[Autogenerated] you know, one of the questions we always asked.
Is this a big source of compromise?
I don't think so.
Code.
You know,
there was a very famous cardholder data breach from a data center where
people just walked up the data center and stole the servers.
But that was 10, 12 hours a while.
That was a while ago.
I think we've moved on quite and cloud based debts.
And you have no idea where your data is gonna be in in a date.
Center, right?
Often.
Yeah, right.
But what about ignoring the code a little bit?
What about other breaches of requirement nine that have
led to colonel the decent breaches?
So I don't know of particular cases,
but I think one of the major sort of risk areas would be like a contact center
where you have a heap of workstations handling payment cards,
right.
And if somebody can get into that space and attach
some sort of keystroke capture, you know,
device or deploy some malware on those workstations or
adversely affect that network traffic, right?
You know,
compromise that network device and then man in the middle of the traffic,
uh, that I think that that would be, you know,
a very significant possibility.
Yeah, I can read I can, you know,
relate to the fact that having seen compromised reports,
that's the sort of thing that typically have a USB
key loggers into contact center.
You don't have control over who is in the context
center is not in the contact center.
There's often a lot of like paper.
Leak is from contact centers where people are writing card numbers down,
which you're allowed to do.
By the way, the standard You know, I've seen some QoS.
Is that make contact centers like you can't write?
Cardinal first one doesn't say that anywhere in the stand,
Yeah, but that you need to dispose of it properly.
You can't leave it around forever.
Year.
You can't.
You can't, you know, not then have some meaningful sort of tread process for it.
Thinking about going to do an assessment of requirement nine.
What a sort of stand out points you're gonna be looking at.
So for many of my clients any more,
there's not really anything for me to do for requirement.
So it may be the case that you know there's not much or if there is it's a
contact center or its a series of retail locations Back office,
right?
Yeah, or yeah,
some increasingly unusual set of circumstances
where there is that kind of space.
Uh, but for for many of my like, sort of service provider clients that are,
uh, in some technology or sort of, you know,
fintech payment service, right?
They don't want their own data center.
They wanted in a cola or they want it in a cloud environment.
Um, so, yeah,
you have this increasing sort of split where there's either not much to
do or you have these kind of interesting corner cases or you have a
fleet of POS devices that you have to manage.
We're going to get first things first on second assessments,
any any stand out things where people just get it wrong.
On the second assessment, Um,
I have a few situations where maybe a client has moved
from one data center to another, right.
And then, you know, maybe neglected some steps along the way.
Um, you know, or or occasionally, um, you know,
if it's their own data center, if it's their own facility,
Um, you know, I have let some things fall down right where?
Oh, yeah, I guess we didn't keep CCTV footage for 90 days.
You check that.
I'm gonna go to I'm gonna go to 90 days, and I want to 90 days ago.
Show.
Right?
Yeah.
Show me the still image from 90 days ago with the time stamp on,
And then give me the JPEG or the PNG of that as a work paper.
Okay, I think that's wrapped up physical ability.
Um, and again, if you have, it's a thing.
I have no idea why, but some QoS NuGet really fixated about physical security.
Um,
maybe because they don't they don't do it all the time And like logical
security so that their risk thead goes out the window and they just they do
the black letter interpretation over interpret standard.
So if you get that, you know, talk to the USA,
look at the guidance column in the standard.
And if you're still struggling, get another QoS a from the same company.
Speak to try and get someone more senior,
because this is this is not a major source of risk and compromise.
But I've seen organizations be forced to spend thousands and thousands
of dollars on controls that they really didn't need,
uh, so that that's requirement nine.
Most of requirement mind wrapped up In the next module,
we look a special part of Requirement nine,
which requirement 9.9, which is the security of devices that read cards.