Let’s begin with the relevant links: Three Alleged Hackers Indicted in Large Identity-Theft Case – Washington Post The actual text of the indictment There a few items of interest in the indictment worth noting.

I spend a fair amount of time discussing security and compliance. In particular, surrounding the details of achieving PCI and PA-DSS. But, more broadly, that compliance is an outcome of a risk-based approach to security. In these discussions, I’ve noticed 2 common questions, or perhaps, concerns that arise: Why should a merchant or software company [...]

Synchronicity is, quite possibly, one of my favourite albums ever produced. It is also, according to wikipedia: two or more events which are causally unrelated occurring together in a meaningful manner. I experienced just such a series of events today. During an internal meeting, there was a discussion of the PCI compliance obligations surrounding the [...]

At present, I’m sitting (somewhat cramped) on a flight for a partner meeting tomorrow…typically, I travel with one carrier (United) as it makes managing the Frequent Flyer programmes substantively easier (and of greater benefit to me*). For this flight, however, the cost difference and flight time indicated that it would be best to travel via [...]

I have heard from many of the folk I interact with frequently (security folk, payments folk, developer folk, other folk) regarding the newly rumoured processor breach. Many have asked if I have any information…or know something that others may not. Quite simply, no. I don’t sit on any task forces or interact with folk that [...]