Keeping the Bank Happy: PCI DSS v4

on YouTube ↗28m

" summary

PCI DSS v4.0.1 (released March this year) requires concrete controls: annual internal and external penetration tests, ASV scans (Qualys or equivalent), continuous log monitoring, mandatory MFA and EDR, and vulnerability management that addresses all severities. Practical advice: avoid storing PANs, segment and encrypt anything you keep, scan code with ZAP and OpenVAS in CI/CD, and treat cloud as a shared responsibility. A redirect to WindCave can still hit the merchant and breaches cost an estimated $40 billion globally in 2023; merchants processing over 6 million transactions face full audits.

AI-written summary · about

" chapters (10)

1. 0:00PCI DSS introduction
2. 3:12Why PCI DSS matters
3. 7:12Credit card fraud impact
4. 10:04PCI DSS terms explained
5. 13:35PCI DSS v4 changes
6. 16:25Six PCI focus areas
7. 19:56Secure coding for PCI
8. 23:01PCI compliance levels
9. 25:07PCI DSS benefits
10. 27:14PCI compliance resources

" related talks

• 47mBreakout SessionChristophe Pettus · PGConf Silicon Valley 2015
• 48mPCI DSS 4.0: Evolution, Revolution, or an Omen of Extinction?John Elliott · RSAC 2022
• 32mSecurity horror stories in paymentsAbhay Rana · 50p 2017
• 42mSecurity, Fraud, and Compliance PanelPAYMENTSfn 2019
• 06mLightning Talk: PCI DSS andEliot Cohen · PAYMENTSfn 2019
• 41mPerspectives on the transition to PQC in the financial sectorJaime Gómez García · Post-Quantum Cryptography Conference Austin 2025
• 47mKey Trends in the Shifting Threats to Payments as Blended Commerce ReturnsMichael Jabbara · RSA Conference 2023
• 33mPKI PKI and PQC Strategy for Payment Card IndustryJeremy King · Post-Quantum Cryptography Conference Amsterdam 2023