Search
Close this search box.
Facebook Instagram Linkedin

Month: June 2022

Categories
Data Protection

PayShield 10K: Why migrate?

As companies become increasingly digital, the risk of data breaches and cyber attacks increases. One of the most important steps in protecting yourself is to choose the right payment security solution. That’s where payShield 10K does its part.

payShield 9000 is one of the most popular payment security solutions on the market. However, with the release of payShield 10K, businesses now have a new option to choose from.

But why should companies migrate from payShield 9000 to the new payShield 10K? Continue reading the article until the end and learn about the differences and advantages of migrating.

Meet the new payShield 10K

Thales’ fifth generation payment HSM, payShield 10K provides proven security features in critical environments, including transaction processing, protection of sensitive data, payment credential issuance, mobile card acceptance, and tokenization.

Similar to its predecessor payShield 9000, the new version can be used across the global ecosystem by issuers, service providers, acquirers, processors, and payment networks.

payShield 10K offers several benefits that complement the previous versions, showing Thales’ commitment to the continuous improvement of its products.

In practice, the new version:

  • Simplifies deployment in data centers;
  • It offers high resiliency and availability;
  • It provides the broadest card and mobile application support in a timely manner;
  • Supports performance upgrades without hardware change;
  • Maintains compatibility with all legacy Thales payment HSMs.

Top 10 Reasons to Switch to PayShield 10K

1. Thinner format

The new version of payShield 10K reduces the unit height to 1U, which means that you can stack twice as many units in the rack as with payShield 9000, reducing the cost of investment.

The unit is now longer for easier access to the connectors on the back panel and comes with slide rails to help simplify and speed up the installation process.

The front panel design retains the familiar left and right key mechanisms so you can securely lock the HSM in the rack.

2. Lower energy consumption

Every watt of power that a device requires increases your data center’s power and cooling costs.

The new payShield 10K design, leverages the latest energy efficient components and power management techniques to reduce overall power consumption, even while operating at twice the cryptographic performance, by 40%.

This will undoubtedly help reduce your data center’s electricity bill and contribute to your company achieving its “green goals”.

3. Increased resilience and availability

If your company is forced to take an HSM offline for routine configuration tasks or to replace a faulty power supply, it negatively affects the availability of your financial services infrastructure.

Thales in its continuous improvement process, enhances the physical design with payShield 10K, providing two power supplies and hot swappable fans as standard, improving MTBF, providing a very high expected uptime.

As part of the mission to help keep your payShield 10K running 24/7, the new version of the appliance performs additional background monitoring of HSM system processes and application code.

If problems are detected, they will be fixed automatically without any intervention from the IT team.

4. payShield 10K with faster firmware updates

Loading firmware usually means taking the HSM offline for several minutes. With payShield 10K, the firmware upgrade workflow process has been reduced while maintaining all the necessary security checks for authenticity and code integrity.

The reliability and ease-of-use aspects have also been improved, so that if power or connectivity interruptions occur, the charging process will automatically recover to minimize the possibility of the HSM becoming idle.

 

Thales and E-VAL can help you with LGPD

5. Clearer visual indicators

The payShield 10K has a simple and neat front panel design that displays a red warning triangle when a tampering event occurs.

When all is well, the left handle on the front panel is illuminated white, but if regular background integrity checks discover a problem, the handle will turn red.

To help identify which HSM in a rack may need emergency or scheduled intervention, operations staff can now quickly direct local staff to the HSM that needs support by illuminating the front and rear maintenance lights using payShield Manager.

In addition, the front light illuminates the unit’s serial number, making it easy to read if necessary. These are just some of the time-saving features introduced in payShield 10K, some inspired by customer feedback.

6. Clear confirmation of key removal

In the routine of IT infrastructure administrators, it is sometimes necessary to move an HSM from a production environment to another, less secure location.

Under various security audit constraints, critical keys, such as active LMKs, must not be present when the unit is at the new location.

The payShield 10K contains a dedicated key removal confirmation light on the back panel to ensure that no keys or sensitive data reside on the drive and that it is safe to deactivate.

This improved approach to erasing the key provides confirmation even after the unit is turned off.

7. Even stronger tamper protection

payShield 10K has multiple levels of tamper detection that, when activated, erase keys and confidential data in the event of an attack.

A fully locked cover is also used to increase the complexity for any attacker.

Attempts to access the inside of the internal safety module cause the device to be permanently disabled.

8. Broader cryptographic support

To support new payment methods, the new version of the hardware is able to leverage very fast hardware-based ECC processing in addition to the legacy 3DES, AES, and RSA algorithms.

Many of the emerging payment credential issuance use cases use ECC instead of RSA, especially when the payment instrument is a mobile, IoT or connected device.

payShield 10K is ready for enhancement to support a much wider range of cryptographic algorithms and mechanisms as they become formalized as part of the growing range of payment security specifications.

9. Even Higher Performance

Card payments and online digital payments are growing year by year, requiring you to constantly monitor and upgrade your processing bandwidth.

The new version of payShield offers significantly higher RSA and 3DES performance than its predecessors, which can reduce the number of devices in the previous version and lower your costs.

This faster cryptographic engine also provides more consistent and predictable performance across all host commands, even in heavy load situations and when TLS-based secure communications are in use.

10. payShield 10K features superior architecture

As the payments world increasingly looks for new deployment models involving a mix of private and public clouds, payShield 10K is specifically designed to offer secure remote management and monitoring, providing a true ‘contactless’ experience.

This provides support for various types of payment service offerings and more capabilities to perform functions securely across a wide range of operating environments.

With its enhanced features, payShield 10K is well suited to handle the ever-changing landscape of payment security.

payShield 10K ensures payment security

With payShield 10K you are assured that your company meets the highest security standards in the financial industry.

The fifth generation of payment HSMs from Thales, Eval’s partner company, offers a suite of proven security features in critical environments, in addition to transaction processing, protection of sensitive data, payment credential issuance, mobile card acceptance, and tokenization.

The payShield 10K solution can be used throughout the global payments ecosystem by issuers, service providers, acquirers, processors, and payment networks, offering a number of benefits.

Eval Professional Services has a team of specialized professionals with the best practices in the market

Benefit from our years of experience and expertise in information security and compliance with the General Data Protection Act (LGPD). We will be your partner for realizing digitization projects in compliance with security and data protection regulations.

We share our expertise across all business flows in healthcare organizations to help you minimize risk, maximize performance, and ensure the data protection your patients and partners expect.

About Eval

Eval has been developing projects in the financial, health, education, and industry segments for over 18 years. Since 2004, we have offered solutions for Authentication, Electronic and Digital Signature, and Data Protection. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With market recognized value, Eval’s solutions and services meet the highest regulatory standards for public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

Digital fraud will cause $48 billion in losses by 2023

In recent years there has been a significant increase in the number of digital frauds carried out over the Internet. This type of crime can take many different forms, such as credit card fraud, identity theft, and cyber attacks. That’s when solutions like payShield 10K make a difference.

According to
study by Juniper Research
global losses from digital fraud are expected to reach $48 billion by 2023. This is up from the estimated $22 billion in 2018. The increase is due to several factors, including the growth of e-commerce and the increasing sophistication of fraudsters.

There are a number of steps that companies can take to protect themselves from digital fraud. Stay with us until the end of the article to better understand this threat scenario and see important tips that we have separated to minimize the risk of scams in your company.

Lack of analytical maturity of organizations is one of the causes of the growth of digital fraud

According to
study by Serasa Experian
, by March 2022, 389,788 fraud attempts were registered, representing an increase of 18.9% over the same period in 2021.

In practice, this means that every 7 seconds a Brazilian is a victim of fraudsters. The segment that has suffered most from this is retail, with a 74.1% increase in digital fraud attempts.

Basically, digital fraud is the use of illicit techniques to gain undue advantage. However, the modality is very broad and can take on different formats.

One of the main strategies used by criminals is phishing, which consists of creating fake websites to obtain personal data from the victims.

Another modality is identity theft, where criminals use the stolen information to make purchases or access bank accounts.

The main forms of digital fraud recorded are:

  • Online credit card scamsOnline credit card scams: This type of crime is committed when the criminal obtains personal information from users, such as credit card number, expiration date, and security code, in order to make online purchases in their name;
  • Identity theftIdentity theft: This crime occurs when a criminal uses another person’s identity to gain financial advantages, such as opening accounts in his or her name or applying for loans;
  • Bank fraudDigital fraud: This type of digital fraud happens when the criminal is able to access someone else’s bank account and make transfers to your account.

The lack of analytical maturity of organizations is one of the main causes of the growth of digital fraud. Many companies still do not invest in data analysis systems that can detect fraud attempts, making the criminals’ job easier.

In addition, the growth of e-commerce has also contributed to the increase in digital scams, as criminals have found it easier to attack companies that offer online services.

What are the consequences of digital fraud for businesses and consumers?

Digital fraud is a serious problem that can have devastating consequences for businesses and consumers. In the business world, digital fraud can result in:

  • Financial losses for the company: once a company is a victim of digital fraud, it can suffer significant financial losses. This is because fraud can lead to the loss of money, as well as the expenses incurred to investigate and reverse the damage caused by fraudsters;
  • Damage to the company’s reputation: Besides causing financial losses, digital fraud can also damage a company’s reputation. When consumers are victims of fraud, they can become frustrated and angry, which can negatively affect the brand image;
  • Increased risk to cybersecurity: Digital fraud can also increase the risk of other cyber attacks, because fraudsters can use the information obtained to carry out new attacks. In addition, companies that suffer from digital fraud may be more vulnerable to other types of attacks, as fraudsters can exploit the company’s security flaws to carry out their attacks.

Thus, it is clear that digital fraud can cause serious harm to businesses and consumers. It is therefore important that companies take steps to protect themselves against this type of attack, as well as to investigate and reverse the damage done by fraudsters.

How to avoid digital fraud in companies?

There are several ways to avoid digital fraud, both for businesses and consumers. For businesses, the top tips for avoiding digital fraud are:

  1. Implement security measures: companies must implement security measures to protect company data and systems against cyber-attacks. These measures can include implementing a firewall, encrypting data, controlling access, and other security measures;
  2. Investigate suspicious transactions: organizations must also investigate suspicious transactions to identify possible digital fraud. This can include checking data such as IP address, credit card number, and other information that might indicate a cyber attack.

For the workforce, the top tips for avoiding digital fraud are:

  • Be careful what you share on social networks: Consumers should be careful what they share on social networks, because the information they share can be used to carry out cyber attacks;
  • Check URLs before clicking: employees should also check URLs before clicking, because sometimes fraudsters use fake URLs to trick people into going to malicious sites;
  • Backing up data: although it is something very technical and usually done by IT teams, employees need to be aware of the backup processes for important data, as this can help recover lost information in the event of a cyber attack.

In addition to these tips, companies and their employees should also keep an eye out for digital fraud attempts and report any suspected cyberattacks to the proper authorities.

Digital fraud is a growing problem in the business world, and can cause serious harm to businesses and consumers.

Therefore, it is important to take steps to protect yourself against this type of attack, as well as to investigate and reverse the damage done by fraudsters.

payShield 10K ensures payment security and combats digital crime

With payShield 10K you are assured that your company meets the highest security standards in the financial industry, including protection against fraud.

With payShield 10K, the fifth generation of payment HSMs from Thales, an EVAL partner company, offers a suite of proven security features in critical environments, in addition to transaction processing, protection of sensitive data, issuance of payment credentials, mobile card acceptance, and tokenization.

The payShield 10K solution can be used throughout the global payments ecosystem by issuers, service providers, acquirers, processors, and payment networks, offering a number of benefits.

EVAL Professional Services has a team of specialized professionals with the best practices in the market

Benefit from our many years of experience and expertise in information security and LGPD compliance. We will be your partner for realizing digitization projects in compliance with security and data protection regulations.

We share our expertise across all business flows in healthcare organizations to help you minimize risk, maximize performance, and ensure the data protection your patients and partners expect.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

Ransomware Clusters: Protect Yourself and Prevent Attacks

Ransomware groups continue to take advantage of vulnerabilities to infect and extort their victims. It is important that individuals and businesses are aware of these vulnerabilities and take the necessary precautions to protect themselves from infection.

By knowing what to look for, we can help minimize the chances of falling victim to cybercriminals, ransomware attacks, and all their effects.

In this article, we will discuss how to protect yourself against ransomware group attacks, the dangers of not being prepared, and what to do to protect yourself.

Groups specializing in malware distribution

Ransomware groups are organized criminal gangs that specialize in distributing different types of malware

They often take advantage of old vulnerabilities to infect their victims. This is because many people and companies do not keep their software up to date, leaving it vulnerable to attack.

According to the analysis of ransomware attacks recorded between January and March 2022 by cybersecurity researchers at Digital ShadowsLock Bit 2.0 and Conti were the two most active ransomware gangs during the three-month reporting period, accounting for 58% of all incidents.

Ransomware gangs usually infect a computer using social engineering techniques, such as sending malicious e-mails that contain infected attachments or links.

Once a victim opens the attachment or clicks on the link, the ransomware runs and encrypts the computer’s data. After encrypting the data, the gangs usually demand a ransom in virtual currency to decrypt it.

In addition, ransomware gangs can also infect a computer using exploits and unknown vulnerabilities, also known as Zero-Day attacks.

This is done by exploiting a flaw in the computer’s software that has not yet been fixed by the manufacturer. By doing so, ransomware gangs can gain complete access to the organization’s computer and networks.

Once ransomware has access to a network, it can spread to other computers connected to the network and encrypt the data on all computers.

This makes it even more difficult for an organization to recover its data, as they need to pay ransoms for all infected computers.

Ransomware groups have made their operations professional

As ransomware groups are becoming more professional with their attacks, it is important that individuals and businesses take the necessary precautions to protect themselves. One way to do this is to know what to look for to identify a possible ransomware attack.

Some of the most common vulnerabilities that ransomware groups are exploiting include old exploits in established products such as operating systems and productivity tools.

By keeping them up to date, we can help mitigate the risk of being infected by ransomware.

As ransomware operations have become more complex, they require an increasing range of specialized skills to be executed successfully.

For example, some ransomware groups are recruiting IT professionals to help encrypt their victims’ systems and ensure that the attack is successful.

The groups are increasingly specializing in certain industries to ensure that the victims are willing to pay the ransom.

For example, some ransomware groups are focused on attacking hospitals because they know that these organizations cannot stop functioning and need their systems to operate.

This means it is crucial that companies identify the types of ransomware that are being targeted and take the necessary steps to protect themselves.

In addition, it is important that companies keep a backup of their data so that they can restore their systems if they are infected by ransomware.

Finally, it is also a good idea to educate yourself and others about the dangers of ransomware. By doing so, we can help decrease the chances of being a victim of an attack.

 

infographic about the data protection platform CipherTrust

 

How to protect yourself from ransomware groups

There are a few steps you can take to protect yourself from ransomware groups.

  • First of all, make sure that you have up-to-date security software installed on your computer and that it is running the latest patches;
  • The second step is to be aware of the types of ransomware that exist and the methods they use to infect their victims. This will help you identify an attack if it happens;
  • Third, make sure you have a backup of your data in case you get infected. This way you can restore your systems without having to pay the ransom.

Also, be very careful what files you download and open, especially if they are from unknown or untrusted sources.

If you suspect that you have been infected with ransomware, do not attempt to pay the ransom, as this only encourages the attackers and may not result in the release of your files.

Instead, contact a professional malware removal service or your local authorities for assistance.

By following these simple steps, you can help keep yourself protected against ransomware groups.

Your company’s cybersecurity with real-time data protection and secure encryption

O
CipherTrust
is the ideal solution against ransomware attacks. In a simple, comprehensive and effective way, the solution
CipherTrust
 provides capabilities to secure and control access to databases, files, and containers – and can protect assets located in cloud, virtual, big data, and physical environments.

With CipherTrust, you can protect your company’s data and anonymize your sensitive assets, ensuring security for your company and avoiding future problems with data leakage.

Eval Professional Services has a team of specialized professionals with the best practices in the market

Benefit from our many years of experience and expertise in information security and compliance with LGPD (General Data Protection Law). We will be your partner for realizing digitization projects in compliance with security and data protection regulations.

We share our expertise across all business flows in healthcare organizations to help you minimize risk, maximize performance, and ensure the data protection your patients and partners expect.

About Eval

Eval has been developing projects in the financial, health, education, and industry segments for over 18 years. Since 2004, we have offered solutions for Authentication, Electronic and Digital Signature, and Data Protection. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With market recognized value, Eval’s solutions and services meet the highest regulatory standards for public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Where We Are

Rua Paulistânia, nº 381, 2º andar,
Sumarezinho
São Paulo - SP,
ZIP CODE: 05440-000

Contact

(11) 3670 - 3825
(11) 3865 - 1124
[email protected]

Facebook Instagram Linkedin
logo-tales-azul
keyfactor-logo
logo-valid-certificadora-digital
google-safe-browsing
Privacy Policy

Copyright © 2023, EVAL TECNOLOGIA EM INFORMÁTICA. All rights reserved - CNPJ 05.278.889/0001-97