Today we are going to discuss DUKPT (Derived Unique Key Per Transaction). The DUKPT is created using an initial master key also known as the BDK. The initial key and KSN (Key Serial Number) are injected into the device. Once the initial key is injected into the device it creates a group of future encryption keys. DUKPT generates a one-time encryption key for each transaction from the secret master key (BDK). The one time keys are discarded after each transaction, and the encrypted data has to be decrypted at the other end of the transaction (at the gateway or processor). The master key is shared with the decrypting device, but the master key isn't actually used for encrypting and cant be recoverable from the one time encryption key. DUKPT is a great and useful tool to help keep your clients card information secure.Continue reading
Unattended Card Payments Inc. (UCP Inc.) is dedicated to providing EMV compliant Hardware and Payment Gateway solutions for Unattended card payment terminals in the North American market.
You might have noticed car charging stations recently in many garages or parking lots that you have been in. Electric cars are becoming more affordable, and providing a longer range between charges. The global EV charger market is expected to grow to more than 12.7 million units by 2020 according to the IHS. Auto manufacturers are constantly making new advancements. Porsche is working on technology now that will enable you to charge a vehicle up to 240 miles in just 15 minutes. This is a rapidly growing industry, and the charging stations are using EMV technology to collect payments. Interactive kiosks will play a large role in this new industry doing everything from collecting payments to displaying a business advertisement on the screen. ABB the world’s leading manufacturer of auto charging stations has implemented EMV technology into their charging stations already.
EMV smart chip technologies insure that the user’s financial data is more secure. The NFC (Near Field Communication) gives users extra security through their smart phone payment platform such as Apple Pay or Android Pay. A large portion of EV drivers are very into technology and this makes the experience more convenient for them. The OTI Trio is a perfect set up for this growing industry. The Trio has a small compact size and is a 3-IN-1 device that allows you to use the EMV chip, Mag stripe, and also NFC contactless payment methods. The Trio is also very durable and can be used indoors and outdoors. Unattended EMV technology has already become common place in retail, and restaurant settings but one of the next major industries to use this technology will be the EV charging stations!
For more information on the choices available to you please contact us!
Unattended Card Payments Inc.
Tel: (702) 802-3504
The Impact EMV Has On Kiosk Owners
As a kiosk owner you may be wondering what the impact of EMV will have on your kiosk business. To answer this we need to analyze what being EMV enabled means, and what will happen if you’re not upgraded. EMV (Europay Mastercard and Visa) is a global payment standard created by the major credit card brands. EMV uses the embedded microprocessor chip on your new credit card. This chip is replacing the old magnetic stripe as the means to convey your account information to a terminal. The mag-stripe cards are less secure, and the information on the mag-stripe can be easily retrieved and replicated. This leaves cardholders at risk for their account information being used to create cloned fraudulent cards.
EMV is technically a choice for merchants. With that being said, a merchant who has not implemented this technology will be liable for fraudulent mag-stripe transactions performed at their kiosks. The liability deadline was October 2015, but most experts don’t expect the majority of merchants to be upgraded for another 3-4 years. Last summer merchants handling low value transaction (under $25.00) were given a grace period for liability. This includes many kiosks and vending machines. When this grace period ends you need to make the upgrade to EMV. Card issuers will hold you liable for fraudulent credit card charges if your payment equipment is not EMV compliant.
Many businesses have experienced challenges while trying to implement EMV technology, and because of this credit card issuing companies have given businesses more time to comply. The credit card companies want to support merchants, and help reduce credit card fraud. Kiosk operators have been slower to comply with this than larger companies. Seventy-six percent of the 200 largest merchants are now able to accept cards with EMV chips. Don’t feel overwhelmed as a kiosk owner. Payment equipment manufacturers have created many EMV compliant devices, and there are many pre-certified software solutions available to integrate these devices to your kiosk’s application. The easiest way for businesses to begin the compliance process is to find a technology partner that they can trust.
For more information on the choices available to you please contact us!
Unattended Card Payments Inc.
Tel: (702) 802-3504Continue reading
Unattended Card Payments will be attending the National Retail Federation's annual Big Show at the Jacob Javits Center in New York. Will you be there? Contact us to schedule a meeting to discuss your self-service payment needs.
Unattended Card Payments Inc.
(702) 802-3504Continue reading
Unattended Card Payments Inc. earned a total of 83 points to come in second place in PYMNTS.com's Unattended Retail Tracker June 2016 report. The coveted number one position was earned by multinational hardware manufacturer Ingenico with a total score of 88. Congratulations to Ingenico and all the others who made the cut.
To learn more and download the report go click HERE.
6635 S. Tenaya Way Suite 100
Las Vegas, NV 89113Continue reading
ROSH PINA, ISRAEL and LAS VEGAS, NV -- (Marketwired) -- 05/11/16 -- On Track Innovations Ltd. (oti) (NASDAQ: OTIV), a global provider of near field communication (NFC) and cashless payment systems, has partnered with Unattended Card Payments (UCP), a Las Vegas-based provider of self-service payment solutions, to offer oti's SATURN 6500 TRIO readers and CONNECT 3000 telemetry controller as part of UCP's standard portfolio of products for the North American unattended payments market.
As an Independent Sales Organization (ISO), UCP specializes in unattended payment solutions across various market verticals, including the leading EMV-focused total solution provider in the North American self-service market.
oti's SATURN 6500 TRIO is an innovative modular reader that provides multiple payment options to the unattended market segments. TRIO can be installed modularly, allowing self-service operators a simple retrofitting option with a variety of configuration choices, including:
- Contactless only;
- Magnetic stripe only;
- Combined magnetic stripe and contactless;
- EMV contact only;
- EMV contact and contactless; and
- EMV contact, contactless and magnetic stripe (three-in-one).
"oti's innovative product line offers a comprehensive combination of certified-EMV solutions and reliable performance at a competitive price," said Rob Chilcoat, President of North American Operations of UCP. "This is particularly important for our customers because it allows them to quickly and affordably comply with EMV standards, while reducing their liability for fraudulent transactions. The multi-modal payment functionality also lets them capture the maximum amount of sales possible, as consumers transition from card to mobile payments."
Gonen Ziv, president of oti America, added: "Our partnership with UCP reaffirms the fact that our technology, functionality, and security in the payments industry is an ideal solution for many self-service operators. These benefits are the reason why many self-service solution providers continually turn to oti for our best in class product offerings. We look forward to working closely with UCP in furthering the reach of our EMV solutions in the American market."
UCP Inc. is dedicated to providing EMV compliant payments solutions for the self-service market in North America. For more information, visit www.ucp-inc.com.
On Track Innovations Ltd. (oti) is a leader in contactless and NFC applications based on its extensive patent and IP portfolio. oti's field-proven innovations have been deployed around the world to address NFC and other cashless payment solutions, petroleum payment and management, cashless parking fee collection systems and mass transit ticketing. oti markets and supports its solutions through a global network of regional offices and alliances. For more information, visit www.otiglobal.com.
President of N. American Operations
oti Investor Contact:
Scott Liolios or Matt Glover
Liolios Group, Inc.
oti Press Contact:
Director of Marketing
Source: On Track Innovations Ltd.
Getting Past the EMV Finish Line
If you concern yourself with the kiosk industry enough to read this article it probably isn’t the first time the terms “chip and pin” or “EMV” have come up in your workweek. In this write-up I hope to address some common misconceptions about EMV and how it effects kiosk manufacturers, ISOs, and kiosk business owner/operators. By the end you should have a good idea of what it takes for all of these groups to get their products past the “EMV capable” finish line.
It is not just the hardware:
EMV hardware manufacturers and distributors have spent the last few years focused on educating ISV/ISOs and hardware integrators that EMV is not just a matter of buying a new piece of hardware. A true solution is dependent on a marriage of hardware and software; and as marriages go it also entails a commitment. More on that to come…
EMV Level 1 means that a device physically meets EMV specifications for chip (contact), and in some cases NFC (contactless).
EMV Level 2 means that the firmware on a device performs to EMV processing specifications.
Both EMV Level 1 and Level 2 are the responsibility of terminal manufacturers. This hardware can be described as “EMV ready.”
Level 3 is achieved when a developer marries a device meeting the aforementioned Level 1 and 2 EMV specifications with their software, and commits to certifying it with a processor or processors, and then the card brands. This fully developed and certified solution can be described as “EMV capable.”
The cost and level of commitment:
The cost of this commitment can definitely set you back more than a designer engagement ring, depending on the ring of course. The cost and level of commitment varies greatly depending on the developer’s goals.
A developer can choose to pursue a direct certification with a processor (fully integrated) or decide to use a payment gateway which has already made a commitment to certifying a piece of hardware with a processor(s) (semi-integrated).
Fully integrated vs. semi-integrated:
A fully integrated approach to EMV is a time consuming a very costly endeavor and the end solution is fully within PCI scope. Historically speaking a fully integrated solution can easily take 8 to 12 months to develop and certify. The cost will be well over $100K all-in considering time, tools, and certification testing. Then rinse and repeat for each processor you want to certify with.
A semi-integrated approach allows you to leverage the commitment of another company to complete your solution in a matter of weeks, and at an enormously reduced cost. In addition to the cost factor a semi-integrated solution also allows you to piggyback on your gateway partner’s PCI-DSS compliance. A semi-integrated approach eliminates your need for full-blown PCI and EMV evaluation. In most cases semi-integrated system architecture will allow for a PCI Self Assessment Questionnaire (SAQ) to obtain your attestation of compliance.
RIVERWOODS, Ill. & NEW YORK--(BUSINESS WIRE)--Creditcall, a payment gateway provider and EMV migration specialist, and Diners Club International, a business unit of Discover Financial Services and part of the Discover Global Network have announced a signed agreement that will expand the acceptance of Discover and Diners Club cards worldwide.
“This agreement will increase the number of merchants that card members have access to in over 30 countries.”
This agreement is part of Discover Global Network’s overall strategy to partner with key payment solution providers, such as Creditcall, to help drive increased Discover and Diners Club card acceptance. The agreement also means that Creditcall will, as standard, certify new solutions for Discover across future processor certifications, widening the reach of card acceptance for both parties. Creditcall is a leader in a number of sectors – from transportation ticketing and parking to vending, retail and hospitality. Some of the largest UK transit system providers - such as Atos and Cubic, already use Creditcall’s payment gateway.
“Working with Creditcall is an important step in securing card acceptance at merchants around the globe,” said Gerry Wagner, vice president, Discover Global Network. “This agreement will increase the number of merchants that card members have access to in over 30 countries.”
Discover Global Network is the third largest payments network in the world and the largest merchant acceptance network in Asia-Pacific. With more than 30 million merchant acceptance locations and one million ATM and cash access locations across 185 countries and territories, Discover Global Network includes Discover, Diners Club International, PULSE and affiliated networks.
Creditcall’s range of payment solutions includes in-store, online and mobile card payment acceptance as well as products to simplify and speed up EMV migration, helping countries transition from magnetic stripe card acceptance to the Chip and PIN. Creditcall works across a range of industries where secure, reliable and trusted payment capabilities are essential, including parking, vending, transportation, hospitality and retail.
“Creditcall is pleased to be strengthening its relationship with Discover through this joint initiative which benefits Creditcall’s past, present and future customers, giving them a wider, enhanced offering,” said Sian Bosley, commercial director of Creditcall. “We look forward to working closely with Discover to help expand their card acceptance across Europe. This is a great example of a leading card scheme recognizing that Creditcall is a global leader in the payments industry and can contribute to their success.”
About Creditcall Limited
Creditcall makes card acceptance simple from any device, anywhere. No matter if in retail, hospitality, parking or transportation, our award-winning EMV-ready Payment Gateway and EMV Kernels are at the very heart of our clients’ business. Whether in-store, online or mobile, we ensure payments flow securely, all day, every day.
Unattended Card Payments
"EMV kiosk hardware"
"chip and pin kiosk hardware"
Link to original content: http://www.businesswire.com/news/home/20150728005138/en/Discover-Global-Network-Partners-Creditcall-Corporation-Expand#.VbfxTWCslPQContinue reading
I found myself writing this rather lengthy answer to a question posed by a potential client and thought I should share it.
Because this was originally written as an email, please accept it as more of a discussion, and less of a formal piece of writing. Nevertheless, I hope you find it informative.
Unattended Card Payments Inc.
Las Vegas, NV
"EMV kiosk hardware"
With just four months left until the October 1 liability shift, it’s imperative to help your clients make informed decisions about EMV technology now.
To give VARs some perspective on SMBs’ progress in the transition to EMV-enabled payment technology before the Oct. 1, 2015, liability shift date, BSMinfo.com reported the results of the survey, SMB Preparedness for the Transition to Chip-Based Credit Cards, by Software Advice, a research and reviews website for IT security software. The survey revealed that as of late last year, only 11 percent of SMB merchants had terminals capable of accepting EMV payments made with integrated circuit or “chip” cards to authenticate transactions. The report also included the reasons SMBs hadn’t yet installed EMV terminals: 30 percent said they are unnecessary, 17 percent said they are too expensive, 16 percent said they had no time to research or implement them — and 26 percent said they didn’t know what they are.
At the time the survey was released, there were about 10 months until the October 1 liability shift — when liability for fraudulent payment card transactions shifts to the party with the least EMV-compliant technology. Now, with only a little more than 100 days until that date, your SMB merchant clients might still be in the dark about this impending change.
Business Solutions asked VARs if they’ve seen progress among their SMB clients since the survey — or if 26 percent are still unaware of EMV.
“It’s worse. It’s more like 80 percent here,” says Bob Medina, the owner of Aztec Eagle Systems, a Lawton, OK, VAR. To help change that, Medina provides his SMB clients and prospects with informational handouts and lists of online resources related to EMV. He explains, “If they don’t make the transition, they leave themselves open to fraud with noncompliant devices. Merchants do not understand that the onus is on them if they continue to use noncompliant devices.”
Paul Leduc, president of Globe POS Systems, based in Brampton, Ontario, says he executed a similar strategy prior to the liability shift in Canada in 2011. Of all of the information available to merchants, he boiled it down to two basic points: the liability shift and the security aspects of EMV. “I had a two-page synopsis. I carried it with me, and I left it behind. It’s really all the merchant cared about: the liability shift and security.”
When your conversations with SMBs progress from the liability shift and security to purchasing EMV technology, it’s beneficial to continue to educate your clients. Rob Chilcoat, president of North American operations for Unattended Card Payments, a hardware and payment gateway solutions provider, says, “I find the best way to present value is to explain that these sophisticated pieces of hardware have processors and intelligence of their own, unlike the simple mag stripe readers most automated retailers are used to — which typically just do simple keyboard emulation of the data on the magnetic stripe. EMV terminals, using an application hosted locally on the devices along with encryption keys, secure data at the point of interaction, and send it to the gateway/processor through a secure connection, which is why we call them terminals and not just ‘readers.’”
With merchants aiming to provide the best customer experience to stay competitive, you can also explain to SMBs how EMV technology can contribute to a positive experience by protecting consumers’ payment cards — and their accounts. Chip cards create a unique transaction code — so if data were stolen, a payment attempted with that one-time code would be denied, and the cards can’t be duplicated.
In addition, says Chilcoat, “With a chip card, the issuing bank can send updates to the card through any EMV-capable terminal. So if a potential breach of that card’s account number had occurred elsewhere, the next time the card is put into a terminal, it can have security updates sent to the chip. The card becomes an active part of monitoring the account for suspicious activity.” For example, if a chip card is used repeatedly in a short period of time at a kiosk that doesn’t require online authorization, the chip can tell the terminal not to accept the next transaction without online approval.
For merchants, having EMV-enabled systems protects them from chargebacks for fraudulent card transactions. Your conversation with an SMB merchant could evolve into a math exercise of how many fraudulent transactions they experience now and how that compares to the cost of upgrading their payment systems. That calculation, however, might not be a good predictor of ROI for some merchants who could see an uptick in fraud after October 1 if they don’t install EMV-compliant solutions.
Patty Walters, SVP of EMV corporate strategy for Vantiv and vice chair of the 2015-16 EMV Migration Forum Steering Committee, urges, “If you serve retail, supermarket, fuel, or drugstore merchants, understand that EMV integration is absolutely critical to protect them.” She explains those merchants — selling gift cards, electronics, or jewelry — will be targets of fraud if they do not have EMV-enabled systems after the transition.
Chris Martyniuk, CTO of etixnow, a provider of e-ticketing solutions, based in Edmonton, Alberta, Canada, adds that beyond saving the cost of chargebacks, you should discuss the other ways EMV can protect your merchant clients. “You cannot put a price on the ability to escape being blamed for fraudulent purchases. The returns are immediate. Reputations are fragile — no merchant can afford to be in that position,” he says.
“When the landscape is split between merchants who accept EMV and those who don’t, customers will gravitate toward those that are perceived to be more secure,” Martyniuk comments. He says, for example, now that Canadian consumers are accustomed to EMV transactions at restaurants with wireless tableside terminals, they “are loath to let their Visas out of their hands in American restaurants, when the server takes the card to swipe.”
“Losing sight of your card feels instantly like, ‘It will be stolen. I will be defrauded.’ The same trend will take hold in the U.S., and merchants without EMV upgrades will be left on the side of mistrust,” Martyniuk says.
Walters stresses that however you want to carry out the EMV conversation with your SMB clients and prospects, definitely and with urgency, start it. “There is absolutely a real need for merchants to protect themselves, and time is of the essence.”
She adds you might not only be helping your clients protect their businesses, but you could be protecting your own: “If a merchant’s legacy solutions provider doesn’t provide EMV solutions, they could reach out to someone else — and that could be a risk to your business.”
LINK TO ORIGINAL CONTENT: http://www.bsminfo.com/doc/why-you-need-to-talk-to-smb-merchants-about-emv-today-0001?atc~c=771%20s%3D773%20r%3D001%20l%3DaContinue reading
In this blog I will outline the steps an EMV card present transaction goes through from start to finish. This excellent infographic does a great job of illustrating all of the steps card issuers and processors have put in place to help fight fraud. Enjoy!
Step 1: Transaction initiated by point-of-sale. This can be done by way of an attendant or by a user at an unattended self-service kiosk.
Step 2: Card inserted into PIN entry device or PED. This is done by the customer at the register or user of the kiosk.
Step 3: Card application is selected. EMV cards can run multiple applications due to the development of a common EMV application identifier (AID) to support routing between the credit and debit networks, as well as PIN and signature networks.
Step 4: Offline card check. This step is used to validate that the card being used is a genuine card.
Step 5: Card holder verification. In a chip and PIN environment the user enters a PIN to authenticate their identity.
Step 6: Terminal decision. Based on the type of terminal, the installation scenario, and the value of the transaction, the terminal decides if the transaction can be completed offline, or if online authorization with the bank is required.
Step 7: Card decision. In EMV the card ultimately decides whether the transaction should go online or not. It can override the terminals previous decision. Chip cards are active in their own monitoring and can require an online transaction or a PIN entry if it determines that it has been used in a suspicious manner recently.
Step 8: If the transaction goes online a ARQC is generated which is a cryptogram that acts as a digital signature of the authorization request.
Step 9: The processor and acquirer ensures that the encrypted information makes it all the way to the card issuer.
Step 10: The ARQC is verified by the issuer and a risk evaluation is preformed on the transaction.
Step 11: If approved the issuer generates a APRC, which is an encrypted authorization response.
Step 12: The decision from step 11 is passed all the way back to the terminal and informs it of the decision from the issuer; authorize or decline.
Step 13: At this point any updates the issuer sent along with its decision can be written to the chip negating the need for issuers to send out new cards when updates are needed as previously done with magnetic stripe technology.
Step 14: The user removes the card from the reader and the decision is passed back to the POS or self-service kiosk.
Step 15: The transaction is complete!
Rob Chilcoat "Chip & PIN kiosk hardware"
Unattended Card Payments Inc.
(702) 802-3504 TelContinue reading
Security Concerns Will Dominate Payments Space In 2015
Ingenico Group works closely with merchants of all sizes in the U.S., and one of the most frequent questions we get from reseller and managed services partners is, “What is the key concern among your merchant customers that we need to address?”
Without a doubt, that key concern is preventing breaches and protecting consumers’ card data.
There were a multitude of large, well-publicized card data breaches in 2014. Some of that may be the natural consequence of the U.S. being the last developed country in the world relying on mag stripe technology. With the impending October 2015 EMV liability shift coming, at long last U.S. merchants are upgrading their payment infrastructure for chip cards, and that may help stem the tide of card reproduction fraud. But merchants are still very concerned, and are looking to ensure that they’re doing everything they can to protect customers’ data and their own reputations.
Stage Stores is one such merchant. This leading neighborhood retailer delivers brand-name family apparel in 40 states across the U.S. The company has implemented point-to-point encryption (P2PE) for its almost 900 stores. Now customers shopping at Stage Stores’ five brands (Bealls, Goody’s, Palais Royal, Peebles and Stage) will conduct their payment transactions on Ingenico terminals that encrypt from the moment the transaction enters the terminal. Stage Stores CIO Steven Hunter says that securing customers’ information is the company’s #1 priority in 2015.
P2PE and tokenization are the best weapons a merchant has against card fraud. P2PE is about protecting data in flight, and tokenization is about protecting data at rest. Every merchant needs P2PE; most (but not all) need tokenization. We believe that virtually all Tier 1 and 2 merchants will have implemented one or both by the end of 2015. Here’s why:
P2PE: Although chip cards make card cloning very difficult, they do not immediately address card data in flight. P2PE is a security solution that helps protect card data while in transit to the merchant’s processor. In a P2PE environment, card data is encrypted at the point of entry so that raw card data is never exposed to internal systems or legible to would-be criminals. It is not decrypted until it reaches the point of processing. When implemented properly, P2PE can help merchants reduce their PCI DSS scope but more importantly it reduces overall risk — which is why it’s so effective.
A simple concept, yet many merchants did not consider implementing P2PE until recently — when bad publicity over card breaches made it dangerous to ignore. It is also a good insertion point for P2PE as many retailers are analyzing their POS systems and terminals in preparation for EMV acceptance.
Tokenization: In the payments world, tokenization is a solution that replaces a customer’s debit or credit card number with a surrogate value (called a token). The token is returned post authorization by the merchant’s payment processor or transaction service provider. Tokens eliminate the need for merchants to store customer card data in their own systems. Many merchants rely on this data for legitimate business reasons like recurring billing and automated returns, but do not want the risk of stored card data as a consequence. Instead, unique tokens are stored and used in place of a card number to process subsequent transactions. Thus, in the event of a merchant data breach, criminals are not able to access actual card data — just encrypted tokens that are meaningless to any entity except the original card processor.
Tokenization has gained interest recently due to its use in Apple Pay as a security feature that substitutes your actual card number in the iPhone with a token that is used when you present a payment. While many are under the impression that Apple invented tokenization, this is not so. Tokenization has been used in the electronic payment and e-commerce worlds for many years. Apple Pay has brought attention to tokenization, which we believe is a good thing, because now both merchants and cardholders are asking about it.
Most payment solutions vendors and processors offer some flavor of P2PE and/or tokenization, making it easy for you to add them to your portfolio. Look for solutions that are already proven in the field and certified for EMV Level 1 & 2 and PCI PTS 3.0 or higher.
Merchants are actively looking for these technologies — in fact they shouldn’t seriously consider a payment solution that doesn’t incorporate the latest security features. That means resellers and managed service providers need to ensure they can provide it.
Thierry Denis is President of Ingenico North America. He has 20+ years’ experience in the payments technology space. At Ingenico Group, he works closely with merchants, processors and acquirers to help them implement secure and seamless end-to-end payment solutions.
Link to original content: http://www.bsminfo.com/doc/security-concerns-will-dominate-payments-space-in-0001
How Using an EMV Payment Gateway Saves Time and Money
UCP Inc. will be attending the 104th Annual National Retail Federation's "Big Show” as a Value Added Reseller of the Ingenico iSelf product line. We will be in the Ingenico Group booth (#1743). Come by the booth for information on the latest in attended and unattended EMV compliant payment hardware. Let us be your EMV experts and guide you through the complexity of readying your self-service solution before the coming 2015 EMV liability shift. We can offer comprehensive consulting on the hardware and software solutions that best meet your requirements. We can help you reduce the time and cost associated with migrating your solution from traditional magnetic stripe transaction processing to the future of EMV smart card and mobile payment acceptance at self-service kiosks.
Last night on 60 Minutes there was a segment on credit card fraud in America. The news segment included interviews with some interesting industry professionals. The first interview was with Dave Dewalt, CEO of FireEye. Mr. Dewalt said that 97% of companies experience security breaches. I don’t believe that the security breaches Mr. Dewalt is talking about in this statistic are solely financial in nature. However it does make one stop and think about securing card holder data. Breaches of this variety cary penalties in the millions, and also represents a significant financial burden to card issuing banks as well. Mr. Dewalt also confirms a statement by the interviewer, Bill Whitaker, that the average time between infection and detection of malicious software on company networks is 229 days! FireEye is an interesting cyber security company worth checking out; if even only for the live Cyber Threat Map on their homepage. (www.fireeye.com)