Being one of the authors of Verizon's annual Data Breach Investigations Report, we felt his thoughts may be of interest to readers.

iTWire: How are breaches, such as the recent one at Global Payments, typically uncovered?

Mark Goudie: The most common data breach detection method for payment cards is Central Point of Purchase analysis.  This technique looks for merchants where cards that have shown fraudulent transactions were used validly.  Where you have a cluster of cards that were used at a merchant that have shown subsequent fraud you have a Central Point of Purchase (CPP).

iTWire: But of course, this time the breach wasn't at the merchant level.

Mark Goudie: That technique is very successful and quickly identifies the compromised merchant, but when any data aggregator is compromised the CPP analysis makes it look like a whole group of merchants has been compromised and it can take some time to work out where the problem lies.

Data aggregators have a far better track record than merchants, but they do offer a more attractive target for organised crime than merchants due to the volume of data they process.

iTWire: Of course the whole process is supposedly governed by the rules of the Payment Card Industry Data Security Standard (PCI-DSS), but we have heard of too many occasions where desperation sets in when the annual or semi-annual audit is almost due and the whole IT team is set vigorously upon the task of satisfying the audit before returning to their normal ways.

Mark Gaudie: As always, security and the PCI-DSS is a 24 x 7 exercise.  For modern organisations, the days where improving security just for a security assessment are a thing of the past.  Security has to be checked by the data owner because if they do not rectify a problem that creeps into their environment someone will exploit it and the problem will come to their attention for all the wrong reasons.

iTWire: so, we now know what happened - hackers broke into Global Payments.  Is that where the role of a company like Verizon ends?

Mark Goudie: The facts of a data breach evolve dramatically over the course of a data breach investigation and it is often many weeks or months into the case before the investigators have a good understanding of exactly what happened.  Looking at whether incidents are linked very early in any investigation is dangerous and will typically take some time for the facts to come to light.

iTWire: so that means we shouldn't expect to hear definitive outcomes from the investigation for some time to come?

Mark Goudie: If ever.