Many merchants --- and you know I'm slightly,
partly responsible for this because Visa Europe was one of the big
proponents to the point-to-point encryption standard.
So many merchants have moved to point-to-point encryption where the card
data is encrypted in the secure point-of-sale device,
so it's not running through the till,
but it's running through a dedicated reader strongly encrypted all the
way back to either the processor or the merchant.
So that means the card data's not accessible.
Has that had an effect on your work and on what merchants are doing?
Yes.
It's had a profound effect on it.
We have yet to see a properly implemented P2PE solution that has been breached.
Now we do see where the attackers have come in and taken
advantage of improperly configured P2PE solutions.
Tell me about that then because that should be quite given.
I'm pretty familiar with the standard.
That should be pretty hard for someone to do.
What did they do wrong?
Well, the merchant did everything right except for one thing.
They set up their P2PE solution, tested it,
did everything perfect, and then they left it in debug mode.
And so the cards,
even though the solution was there to prevent those cards from leaking,
the attacker was able to come in and look at plain text
credit card data going across the wire.
That's awesome.
That really is awesome.
And it --- I'm going to stop,
I want to stop you there because that's like the second big learning point.
If you put in a P2PE, then make sure it's turned on and working, yeah?
Yes.
And not just working,
but make sure it's absolutely encrypting those cards
because it can look like it's working.
Hey, did you swipe a card there?
Did it come out on that end?
Yes.
Well what happened in the middle?
So put a network analyzer on there.
Catch some data from it.
Look at the packets.
Make sure there's no encrypted card data.
Unencrypted card data.
Unencrypted data card, yeah.
Absolutely.
When I go onsite, I always test the P2PE solution,
and I'll download memory,
and I'll scan that memory for any unencrypted card data going through there.
And every so often, we still find it even when merchants say, yeah, we're good.
We're running P2PE.
But if it is put in and running correctly, it is a very, very big deterrent.
Right, and I guess then the merchant doesn't have to do PCI DSS.
So that must be a pretty big thing for them.
I mean that was one of the drives of P2PE.
It can bite you if you don't use it correctly.
It is not the end of security, end of your security efforts.
Your network is still your network,
and it still presents a valuable target to the attackers.
We had one recent case, a very large merchant,
a multibillion-dollar merchant, that put in a fantastic P2PE solution.
They had it verified.
They were doing great with it.
They still got hit by attackers.
Now the attackers did not get any credit card data.
The cards were safe.
They did not leak any cards, but the attackers went in,
and they put ransomware and just encrypted the POS terminals.
On all the POS terminals?
Yeah, on all the POS terminals.
Okay, so that's good.
So they're not leaking any card holder data, but they're not trading.
So the card brands,
even actually the card brands are not going to be happy
because they're not making money either.
No one's happy now.
And you have your employees standing around at a machine that says,
please send your bitcoins here to restore this machine.
That's across your entire network.
I'm mean, talk about an expensive bill.
You've got to pay an attacker to get all of your POS machines back up.
You might as well just wipe everything and start over.
That's a tremendous bill.
Yeah, what about cryptominers?
You see any of those, those things that mine for bitcoins?
Because that's a way of monetizing access as well.
Yeah, the attackers, even if they can't get your cards,
they're going to make that access, all the work they did to access that network,
they're going to make it pay for itself somehow.
Yeah, because I guess they came expecting to steal the card data,
they're seeing just encrypted card data,
they are quite cross,
and so they want to monetize their access because they might have
spent three or four weeks breaking into this merchant.
Yeah, and so they're going to take advantage of those CPU resources.
They can do cryptominers, they can put ransomware on there,
they can steal other corporate secrets that you have,
and they can make your network part of their bot network.
Okay, so I think that's the big, the third learning point for merchants.
If you put P2PE in,
don't then forget to do security for the rest of your network
because you have other valuable assets that aren't --- so they
don't concern people like you and me.
It's not a PFI.
It's not a card data issue, but it's an issue of their trading as a merchant.
Right.
Yeah.
You still have to protect your network.
Your network is still your network.
There's still value in that network,
and you can't just do P2PE and wash your hands of all security concerns.
I think every P2PE manual should come with a big health
warning at the beginning that says, this fixes one problem,
but not the others.