How to ensure cybersecurity in the payments process

The inex­orable rise of cyber­crime has made it a risky time to be run­ning a busi­ness that depends on the inter­net. When that busi­ness is deal­ing with pay­ments, bro­ker­ing finan­cial trans­ac­tions for poten­tial­ly mil­lions of cus­tomers, the stakes are even high­er. 

One cyber attack in July, tar­get­ing a glob­al net­work of pay­ments ter­mi­nals using soft­ware sup­plied by US firm Kaseya, amply illus­trates the risks fac­ing the sec­tor. It was mount­ed by a hack­ing gang using a ran­somware strain known as REvil. 

In the state­ment it made after the attack, Kaseya report­ed that only 60 of its cus­tomers were affect­ed – which, while cor­rect, demon­strates the con­cen­tra­tion of pow­er in the pay­ments indus­try. Those 60 cus­tomers were sup­port­ing about 1,500 oth­er busi­ness­es, which were ren­dered inca­pable of tak­ing pay­ments. 

Real-world ramifications of cyberattacks

More than a third of the affect­ed enter­pris­es were branch­es of Swedish super­mar­ket chain Coop. The ran­somware dis­abled its tills, forc­ing the clo­sure of most stores. A small num­ber tried to con­tin­ue trad­ing using an alter­na­tive pay­ments method that they had test­ed before the attack, but that sys­tem would also lat­er fail, unable to with­stand the sud­den surge in demand. Some per­ish­able foods were giv­en away to pre­vent spoilage.

Natal­ie Page, cyber threat intel­li­gence ana­lyst at Tal­ion, a spe­cial­ist in net­work secu­ri­ty, observes that only 0.1% of Kaseya’s clients were affect­ed. 

“This attack could have been a lot worse – the god-lev­el access mode that REvil ran­somware oper­a­tors achieved was extreme­ly wor­ry­ing,” she says. “Unfor­tu­nate­ly, this won’t be the last sup­ply-chain attack we shall wit­ness. Next time we may not get off so light­ly. It’s a mat­ter of when, not if, there will be a sim­i­lar case. Owing to the spread­ing mech­a­nism that an attack of this nature can pro­vide, such inci­dents have the poten­tial to be lit­tle short of dis­as­trous.”

Kevin Cur­ran, pro­fes­sor of cyber­se­cu­ri­ty at the Uni­ver­si­ty of Ulster, believes that the sec­tor “has a long way to go to keep up with sophis­ti­cat­ed tech­niques used by fraud­sters. Although a cash­less soci­ety is on the hori­zon, mov­ing that way presents major risks for the pay­ments indus­try.”

It’s there­fore vital that the sec­tor applies arti­fi­cial intel­li­gence as a threat-hunt­ing tool, says Page, who notes that Visa has been using AI-based sys­tems for well over two decades to safe­guard trans­ac­tions. This tech­nol­o­gy can analyse more than 500 risk attrib­ut­es every mil­lisec­ond. 

“AI has been the dri­ving force in help­ing com­pa­nies world­wide to improve the cus­tomer expe­ri­ence, boost their growth and, most cru­cial­ly, mit­i­gate threats to pay­ment secu­ri­ty,” she says. 

But Page adds that fur­ther work is still need­ed to keep the ever-more sophis­ti­cat­ed cyber­crim­i­nals at bay. This includes the devel­op­ment of an approach known as zero-trust archi­tec­ture, which requires every request made on an organisation’s net­work to prove its integri­ty before it can be per­mit­ted.

Is consolidation to blame?

Some observers have observed that the recent pan­dem­ic-fuelled uptick in M&A activ­i­ty and increas­ing cen­tral­i­sa­tion in the pay­ments indus­try have been mak­ing the sit­u­a­tion riski­er. These trends have caused points of fail­ure to be bunched more close­ly among a decreas­ing num­ber of pay­ment providers. 

This con­cen­tra­tion of pow­er is a poten­tial con­cern for busi­ness­es oper­at­ing crit­i­cal infra­struc­ture such as pay­ment ser­vices, as Page explains: “With many pay­ment providers now cen­tral­is­ing and merg­ing, a small­er group of tar­gets are being cre­at­ed, with a much larg­er client base than ever before. This means that the secu­ri­ty of pay­ments sys­tems has nev­er been so cru­cial.” 

She con­tin­ues: “There are real dis­par­i­ties in the qual­i­ty and secu­ri­ty offered by var­i­ous pay­ment sys­tems. With no gov­ern­ing body to set and main­tain stan­dards, the indus­try could be head­ing for dis­as­ter. The devel­op­ment of a real author­i­ty to mon­i­tor this area would there­fore be an extreme­ly pos­i­tive step to ensure the future secu­ri­ty of the pay­ments indus­try.”

Taking steps to prevent disaster

Cur­ran is con­cerned that the sec­tor, as cur­rent­ly struc­tured, is ill-equipped to han­dle anoth­er cri­sis on the scale of the Kaseya attack. 

“Even though the growth of mobile pay­ments has been explo­sive, secu­ri­ty con­trols and enter­prise man­age­ment tools have not matured in the same way,” he notes. 

With­in days of the attack on its sys­tem, Kaseya man­aged to come up with a soft­ware patch to plug the vul­ner­a­bil­i­ty that the hack­ers had exploit­ed. 

Cur­ran stress­es that busi­ness­es need to update their soft­ware when­ev­er they are prompt­ed to do so. This is par­tic­u­lar­ly impor­tant in the case of pay­ments sys­tems, which process high­ly sen­si­tive pri­vate infor­ma­tion, includ­ing the secu­ri­ty codes on cus­tomers’ bank cards that are required to ver­i­fy online and tele­phone trans­ac­tions. 

“All soft­ware has vul­ner­a­bil­i­ties, so the quick­er an update can be dis­trib­uted, the more secure it is,” he says. “The longer a sys­tem remains out­dat­ed with known vul­ner­a­bil­i­ties, the greater the risk.”

It’s impor­tant for com­pa­nies to back up their sys­tems reg­u­lar­ly and main­tain cyber­se­cu­ri­ty aware­ness among their employ­ees. From a busi­ness-con­ti­nu­ity per­spec­tive, it’s also advis­able not to rely on a sin­gle pay­ments provider if at all pos­si­ble.

The Kaseya attack has been use­ful in that it has warned all play­ers in the sec­tor that they need to take prompt and effec­tive action, or risk becom­ing the next vic­tims. 

“Although the pan­dem­ic has made many peo­ple feel that time is stand­ing still”, Page says, “the glob­al econ­o­my cer­tain­ly isn’t.” 

As a result, nei­ther should the pay­ments indus­try.