
something that we don't see in Europe very much apart
from on ticketing machines actually, surprisingly.
Gas stations,
I think is a big thing in America for a --- I keep reading on the internet,
but mostly on Krebs actually, about people taking card data from gas stations.
Gas stations, parking meters,
all those type of devices that you wouldn't normally think
of as being connected to a huge network,
attackers love to go and place very simple skimmers on those type of devices.
So those physical attacks against gas stations,
what controls in PCI DSS would protect a merchant,
or a gas merchant, against that?
There are a number of controls that actually protect against that,
layered approaches.
One is actually physically examining those devices from time
to time to see if they've been altered, to see if they've been tampered with.
Is that easy to do?
Are these skimmers invisible now or ---?
They can get more sophisticated.
We've seen one that looked no more dangerous than a piece of scotch tape.
It was just, the attacker could place it over,
and it's hard to spot unless you're actually trying to spot it.
If you know it's there, then it gets a little bit more difficult,
but very few people are, everybody's in a rush when they're at the gas pump,
right?
Yeah.
And even as jaded as I am in this industry,
I don't check every single time I go to the gas pump to
see if there's a skimmer on that device.
But a number of PCI controls can help mitigate even physical attacks,
like those against a gas pump, monitoring your physical security,
checking your logs.
The gas pumps still maintain their logs so they can go through
and --- check your logs from time to time.
Look at the audits that you have.
Obviously with the move to chip,
the US is going to see the sort of attacks we saw in Europe.
So we don't tend to get skimmers.
We tend to get two sorts of things.
We tend to get overlay attacks where somebody builds an
overlay and puts it right over the whole,
entire point-of-sale machine, and it's got a skimmer build into the overlay,
and it's wired the PIN cards.
Have you seen, have you started to see those in the states?
I have not seen one of those myself.
I'm kind of looking forward to it, unfortunately.
But we don't see those.
We have seen kind of a move away from the POS attacks because as
the Chip and PIN gets more fully integrated here,
that data becomes less viable to the attacker.
And so, not that we don't see the attacks.
They're still wanting that data.
But they're collecting the card,
but then they have to use that card in less convenient ways like taking it to a
card not present transaction such as an internet website.
But then they'd have the CVV too, and so it makes the attack harder.
Exactly.