Hi,
this is Troy Hunt and I'm here with John Elliott to talk about defending
against JavaScript keyloggers on payment card information.
So, John,
why don't tell us a little bit about who you are and why you are the
right guy to be talking about payment card information.
Cool, yeah, well I'm a Pluralsight author,
I've written a couple of courses of PCI DSS,
I used to work for Visa,
and I've spent quite a lot of time helping write the PCI DSS standards.
So, PCI is your fault?
It's not entirely my fault.
I hope some of the good bits in there are things I contributed to,
but, I mean, PCI DSS is the fault of bad guys stealing cardholder data.
Okay, but I guess in terms of the course,
you have obviously spent a lot of time thinking about how information systems
need to protect payment card information because clearly that is a pretty
critical part of taking these sort of payments these days.
It absolutely is,
and I think payment cards are almost the canary for how the
information security industry works because bad guys have been
stealing payment card data for a long time,
they know that they can monetize it, and people go after stuff they can monetize.
So, we've seen over, well, it's probably about 12 years since PCI DSS came out,
that criminals have constantly attacked payment cards,
and as PCI DSS has made things more secure in different areas,
the criminals have changed the way they attack payment cards,
which is what brings us to JavaScript attacks in browsers.