Boyd interview

Tips:

Research the company

Be honest (do you want to move? not particularly)

Boyd Clewis, do it on evenings.

Know the company. Talk about recent news and developments (Boyd mentions ghost stores)

PARTICIPATING ORGANIZATION AND TRAINING FOR ISAs

-Boyd said he told the last company what that would do for the company and the training that is available. If they would become a participating organization. Research what this is. 

-Let the conversation flow, be yourself.

Elevator speech- On PCI DSS is the framework that companies that store process or transmit credit card data have to abide by annually, now they have to be compliant everyday but compliance has to be validated annually.  And if for some reason we are not compliant there are fines and penalties associated with that and we can even lose the ability to process payments and so, ultimately this framework is the framework that we can use to stay out of the news for credit card breaches, data breaches those type of things.

Q: How do you access what is in scope or not?

The way I do it, and I'm pretty hardcore with this. and I'll explain my methodology.

First of all, every year, before the assessment kicks off, SCOPING ACTIVITY. Let's review the data flow, let's review the card flow diagram, and the network diagram. let's see what changed. Then, I go a step further that I believe most IT professionals miss because they are thinking like IT guys.  I have a conversation with accounting: can you tell me if we are receiving any payments, any new merchant ids have been established, any other countries, any other business units. Has anything changed since last year?

Oftentimes, I find brand new payment applications that have been introduced that somehow bypass  security review. After understanding what we have in scope at a high level. The next thing that I do, I validate the internal firewalls that the rules have actually been implemented properly to control the actual scope. It's one thing to document on a network diagram and a system inventory that says 'this is what is in scope.' That's fine, but remember this is an assessment that we are going to go through, so you can tell me whatever you want to tell me, but I'm going to validate it. So I need you to export the firewall configurations for me. and I'll do an analysis on that. If I find any network, subnets, things that are not in my inventory, that are not in that diagram, then I got a list of questions. So once I go through that process then I get everything documented up, then I'm confident to move forward with the QSA.