Practical Cybersecurity with Jen Stone

Wish PCI DSS would just stop changing? Jeremy King spent 15 years as PCI's European vice president, and he explains why it can't.

Recorded during PCI's 20th anniversary at PCI North America Community Meeting in Vancouver, SecurityMetrics QSA Jen Stone talks with Jeremy about how PCI standards actually get written, why criminals shift tactics as payment security improves, and why treating compliance like a checkbox puts merchants at risk.

In this episode:

• How the PCI Security Standards Council balances competing voices, including the card brands
• Why PCI DSS version 1 was scaled back, and what that means for future AI standards
• Why PCI DSS will keep evolving as payment technology changes
• How criminals moved beyond card data to ransomware, deepfakes, and CEO fraud
• Why operational resilience matters for ransomware recovery
• Why "just get me the certificate" is the wrong approach to PCI compliance

Resources:

• Watch on YouTube: https://youtu.be/Xs3H4ViXaqA
• Read the full transcript: [LINK]
• PCI DSS Compliance: [LINK]

About SecurityMetrics:

SecurityMetrics is a PCI Qualified Security Assessor company (QSA), Approved Scanning Vendor (ASV), and PCI Forensic Investigator (PFI), and one of only a handful of companies worldwide certified by the PCI Council to conduct all major PCI compliance validations. A member of the PCI SSC's Global Executive Assessor Roundtable (GEAR) since 2018, SecurityMetrics has helped businesses protect payment data since 2000. 

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

PCI DSS 4.0.1 has been the standard for a while now, but a lot of organizations are still stuck on the same handful of requirements. In this episode, Jen Stone sits down with Matt Halbleib, Director of Assessments at SecurityMetrics, to break down where SMBs keep getting tripped up — and how to fix it. 

Key topics covered:

• Why you need to read the actual standard (not just the summary of changes) — and why the PDF version matters 
• Getting senior management buy-in and putting a real project manager behind your PCI program 
• Scoping: what's actually in scope, and why it's worth revisiting 
• What replaced the old org-wide risk assessment, and how to build one 
• Why MFA got bigger in 4.0.1, and where it now applies 
• New service provider requirements, including the responsibility matrix 
• Logging and alerting: what's changed, and where AI actually helps 
• Password requirements, including the jump to 12 characters, and why a password manager beats a memorized passphrase 
• Compensating controls: what they're for, and why they should never be permanent 
• Matt’s honest take on the customized approach 
• E-commerce and payment page security (Req. 6.4.3 / 11.6.1)

Matt Halbleib has worked in information security for nearly 19 years, almost all of it at SecurityMetrics, where he now leads the assessments team. 

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

You can pass your PCI assessment and still be leaking cardholder data. In e-commerce, compliant and secure are not the same thing — and AI just made the gap between them a lot harder to ignore.

In this episode, SecurityMetrics Principal Security Analyst Jen Stone is joined by forensic investigator Aaron Willis and [HOST NAME] for a practitioner panel on how AI is reshaping attacks on cardholder data — and why passing PCI DSS 4.0.1 isn't the same as being safe. It's a repurposed webinar built around what auditors and forensic investigators are seeing in the field right now.

In this episode:

- Why passing PCI (especially SAQ-A) doesn't mean your checkout is secure

- Why PCI DSS 4.0.1 already covers AI without ever naming it

- Where e-commerce skimmers really hide — and how one defeated a top detection agent

- Requirements 6.4.3, 11.6.1, and SAQ-A FAQ 1588, decoded

- The payment-redirect trap: the convenience attackers are cheering for

- How AI reshapes your risk analysis, MFA, and third-party obligations

- Treating compliance as security: a three-tier framework

Chapters:

(0:00) Why we're running the AI panel 

(1:08) 2026 forensic & cyber predictions 

(3:42) Inside 2,000+ e-commerce cases 

(4:54) Shopping Cart Monitor: one skimmer a week 

(6:35) What Specter AI does 

(8:06) The skimmer that beat a detection agent 

(10:19) Real-time and agentless defense 

(11:52) PCI DSS 4.0.1 and AI 

(14:05) Script security: 6.4.3, 11.6.1 & FAQ 1588 

(17:30) The payment-redirect trap 

(19:56) AI-impacted requirements 

(24:18) Compliance as a security framework 

(26:28) Script inventory on the checkout page 

(27:35) Listener Q&A 

(35:45) Public vs. private AI tools 

(37:51) Final tip: AI raised the stakes 

Follow Practical Cybersecurity so you don't miss an episode. If this one helped, pass it to someone on your compliance or security team.

Watch the full video version on YouTube: https://youtu.be/-CPruQnGRpc

About SecurityMetrics:

SecurityMetrics helps organizations secure payment data and meet PCI DSS. We're a certified PCI Qualified Security Assessor (QSA), Approved Scanning Vendor (ASV), PCI Forensic Investigator (PFI), and P2PE Assessor.

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

How much of your business actually needs to be PCI compliant? Almost always less than you think.

Every system inside your PCI scope is something you have to secure, document, and prove — year after year. So the fastest way to cut the cost and effort of compliance isn't working harder on controls. It's making your scope smaller.

In this episode, Principal Security Analysts Jen Stone and Michael Simpson break down how PCI scope actually works — the three buckets every system falls into, the connected systems most people forget, and four practical ways to shrink your Cardholder Data Environment (and the bill that comes with proving it).

In this episode:

- What "in scope" really means, and why getting it wrong gets expensive

- The three scoping buckets: primary, secondary (connected), and out of scope

- The bucket almost everyone underestimates (hint: your Active Directory)

- Four ways to shrink your scope: segmentation, P2PE, tokenization, and fixing phone payments

- How taking payments by phone quietly balloons your scope, and the ways out

- Why "we use a third party" and "we're in the cloud" don't get you off the hook

- Three costly myths that keep merchants over-scoped and overspending

Free PCI scoping resources: https://listings.pcisecuritystandards.org/documents/Guidance-PCI-DSS-Scoping-and-Segmentation_v1.pdf
https://blog.pcisecuritystandards.org/new-information-supplement-pci-dss-scoping-and-segmentation-guidance-for-modern-network-architectures

Watch the full video version on YouTube: https://youtu.be/sSzZOGeGuYg

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

About 100 authorized assessors. An estimated 118,000+ companies that need to be assessed. That math is the reason CMMC can't wait — and it's where this conversation starts. Brett Cox, lead CMMC Certified Assessor and head of Boeing's DFARS CMMC Program Management Office, joins host Jen Stone to explain what the Cybersecurity Maturity Model Certification actually requires, why the November 2026 third-party assessment deadline is creating a bottleneck, and how a small or mid-sized contractor should take the first step. 

KEY TAKEAWAYS 

• Phase 2 — the third-party (C3PAO) assessment requirement — goes live November 10, 2026. The right to waive the requirement goes away in 2028. 
• Under CMMC, you must verify the subcontractor below you holds the required level before you can award them work. Their compliance is now your problem. 
• The bottleneck is real: ~100 assessors vs. ~118,000 companies. Expect a months-long queue — get in line now. 
• COTS (unmodified commercial off-the-shelf) is the only exemption, and there's no minimum dollar threshold. Modify a part and it's no longer exempt. 
• You can't use the same company for both readiness consulting and your assessment. 
• First step: decide your level (FCI vs. CUI), download the scoping and assessment guides from the DoD CIO site, and start your gap analysis. 

RESOURCES 

DoD CIO CMMC documentation (scoping & assessment guides): https://dowcio.war.gov/CMMC/Resources-Documentation/

Cyber AB Marketplace (find a C3PAO or consultant): https://cyberab.org/marketplace 

NIST SP 800-171 https://csrc.nist.gov/Pubs/sp/800/171/r3/final

SecurityMetrics CMMC services: https://www.securitymetrics.com/product/cmmc

About the Guest

Brett Cox — Lead CMMC Certified Assessor; Principal & Team Lead, DFARS CMMC Program Management Office, The Boeing Company. LinkedIn: https://www.linkedin.com/in/brett-r-cox/

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

First time filling out a PCI SAQ? In this episode, two QSAs who've scoped hundreds of payment environments walk you through how to pick the right one—so you don't end up with the wrong form, the wrong security controls, and the wrong amount of risk.

Choosing the right PCI DSS Self-Assessment Questionnaire (SAQ) isn't just a paperwork decision. Pick the wrong form and you can leave blind spots in your network security or lock yourself into compliance requirements you never needed.

In this episode of the Practical Cybersecurity Podcast, SecurityMetrics experts Jen Stone (QSA) and Michael Simpson break down the complex, often misunderstood rules of PCI scoping. They translate confusing auditor-speak into a practical roadmap so you can identify your payment channels, reduce your data footprint, and satisfy your acquiring bank.

In this episode:

• The e-commerce breakdown: the technical triggers that separate SAQ A, SAQ A-EP, and SAQ D—and the "iframe vs. direct post" buzzwords that decide which one is yours
• How to spot bad PCI advice, including the common Toast POS / SAQ A myth that sends merchants to the wrong form
• Why validated Point-to-Point Encryption (P2PE) is the gold standard for in-person payments and how it eliminates local network scope
• E2EE vs. P2PE: the critical difference between proprietary end-to-end encryption and a formally validated solution—and why you can't use the P2PE form for E2EE
• The cellular terminal question: how to document network-connected mobile payment devices
• Virtual terminals (SAQ C-VT): how to stress-test your network segmentation so a call center actually qualifies
• The SAQ roll-up: how to combine multiple payment environments into one master document without losing your mind
• Service providers: the one unyielding rule for B2B vendors who handle downstream cardholder data

Resources:
Official PCI SSC PTS device search: https://listings.pcisecuritystandards.org/assessors_and_solutions/pin_transaction_devices?agree=true

Talk to a SecurityMetrics QSA about scoping: https://www.securitymetrics.com/security-consulting

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

Passwords were built for a different era of the internet. It’s time to move past shared secrets to close your organization's largest threat vector for good.

Traditional passwords and legacy Multi-Factor Authentication (MFA) are no longer enough to protect your business. Automated, scaling phishing toolkits easily intercept shared secrets, leaving small and medium businesses highly vulnerable to credential breaches.

In this episode, Jen sits down with Nishant Kaushik, Chief Technology Officer at the FIDO Alliance, to translate complex cryptographic standards into an actionable, resource-light deployment plan. Learn how to transition away from legacy authentication and close the hidden operational loopholes that hackers actively exploit.

What You Will Learn:

• The Flaw in Basic MFA: Why SMS codes and standard one-time passwords (OTPs) are failing, and what true "phishing-resistant" security means.
• The Account Recovery Trap: Why a weak "Forgot Password" workflow accidentally gives hackers their primary attack vector back—and how to fix it.
• The Bottom-Line Benefit: How moving to passkeys drastically reduces internal IT helpdesk tickets, manual password resets, and overhead costs.
• Right-Sizing Your Passkey Deployment: How to easily segment your workforce strategy:
  • Standard Users: Synced passkeys via platform credential managers (Apple, Google, 1Password, Bitwarden).
  • Privileged Users: Dedicated hardware keys (YubiKeys) for root admins and high-sensitivity infrastructure.
• The 1-Week Action Plan: How to leverage the identity infrastructure you already own (like Google Workspace or Microsoft Entra ID) to deploy passkeys today.

Resources Mentioned:

• Learn more about modern identity standards: FIDO Alliance Website
• Review baseline federal security recommendations: CISA Guidance on Phishing-Resistant MFA
• Discover SecurityMetrics compliance resources: SecurityMetrics Official Site
• Threat Intelligence Data: Read the data behind credential exploitation in the latest Verizon Data Breach Investigations Report (DBIR). 
• Federal Passkey Standards: Review the updated identity and passkey frameworks via the NIST SP 800-63 Digital Identity Guidelines. 
• Enterprise Identity Platforms: Learn how modern stacks integrate passwordless via Okta Verify and Microsoft Entra ID. 

About the Guest: Nishant Kaushik is the Chief Technology Officer at the FIDO Alliance, bringing over 25 years of leadership in digital identity and access management (IAM). He holds nine patents, frequently serves on the advisory committees for the RSA Conference and Identiverse, and is a founding member of IDPro.

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

We can't keep turning a blind eye to e-commerce skimming. It's a real threat that demands real attention—regardless of how compliance checklists evolve. Eighteen months ago, our panel met to break down the rollout of PCI DSS requirements 6.4.3 and 11.6.1. Now, one year after PCI v4.0, we're looking at the data-backed reality of how these requirements are actually playing out in the field.

With the recent industry transitions to PCI DSS v4.0.1, clarifications surrounding the boundaries between parent web pages and third-party iframes have created a dangerous side effect: "Checkbox Blindness." Many organizations are misinterpreting these adjustments to mean that script monitoring is effectively optional if a payment iframe is in place. But treating client-side security as a text-only compliance loophole ignores a harsh forensic reality—attackers don't care about scoping boundaries.

In this follow-up episode, host Jen Stone sits down with a full house of SecurityMetrics experts—Gary Glover (VP of Assessment), Chad Horton (VP of Technology), and Aaron Willis (VP of Forensic Investigation)—to cut through the regulatory noise. Backed by data from over six years of payment page monitoring, they translate the latest auditor fine print into practical guidance on why your parent page remains a prime target, and how to protect it without drowning your team in alert fatigue.

Key Takeaways From This Episode:

• The v4.0.1 Scoping Misconception: Why thinking an embedded iframe completely offloads your client-side security obligations is a critical business risk.
• Bypassing the Safe: How attackers manipulate the parent page environment to intercept credit card data before it ever reaches a secure iframe or redirect link.
• The Reality of "Checkbox Compliance": Why tracking down fourth- and fifth-party scripts matters to your baseline security, even if your SAQ criteria makes it look elective.
• Inside a "Zero-Malware" Exploit: A forensic breakdown of how threat actors turn legitimate, approved analytics scripts against online checkout flows.
• Managing the Responsibility Matrix: How to handle iframe providers who are quietly altering their security liability terms in their public documentation.

Resources & Links Mentioned:

• Stop Checkbox Blindness: Automate your script inventory with SecurityMetrics Shopping Cart Monitor 
• Get a Forensic MRI of Your Checkout: Schedule a deep-dive review with SecurityMetrics Shopping Cart Inspect 
• Read the Research: Download the QSA White Paper on E-Commerce Skimmer Attacks 

Connect With Our Team:

• SecurityMetrics Website: securitymetrics.com
• Follow Us on LinkedIn: linkedin.com/company/securitymetrics

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

Is your organization prepared for an autonomous AI bot? Roger Grimes joins Jen Stone to discuss the shifting landscape of cybersecurity. This episode moves past the hype to look at the hard data: AI scams are yielding 4.5x more value for attackers, and traditional MFA is no longer enough to stop them.

In this episode, we translate complex "vulnerability fatigue" into a clear, two-step priority list. We strip away the jargon to show you exactly how autonomous bots are bypassing firewalls by targeting the human element. 

Key Takeaways:

• Focus on the "Big Two": Social engineering and unpatched software account for nearly 90% of business risk.
• Phishing Resistance: Why you should move toward YubiKeys or passkeys to avoid "man-in-the-middle" code interception.
• Patch Management: Why you should ignore "shiny" new vulnerabilities and follow the CISA Known Exploited Vulnerabilities catalog.
• The Negotiator's Trap: What happens when a CEO claims they have backups, but the hackers have already deleted them.

Featured Resources:

• CISA Known Exploited Vulnerabilities (KEV) Catalog: Use this to prioritize patching based on real-world attacker behavior. 
• Phishing-Resistant MFA:
  • YubiKey: A hardware security key requiring physical touch to prevent remote account takeovers. 
  • FIDO Passkeys: A cryptographically secure alternative to SMS codes. 
• Password Management: Tools like 1Password or LastPass are essential for creating long, random, and unique credentials that AI can't easily crack. 
• The 3-2-1 Backup Rule: Maintain three copies of data, on two different media types, with one copy kept strictly offline. 

Connect with Roger Grimes

• KnowBe4: Access security awareness training and social engineering defense resources at knowbe4.com. 
• Free Book Offer: Roger is offering a free PDF copy of his latest book, How AI and Quantum Impact Cyber Threats and Defenses, to all listeners. Email him directly at [email protected]. 

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

This episode of Practical Cybersecurity moves past the standard PCI checklist to focus on the operational realities, common misconceptions, and "stealth" requirements that define SAQ A in the PCI DSS v4.0.1 era. 

The Eligibility Foundation

Most merchants skip the Eligibility Criteria, which is the actual foundation of the assessment.

• Total Data Outsourcing: To qualify, a merchant must not store, process, or transmit any electronic account data on their own systems or premises. 
• Call Center Exception: Merchants can still qualify for SAQ A if you use a third-party call center to handle payments on your behalf.
• Paper Ghosts: While the standard includes criteria for paper records, our experts have virtually never seen a modern SAQ A merchant that actually handles card data on paper in 15 years of assessments.

The Iframe Paradox

A significant "stealth" requirement exists for merchants using iframes to capture payments.

• Susceptibility by Design: Iframes are "by definition" susceptible to scripting attacks, where malicious code scrapes data directly from the customer's browser.
• "Hidden" Controls: To prove you aren't susceptible, the Council essentially requires you to meet requirements 6.4.3 and 11.6.1—technical controls for script inventory and integrity that are not technically listed in the body of the SAQ A document.

Tips for Completing Your SAQ A:

• The SNMP Trap: When hardening servers (Requirement 2.2.2), administrators frequently overlook SNMP community strings, which often serve as easily searchable default "passwords" for attackers.
• Break-Glass Strategy: Requirement 8 now accommodates emergency "break-glass" accounts. If your lead admin ("Lisa") wins the lottery and disappears, your organization needs a documented, management-approved protocol to get the new hire ("Bob") into the system securely.
• The Staff Turnover Gap: Quarterly ASV scans often fail because the one person responsible for them leaves the company, and the new hire is unaware the scans are even occurring. Redundancy—where management also receives scan results—is a critical operational fix.
• Compliance is Not Inherited: Just because AWS is compliant does not mean your implementation of it is.
• Responsibility Matrix: You must utilize your provider's Security Responsibility Matrix to identify exactly which controls are managed by the vendor, which are shared, and which are your sole responsibility.
• And More!

Resources:

Download the SAQ A: Official PCI SSC SAQ A 4.0.1 PDF 

List of PCI ASVs: Approved Scanning Vendors 

AWS Responsibility Matrix

Azure Responsibility Matrix

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/