Lessons from the Heartland Payment Systems attack
- Teodora Petrovic
- Expert review
- 3 min.
- Updated on:
Last week, we went through the facts of the Heartland Payment Systems attack, which resulted in around 130 million credit card numbers being compromised, a massive drop in Heartland’s stock price, the company temporarily losing its Payment Card Industry Data Security Standard (PCI DSS) compliance, and needing to pay out approximately $140 million in penalties.
We don’t want this to happen to your company, so we are going to run through some of the major mistakes that Heartland made, and how you can avoid them.
Defend against SQL injections
The initial incursion into Heartland Payment Systems was via SQL injection. These are really common attacks that essentially involve an attacker sending through unauthorized SQL commands. Thankfully, SQL attacks are easy to prevent. The problem occurs when organizations take on user inputs, such as through forms, but don’t validate or sanitize them properly.
Let’s say that you want someone to submit their name via a form. An SQL injection involves an attacker inputting SQL commands instead of their name. The SQL commands then run on your system, allowing the attacker to take control.
The easiest way to stop this is to validate input data to ensure that it is the type of information that you actually want, and not a software command. Since names don’t tend to include special characters (aside from hyphens and apostrophes sometimes), you can simply blacklist many of the special characters that are used in SQL commands. This will prevent attackers from being able to execute code on your systems.
End-to-end encryption
At certain points during the transaction process, Heartland’s payment card data could be intercepted as plaintext. This allowed the attackers to scoop up the sensitive card data through packet sniffing and then exfiltrate it. One option to mitigate this is to implement end-to-end encryption so that the card data is encrypted from the point of being swiped onward. In the wake of the breach, Heartland Payment Systems actually did begin encrypting their payments systems from end to end, but it was a very expensive way to learn this lesson. Hopefully you can learn from the company’s mistakes and ensure that sensitive data is encrypted appropriately.
A strong security posture goes beyond compliance
To the uninitiated, it may come as a surprise that Heartland Payment Systems was actually compliant with the Payment Card Industry’s Data Security Standard (PCI DSS) at the time of the attack. The PCI DSS sets out security standards for organizations that process payments. If Heartland Payment Systems was compliant, how was it breached?
Unfortunately, compliance doesn’t mean that a company is impenetrable. Standards are about setting minimum levels of security that companies must meet. However, sophisticated attackers can always launch advanced attacks that overcome this level of defense.
These days, SQL injections hardly count as sophisticated, but we’re also talking about an attack from more than 17 years ago, back when our security systems were much less robust. Another problem is that Heartland Payment Systems was compliant at the point when the company was assessed, but that doesn’t mean that the company’s security program was compliant all of the time. To truly be secure, we must go beyond compliance and maintain a proactive security posture.
The easiest and fastest way to pass the Security + exam
Build Your Cybersecurity Foundation. Our team has helped thousands of professionals succeed with advanced certifications like CISSP and CCSP. Now we've taken that same proven and tailored it specifically for Security+!
Master CISSP — as Easily and Quickly as Possible
Expert-reviewed training that makes complex concepts clear and entertaining. Join our CISSP 5-Day Live Bootcamp with expert instructors Rob Witcher and John Berti to fast-track your exam prep and master all 8 CISSP domains. Live on Zoom, this intensive training is packed with real-world insights and Q&A—reserve your spot now!
