What is a level? 

“Levels” is a classification of organizations accepting and processing credit cards.  They are defined and used by the payment brands to indicate what compliance validation procedures and reporting requirements targeted entities are expected to complete.

There is no consensus in this area between payment brands (this would be too easyJ). There are as much levels definition than payment brands

They are mainly defined based on the number of transaction processed annually on the payment brand networks.

Who determines the level applicable for a merchant?

Since acquirers are responsible for merchants’ compliance they are the ones who determine the level applicable to a merchant.

So if a merchant accepts multiple brands and those brands utilize different acquirers, the merchant could be subjected to multiple levels according to the acquirers. 

How to determine the applicable level? 

Acquirers qualifies the applicable level mainly based on the number of transaction processed annually as well as any account compromised experienced by the merchant.

Merchant levels definition per payment brands and transaction volume

The Federal Financial Institutions Examination Council recently released a supplement to the guide it issued in 2005, on authentication in an Internet banking environment. One of the FFIEC’s key recommendations for eliminating fraud is consumer awareness and education.

At some level, you may be aware that financial institutions have a layered security approach in place. Those layers include multi-authentication, which may mean requiring users to punch in a second security code or carry a key fob, as well as due diligence in identifying customers as real people whose identities haven’t been stolen, and consumer education.

Consumers are largely oblivious to the multiple layers of security put in place by financial institutions in order to protect them and their bank accounts. All consumers really care about are ease and convenience. However, a better understanding of what goes on behind the scenes can help consumers adapt to new technologies that affect their lives.

I recently came across a blog post written by a financial institution’s bank manager, “Nerdy Nate,” attempting to educate the bank’s customers in response to the FFIEC’s guidance. Nate’s message is useful for all bank customers, and should be a model for other financial institutions.

“Currently, [this institution] employs a combination of a secure browser connection, customer number, password, and our enhanced login security system. We recently added the ability for you to use email, voice and text to receive a one-time passcode needed when we do not recognize your computer. We do realize that having to use a one-time passcode is inconvenient at times. Please be assured that SIS will research other options to make this more convenient. However, at this time, using a one-time passcode is considered the best practice in authenticating you as a user when you login into SIS Online Banking. This method is also compliant with the FFIEC guidance issued to SIS.

We are also working with our Online Banking provider on other security efforts in response to the FFIEC guidance.

·      Enhanced Device Identification – We will enhance the security of the multifactor authentication enrollment cookie, where it is in use, by adding device fingerprinting. This means that if the cookie is present on a system whose device fingerprint differs from what is on record, the cookie will not be honored and an additional authentication step will be required.

·      Removal of Challenge Questions – In the near future, we will no longer allow the use of a Challenge Question to authenticate you. Instead you will need to use one of the three passcode methods available; text, voice call and email.

·      Web Fraud Detection, Behavior Monitoring – We are evaluating different options to monitor your online access for fraud. Once we have a solution in place, we will notify you on how it might affect you as a user.

·      Malware Prevention & Detection – We are evaluating different options to monitor the use of malware to “hack” your online access. Once we have a solution in place, we will notify you on how it might affect you as a user.

We remain committed to providing you with the best and most secure Online Banking experience possible. With the ever-changing landscape of online fraud, this is proving to be more difficult every day. We are confident that with your help and some hard work on our side, we can achieve our goal.”

Great stuff. Nowadays, education on the “threatscape” is essential. Enhanced device identification is also essential. The FFIEC suggests complex device identification. While complex device identification is more sophisticated than previous techniques, take one step instead of two and incorporate device reputation management.

This proven strategy not only has advanced methods to identify devices connecting to your bank, but also incorporates geolocation, velocity, anomalies, proxy busting, webs of associations, fraud histories, commercially applied evidence of fraud or abuse, and much more to protect your financial institution against cyber fraud.

Robert Siciliano, personal security and identity theft expert contributor to iovation.

Is your data in the cloud? Right now as we speak billions are being invested my major corporations to store and back up data in the cloud. It’s cheaper and it’s safer.

When you think of a cloud, do you picture fluffy white pillow-things that float in the sky without a care in the world? “The cloud,” as it relates to technology, actually refers to millions of servers, which may be owned and operated by either corporations or private individuals, sitting in homes and offices. We can only hope that they are under tight security.

Data stored on your computer is kept together, in one nice little controlled place. Whereas data stored in the cloud is spread out, all over the world. But what’s more secure, your local PC or a server in a dark room in Des Moines?

The reality is that all cloud-based data, just like local PC-based data, is vulnerable to physical theft if the building isn’t properly protected, power outages if there aren’t redundant power backups, natural disasters if Mother Nature decides to have a bad day, and criminal hacking through system weaknesses, phishing, and social engineering.

Then there is Murphy, of Murphy’s Law: what can go wrong will go wrong. And with technology, there is much that can go wrong. CNET recently reported that Amazon’s cloud was down for almost two days. “In April, the cloud storage service experienced a two-day outage that brought many Web site operations to a halt. When a cloud-computing provider has trouble, of course, it raises worries about the dangers of outsourcing operations to another company.”

Cloud-based data is vulnerable both in the cloud, where it’s stored, if it is not properly protected and encrypted, and in transit, via your own Internet connection.

Most cloud service providers won’t explicitly outline what they do to protect your data because it could offer potential hackers information on how to compromise their networks. But one provider for example promises “strict security policies, military-grade encryption, and world-class data centers for optimal data protection of your business’ computers and servers.”

Some providers offer two-factor authentication which is another good way to protect the integrity of cloud-based data, making hacking more difficult than obtaining a simple username and password.  To remind, two factor authentication means you have to use two different things to prove your identity.  Typically this is something you have, like an ATM card, and something you know like a PIN code.

Computer users are responsible for the security of locally stored data, and data that is transmitted via their Internet connection. They can avoid phishing and social engineering scams. But beyond that, they are reliant on the cloud provider to adequately secure their data. Have you checked with your cloud provider yet on their security measures?

Robert Siciliano, personal security expert contributor to Just Ask Gemalto.

Regulators (scenarists and directors)

With any project as complex as the implementation of ISO 27001 there are some things to avoid. Here are two quick things you shouldn't do:

1. Don't focus on information security. Although it sounds counter-intuitive it is only the "content" of ISO 27001 that is about information security. What's more is that if you achieve this and focus on the ISO 27001 process, it will ensure that information security is taken care of properly in your organization.
ISO 27001 is a management system standard. It is a standard that describes requirements for a system for managing information security. It does not include information security itself – merely the processes through which you will manage information security. If you set the processes in place effectively they will (you will) effectively manage your information security. The management system processes fall into two categories. The "primary" processes in the standard are about the processes to understand your current information security perspective, quantify the risk to your organization and plan actions to accept or reduce the risk to make it acceptable. It is implicit that senior management will be involved in accepting poor security... or pay to lower the risk. There is no requirement in the standard that the risk has to be addressed or lowered, merely that management acknowledge it and accept it. Other primary processes include a process to react to security incidents (or near incidents), contingency planning covering information security and a process to have access to information security contacts and information security legal requirements.

In addition to the primary processes, "support" processes include document control, records management, training, internal auditing, management and corrective and preventive action. All of these processes must be formally defined in written procedures that describe a coherent and comprehensive system of processes that help understand and control information security.

It has to be said that although ISO 27001 is not "about" information security, it does make specific reference to information security technologies. In an appendix it lists a number of general categories including physical access, human resources, communications, operations, etc. These categories are expanded in some detail in ISO 27002 and ISO 27001 requires that these controls are considered when reviewing risks in the organization and that their non-applicability is formally justified in a "statement of applicability". Thus the pair of standards do actually require and cover information security but as mentioned earlier none of the requirements are mandatory. Further, certification is about having a formal management system to ensure information security is consistently and continually addressed to ensure it is and remains effective. If you focus on the security issues you are not contributing towards ISO 27001 certification and you are not assuring the consistency and sustainability of information security management. Don't ignore the security issues but deliberately address the management system issues. That is the long term solution.

2. Don't over-complicate your risk assessment method. Risk is a calculation derived from probability and consequence. To make it objective it needs to be quantified as a numeric value so that it can be compared to what management says it will accept. This can be quite complex. Ultimately risk usually includes subjective assessments of what the probability is and what value the consequence might affect. There is a tendency to attempt to formalize each step and even break steps into multiple stages so the subjectivity can be limited. However, truth is that when you add all the stages together the subjectivity still exists. Keep the risk assessment methodology simple. What is the max value of the information asset that may be compromised? How serious is the threat? How serious is the vulnerability? (avoid breaking it down too far). And when assigning numbers try 1-5 rather than 1-10.
The key factor to a good risk assessment is to identify the risks. Most people in your organization will understand what that means when the risk and consequence is described and they will know how serious they are. So long as you do a good job of identifying risk the numbers assigned and range they exist within are lest important.
If this is your first attempt at a risk assessment then keep it simple. You can always make it more complex next time around.

Cavendish Scott, Inc. is experienced at implementing ISO 27001 management systems. We guarantee successful ISO certification and design and implement practical and easy to maintain systems. We also provide ISO 27001 training and conduct ISO 27001 audits including gap assessments.

ISO 31000:2009 sets out principles, a framework and a process for the management of risk that are applicable to any type of organization in public or private sector. It does not mandate a "one size fits all" approach, but rather emphasises the fact that the management of risk must be tailored to the specific needs and structure of the particular organization.

ISO 31000 is designed to help organizations:

• Increase the likelihood of achieving objectives
• Encourage proactive management
• Be aware of the need to identify and treat risk throughout the organization
• Improve the identification of opportunities and threats
• Comply with relevant legal and regulatory requirements and international norms
• Improve financial reporting
• Improve governance
• Improve stakeholder confidence and trust
• Establish a reliable basis for decision making and planning
• Improve controls
• Effectively allocate and use resources for risk treatment
• Improve operational effectiveness and efficiency
• Enhance health and safety performance, as well as environmental protection
• Improve loss prevention and incident management
• Minimize losses
• Improve organizational learning
• Improve organizational resilience.

ISO 31000 and ISO Guide 73 can be applied to any public, private or community enterprise, association, group or individual. The documents will be useful to:

>Those responsible for implementing risk management within their organizations
>Those who need to ensure that an organization manages risk
>Those needing to evaluate an organization' practices in managing risk
>Developers of standards, guides procedures and codes of practice relating to the management of risk.

ISO Training

The International Standard ISO 27001 (previously BS-7799) for Information Security Management has been designed to help organisations of all types and sizes to implement simple and relevant practices that will secure not just their computer and communications services, but also their offices, their valuable organisational information and the efficiency and well-being of their staff.

What are the Benefits of ISO 27001?

ISO27001 was designed for high-pressure, information-driven, information-dependent environments.

ISO27001 was developed by 'real life' organisations including Marks & Spencer, Unilever, Lloyds TSB, and Nationwide Building Society to name just few. All these are organisations that are under commercial pressure: they have to deliver results to share holders or stakeholders, and retain high levels of security and motivated workforces. Their input to the original British Standard and determination to ensure that it was appropriate and supportive in a high-pressure environment means that the controls and recommendations actually enhance efficient working practices.

ISO27001 provides an independent, recognized way of measuring the state of your information security. The standard provides an easy-to-follow framework for measuring and assessing the status of an organisations Information Security at any given time: this means that it is possible to take snapshots of your progress as we enhance your systems and implement new procedures. ISO27001 helps you put in place some of the procedures you are legally required to have in place.

Employment law is increasing in complexity at all time and it is a wise employer who documents and covers all eventualities for staff reference and agreement. In addition, other legislation, such as the Data Protection Act, the Computer Misuse Act and the Human Rights Act, provide a set of veritable minefield for the unwary. ISO27001 urges implementers to consider and design good information privacy and human resources procedures.

ISO27001 provides a way of showing partners, suppliers and staff that your are taking information security seriously.

ISO27001 recommends best practice for all types of information storage, communication and movement. As more and more companies exchange information using technology as the underlying transport system, the efficiency grows – but the risk increases. It is likely that, to facilitate secure inter organisation information exchange in future, sharing agreements will stipulate that partners work in accordance with, or formally comply with, ISO27001. So ISO27001 will increasingly become the requirement for secure information exchange
between all organizations.

In conclusion, ISO 27001 gives you a best practice management framework for implementing and maintaining sound information security. It also gives you a baseline against which to you can either show compliance against or undergo external certification.

ISO 27001 certification communicates to customers and suppliers alike that your organisation is managing and responding to information risk.

ISO 27001 Training