What we know, written down
Knowledge Base
Opinions from the assessment table and the incident room, not summaries of the standard. Bylined and reviewed by our QSAs.
PCI DSS
9 articles
Start here
7 min read
Payment-page scripts: what 6.4.3 and 11.6.1 ask, and what SAQ A still owes
Two PCI DSS requirements now protect the page where the card is typed, as the browser receives it. What each one actually asks, which mechanisms answer which part, why monitoring your server does not count, and what an SAQ A merchant still owes once the payment provider has confirmed its iframe.
5 min read
Compensating controls, refused and accepted
We rarely write a formal compensating control, and we refuse most of the substitutes we are offered. Four refusals, two acceptances, and one we reframed, to show where the line actually sits.
3 min read
The document said so. The room disagreed.
A retention policy that the database contradicted. A data centre whose staffed reception was empty. A platform assessed before it ran. Three reasons we run the query, visit the site and ask to see the thing working.
4 min read
When your payment provider cuts you off
Three online shops, all legitimately on SAQ A, all skimmed. The provider sees transactions drop, suspends card payments and sends the merchant to a QSA. What happens next, and why an upgrade is usually the whole fix.
4 min read
Where the standard isn't clear-cut: requirement 3.4.2
Administrators reach card-data databases over SSH, and the standard says they must not be able to copy card numbers out, unless they are authorised. We have used that exception, and we are not comfortable with it. Here is our reasoning, and where we are unsure.
5 min read
Your provider's AOC is not your compliance
An Attestation of Compliance that covers every call centre except yours. An acquirer whose AOC excludes the terminals it leases you. A request for "an AOC for the vendor's domain". Why the annual AOC chase goes wrong, and what to check instead.
3 min read
The findings we raise most often, and what closes each
Twelve findings from real assessments, none of them exotic. For each one, what it looks like in the room and the one thing that closes it.
4 min read
PCI DSS scoping: in, connected, or out
Every system in your estate is in one of three places. Most scoping mistakes come from treating "does not carry card data" as if it meant "out of scope", and from writing the scope by component type instead of by system.
4 min read
Choosing the right SAQ
Ask two questions before you pick a questionnaire. In what capacity do you handle the payment, and what actually touches the card? Four engagements where the obvious answer was the wrong one, in both directions.
Compliance Operations
4 articles
Start here
5 min read
Preparing for a PCI PIN assessment
PCI PIN is not PCI DSS with different numbering. It is a standard about keys, the hardware they live in and the people who touch them, and the evidence is mostly physical. What a Qualified PIN Assessor will ask to see, what to have ready, and what is new now that the Council lists PIN service providers.
3 min read
How to file evidence so it gets reviewed in minutes
Six rules from our review notes on a first Report on Compliance. When a slot holds the right kind of file, we review it in minutes. When it does not, we open it only to rule it out, and the assessment slows for both of us.
3 min read
Audit-ready is a state: the PCI DSS calendar
The assessment looks at the last twelve months, not at the last six weeks. The organisations that find it calm are the ones with a calendar of every periodic requirement, an owner per line, and a record produced each time. Here is the calendar.
3 min read
Ask once: an evidence process that runs all year
One firewall export serves four requirements. One review record serves three. The evidence process that turns the yearly scramble into a routine is mostly a matter of linking each piece of evidence to everything it proves, and giving it an owner and a date.
Security Testing
3 articles
Start here
4 min read
A segmentation test from one jumpbox is not a segmentation test
Segmentation takes networks out of scope, so the test that proves it carries the whole assessment. Three ways we have seen it fail, and one ending where it was not our call.
3 min read
Segmentation testing, explained
Segmentation only reduces scope if a test proves it. What PCI DSS asks for, how often, from where, what the report has to say, and the cloud details that most tests miss.
3 min read
Penetration testing and PCI DSS: what the standard actually asks
Internal and external, network and application, once a year and after significant change, with exploitable findings fixed and re-tested. How it differs from the quarterly scan, how we scope and deliver it, and how an assessor reads the report.
Automation
1 article
Security in practice
9 articles
Start here
6 min read
Strong customer authentication, possession and device binding
Under PSD2 the "possession" factor is the one most teams get wrong. A phone number is not possession. A key file is not possession. A key that cannot leave the device is. What the regulatory standards ask for, how to bind a device so it counts, and the enrolment mistakes that lock real customers out.
3 min read
Evidence beats assertions
"IT says it's patched." A screenshot of a cover page. "We consider that no data was affected." Customers, regulators and assessors all ask for the same thing, and it is none of these.
3 min read
Reaction time without buying a SOC
A manufacturing group went from email alerts read in office hours to a round-the-clock triage desk in three months, without a managed security operations centre. We helped specify it; the group ran it. What to monitor first, who does what, and what the desk cannot do.
3 min read
Scope and inventory come first
Nothing can be assessed or protected until you know what is in scope. Three engagements, three different ways to get that wrong.
5 min read
Security is a governance decision
The turning point in a two-year security programme was not a product. It was the day risk decisions moved to the executive committee. Why most open findings are about ownership, not technology.
3 min read
Selling cyber hygiene to an executive committee
A business case for group-wide vulnerability management, written in four plain verbs, with site IT directors speaking for the tool instead of the CISO. It was approved. Two months later the attack it predicted arrived. What the case got right, and what it could not do alone.
4 min read
The control is not the tool
A signed token is not possession. A scanner is not vulnerability management. A web application firewall is not a patched website. Three times a technology was mistaken for the outcome it was meant to deliver.
3 min read
When the assessor was wrong
Our own quality review has overturned our determinations. Our scoping notes have opened with corrections to ourselves. A vendor has been right where we were not. How we handle being challenged, and why it is what gives the rest weight.
3 min read
Your backups are only as good as your last restore test
After a ransomware attack, a manufacturing group reviewed the backups of its most critical system at every plant. Most restored fully. One site lost its archives because the archive server had never been backed up. What the review found, and the three habits it argues for.