Hi.
I'm John Elliott, and today,
I'm here to talk about something that I hope never happens to you,
a data breach.
So, I'm here with Aaron.
I'm a data protection specialist.
In my time I've been a PCI Qualified Security Assessor.
I've worked for the card brands, and when I was doing that,
I was in the really fortunate position of being the representative on
the Payment Card Industry Security Standards Council,
which means that I contributed to many of the PCI standards,
to PCI DSS, PA-DSS, and the point-to-point encryption standard.
So I'm here with Aaron.
Aaron's a PCI Forensic Investigator.
Tell me a little about yourself.
Well, I started in PCI forensics about 10 years ago.
I work for a company called SecurityMetrics outside of Salt Lake City.
I've investigated over 100 data breaches,
some from the biggest cases that you've heard of on the news,
many that you've never heard of.
I also teach forensic courses at Utah Valley University,
taught programming courses there for a number of years,
and have a background in data analytics.
Brilliant.
So, I said you're a PCI Forensic Investigator, or PFI.
Well, what does that mean?
Do you have a badge?
I've got lots of badges, but mainly they come from DEF CON and Boy Scouts.
But the badges I have aren't ones that merchants need to worry about.
Credentials that we have as a PFI are those that certify us to perform
specific investigations in the payment card industry.
Okay, and for background then,
you are the only people who are allowed to do
payment card forensic investigations.
That's current.
When a card brand mandates a forensic,
or that a merchant must perform a forensic investigation,
there are only a certain number of forensic companies that are
authorized to perform that investigation.
So does that mean you're also, work a QSA as well?
Yes.
Every PFI is also a QSA.
Right, so you're trained in assessment, and you're trained in forensics.
That's correct.
So you're like the top tier of PCI people really.
I'll say that for you.