[Autogenerated] so having looked at the theoretical
requirements of requirement 9.9 and actually,
why?
Why that came into the standard.
Quite recently,
Jake and I are going to talk about the things that go wrong with it.
But But first of all, I wanna tell you a really funny story.
So I used to be a card brand very often.
The car brand is almost the final call of a desperate merchant
when they're having an argument with the USA.
Certainly for very large merchants,
I used to try to have a relationship with A with a
very large merchants in your app.
I got this call that said, uh, John Up hope you can help me.
It's like Yeah, sure.
What's the problem?
He said, Mike, you say I was like, Oh, gosh, okay, okay, What's the problem?
Said Well, requirement 9.9.
It says Any physical devices that read cardholder data and we
keep in every single one of our stores.
A couple of the zips up on the knuckle busters.
Yeah, the ones that used to do an imprint physical imprint machine on our QoS.
A saying is saying That's the device that physically reads the card.
And so we have to do requirement 9.9 for all of those devices and like,
Well, no, that's not the intent of the standard way.
We're trying very clearly to say physical contact with the car
because way had to find a form of words and said,
Well, they put them in.
So if you ever if you ever have a que SE that says that there is
actually an F A Q now on the on the council's website,
let me just switch to it.
That actually addresses that question.
So there is an F a Q that says our manual imprinted in
scope for PC IDE AD CS requirements.
The answer is no, they're not.
They're not.
There's an f a Q could now point at your QoS a.
If they bring it into scope,
it would also be to me a really good indication that you've got the wrong USA.
Maybe so,
because you know that's not a risk that the paper that it creates
is a paper record that you have to contend with,
but the actual imprint device itself.
Not so much.
I don't if you noticed,
but recently I've been getting cut issued with no embossing on,
so they wouldn't even work on integrated device.
So I think you know these error going away.
In fact, in five years time,
people watching these training course will wonder what the heck exactly.
Okay, so, yeah.
So let's move on to stuff that's really important then,
which is the the requirement 9.9 itself applies to
anything that physically reads the card.
Apart from zips up machines, it's a new requirement.
So eso Ubuntu assessing is what about three years to three year votes.
Okay.
What?
What are the problems with this?
You know, how hard is it for organizations to implement?
It can be very challenging if you've got a big sort of fleet of devices,
uh, spread over a large geography.
Uh,
the way the standard is written is you want some sort of inspection procedure,
right.
Let's go.
Make sure the device hasn't been tampered with.
Hasn't been substituted.
Uh, you know, there's no extraneous cabling eso So the goal is help.
People understand whoever's doing that inspection,
what it is they're looking for either.
You know what?
What might be hostile right or what a good one looks like,
so you could look for variances, right?
Are there stickers in places that there shouldn't be?
Are the cables are the things that fixed to the cables right, Is it You know it.
And I think you could You could build a pretty good process for that if you can,
you know,
manage the number of devices that you've got and and
produce sort of useful training.
I mean,
I would even be satisfied would be very pleased with an
organization where the store manager or the whoever was doing
it just took a couple of photographs whether with their mobile
device and then sent those to, you know,
a particular email Dropbox or something like that.
Where then somebody could go look at him and say,
Yeah, that looks right, right or no, Go take another one.
Because I need to see this angle or just whatever the outcome is right.
That could be a very effective way of doing this,
you know, over a good distributed sort of geography.
But if you insist on having like some team of experts,
that has to, like, go to all of your locals.
That's gonna get rough very quickly and that wasn't
the intent of the requirement, right?
We have a lot of problems, especially in your app with swapped out devices,
because as soon as we move to chip and pin,
it wasn't a matter of just getting a skimmer on the side of it.
It was people actually swapping devices out,
and some of them were very sophisticated.
You almost had to way the device to work out,
which was the one that was tampered in the US You had lots and lots of
skimming problems with people putting skimmers onto devices.
So the only way of doing it, uh, on part,
that's about re engineering the devices to make it harder
to do that which which which was just, you know,
has continued to happen.
But this thing of like, Well, actually,
the only way you could really do it is by a visual check.
It wasn't meant there was a whole team of people going around.
It was meant that the start,
the day the store manager or the person who actually was just
working on the retail counter at the time,
you know, had a had a picture of what it's supposed to look like,
looked at it and went yet?
Yeah, we know.
We knew that that would not catch every single compromise.
We would have caught a heck of a lot of them.
Funny.
Yeah, plenty.
And I've gotten pushback from some of my retail clients who say we can't
burden the store managers with more tasks they already have enough to do at
the start of the day or at the end of the day,
to sort of get things going or close it down,
Um or or I have store managers say, Yeah,
well, you know,
we have all these like mobile devices that we having a locker and we,
you know, hand them out.
At the end of the day, I count him up.
Did I have the same numbers when I started?
And I said, Well, did you check the serial numbers?
Do you have the same set, right?
Or has somebody swapped them out?
And they look at you like, Oh, I never thought of that.
That's the thing that that has absolutely exactly what criminals do.
They steal them from one place, modify them and put them back in another.
Another place.
When I was working in the car brands.
That was a very common thing that we saw people not very common,
but you didn't do.
I'm really surprised that that's happened right enough that well.
And I think I think a lot of people that aren't sort of
conversant with this sort of attack maybe don't understand
how slick some of them are, right.
And if you want to get a sense of how slick some of these all right,
I'd say two things.
One going obviously read Brian Krebs website Krebs on security dot com,
where he will show you with often very good photographs like how tiny,
how slick some of the skimming devices are that get
inserted in to fuel pumps with, like or,
uh, you know, there.
There's some YouTube videos of like CCTV footage in a
convenience store of the criminals,
like the one person distracting the clerk to get some cigarettes and
the other criminal just swift single motion putting an overlay on
the pos device in a matter of moments.
And if you you know, hadn't seen it from the vantage of that CCTV voted,
you would have no idea.
Absolutely.
And actually, I've used that CCG TLS, Azure training courses.
It's on YouTube.
YouTube.
Yeah.
Go, go.
You search YouTube for for, you know,
skimmer overlay or similar terms and find it because they're really,
really slick.
Absolutely.