Reverse Engineering Compliance
summary
Applies classic reverse engineering (GDB and assembler dumps from past work) to the PCI DSS v3.2.1 rulebook, mapping its 139 pages of requirements into a concrete threat model that separates process vs technology failures, ties specific controls (e.g., 1.15, 3.1) to information‑disclosure and process‑decay threats, and uses the four questions + STRIDE to prioritize fixes. Publishes a white paper with the model, exposes rule gaps, and shows how sharing threat models can reduce audit conflict and enable alternative compliant solutions.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:43Agenda
- 2:04Reverse Engineering
- 2:18What is Reverse Engineering
- 3:39Reverse Engineering is Powerful
- 4:03Compliance Systems
- 8:00Stride
- 8:59Threat Modeling
- 9:12PCI
- 12:51Why
- 17:35PCI Model
- 22:06Reverse Engineering Analysis
- 23:23Why Reverse Engineering
- 27:03Threat Modelling
- 30:08Questions
related talks
40mUsing Threat Modeling to Improve Compliance
47mTechniques to Evolve Risk Governance and Comply with SEC Cybersecurity Rule
48mPCI DSS 4.0: Evolution, Revolution, or an Omen of Extinction?
37mHow To Approach InfoSec Like a Fed(eral Auditor)
22mEmpowering Developers through Threat Modeling Excellence
18mProving RISC-V Security Model Compliance with SESIP
42mFrom Devops to DevSecOps
32mIntroduction to CDD and Security Centric System Design