How to Prevent a Heartland-Style Data Breach

17.08.2009
The United States Department of Justice announced today the arrest of Albert Gonzalez, a 28-year old Miami man, in the on record. Gonzalez is accused, along with two as-yet-unnamed Russian co-conspirators, of compromising more than 130 million credit and debit card accounts from a variety of targets including and 7-Eleven.

While the Department of Justice should be commended for the successful investigation and indictment of Gonzalez, the arrest will not 'un-breach' accounts that are already compromised and available on the black market. In an ideal world the arrest would deter future identity theft, but it is unlikely. It is still an almost entirely anonymous crime capable of generating significant revenue and would-be ID thieves are more likely to just consider themselves smarter and better than Gonzalez. He made mistakes, but *they* won't get caught.

So, kudos to the Department of Justice, but you still need to watch your back and safeguard your networks and data from similar attacks. Here are three tips to help you protect your data and make sure you don't become the next Heartland Payment Systems.

1. Wireless security. Wireless networks exist in most businesses these days. The thing about wireless networks is that they let employees roam about and still stay connected to the network, but they also provide an opportunity for unauthorized users who are within range of the wireless access point to gain access as well. The and Lowes were both made possible through weak or non-existent wireless network security.

Wireless networks should be segregated from the primary network to provide an extra layer of protection. The wireless connection should be secured with WPA or WPA2 encryption at a minimum. It is even better if some other form of authentication is used to access the wireless network. There should also be a policy against setting up unauthorized wireless networks and period scanning to ensure rogue networks don't exist.

2. Compliance. By virtue of accepting, processing, transmitting, or storing credit card transaction data the organizations that were compromised in these attacks fall under the Payment Card Industry Data Security Standards (PCI DSS) requirements. PCI DSS was developed by the credit card industry to provide baseline security requirements for businesses that handle sensitive credit card information.