The voice on the other end said, “Chuck, this is Armando in IT. Sorry to call at this hour, but it’s urgent. We’ve been talking to our acquiring bank and we’re now able to confirm that at least eight of our franchise locations have been breached.

“And it gets worse,” Armando said. “The common factor is us. That’s to say, our corporate network. We believe that the hacker gained access to guest names and payment card data by accessing the corporate network, burrowing through the property management system (PMS) and subsequently into the systems of our franchisees’ locations.”

“Start making calls,” Dorin said. “I want your team assembled in the conference room at 6 a.m., and be prepared to give very specific information on what happened.”

The aroma of coffee permeated the conference room as the most plausible explanation unfolded. The hacker had likely exploited a security vulnerability in the corporate website and, through a relatively simple structured query language (SQL) injection attack, had successfully penetrated the corporate network.
“How did this happen? Our corporate network doesn’t store payment card data,” Dorin said. 

Sidestepping the CEO’s question, Armando said, “Our corporate website had a vulnerable page that allowed hackers to perpetrate a SQL injection attack. A SQL attack is a method used by criminals to exploit websites, and can be done by inserting codes or commands into the browser.  We suspect that’s what happened here.  Once the hacker got inside our network, he was able to access the payment data in the property management system (PMS) and then jump to the franchisees’ networks where he was able to access additional sensitive information.”

The forensic report also found that there was no segmentation of the corporate network from the property management system (PMS) network. Network segmentation is an important security practice that refers to splitting a network into functional segments and implementing an access control mechanism between each of the boundaries. In this case, the corporate network’s flat setup meant there were no additional layers of security, thereby allowing the hacker to move freely within the corporate network and into the PMS.  

Once inside the network, the hacker was able to gain access to the domain controller, a server that holds user IDs and passwords.  From there the hacker obtained the administrative credentials necessary to access the PMS where he then gained access to guest names and payment information.  The hacker then jumped to eight franchise locations to gain additional sensitive information.

Because the corporate network did not contain any payment information, management had assumed that the network was out of the scope of Payment Card Industry Data Security Standards (PCI DSS) requirements.  That assumption was incorrect; its connectivity to the PMS made it critical to secure and segment properly.  Adequate controls at the corporate level could have helped limit the information the hacker was able to access or prevented the attack altogether. 

Data Security Considerations
Ensure a Properly Segmented Network Environment
Use network segmentation to ensure the payment card processing environment is separate from public networks including wireless networks. Separate any user environments from any business systems using a firewall and strict access controls (ACLs).  For example, a system used by employees to receive e-mail should be separated from a system used for transaction processing.

Apply Strong Access Controls
Configure the firewall to only allow access between systems participating in the transaction flow. Limit access to only the network ports that are necessary to perform desired business functions. Access controls should be applied to both directions of network traffic – inbound and outbound. Enable logging and exception alerting on all network devices and business systems where possible. Audit logs are valuable in the event of suspected unauthorized activity and for monitoring traffic patterns within a network. Use strong authentication procedures to access the payment processing environment.

Protect Domain Controllers
Domain controllers are a favorite target of hackers because they generally contain authentication information such as user IDs and passwords to access resources on the network. To protect the domain controllers, ensure that the server itself is configured securely.  Domain users should only have minimum network access necessary to perform their jobs. Similarly, applications accounts should also have minimum permissions, and make sure they are in line with the purpose of the application. Organizations should also conduct regular audits of domain administrator accounts and delete any that are unneeded.  Additionally, it is recommended that entities implement a separate domain for the payment processing environment.

Ingrid Beierly is a senior business leader for Visa Inc.