Breakout Session
summary
PCI DSS v3.1 (April 2015) demands concrete controls: require TLS 1.2, ban trust authentication and open 5432, use AES per-column encryption with solid key management (human-in-the-loop on reboot), log everything, enforce two-factor and 15‑minute idle timeouts, and never keep PANs or CVVs in backups. Note specific tool notes: use stunnel with PgBouncer, PGcrypto for DB-side crypto but prefer encrypt in the application, prefer tokenization (Stripe) to avoid scope, and remember full-disk encryption is useless and can't store CVV.
AI-written summary · about
chapters (14)
- 0:00Intro
- 2:35What does it mean to "comply"?
- 10:14Security Policies.
- 17:15FDE protects you against exactly one problem... .... theft of the media.
- 24:55What's wrong with this schema?
- 26:41Encrypt Data in Flight. • "Encrypt transmission of cardholder data across open, public networks."
- 28:10Protect Against Malware.
- 29:49Requirement 6.5.1: SQL Injection Attacks.
- 31:00Restrict Data by Need-to-know.
- 32:29Passwords, yur doin it rong.
- 34:01Two-Factor Authentication is now required!
- 38:47Write That Down. • Maintain a policy that addresses
- 39:18Appendix B: The Bargaining Stage of Grief
- 40:22This is not a Get-Out-of- Jail-Free Card. • If you don't need an external auditor, it's between you, your conscience, and your Errors and Omissions insurance provider.
related talks
28mKeeping the Bank Happy: PCI DSS v4
32mSecurity horror stories in payments
48mPCI DSS 4.0: Evolution, Revolution, or an Omen of Extinction?
34mThe Path of Secure Digital Identity
50mSecuring PostgreSQL
42mSecurity, Fraud, and Compliance Panel
59mA Journey to Protect Points-of-Sale
23mPoint of Sale System Architecture and Security