Agenda

This session has a bit of scope creep - much like your last PCI audit! You’re getting two topics for the price of one today: how to align PCI compliance with other frameworks and tackle PCI in serverless and cloud-native environments.

Sam Greaves, Senior Consultant, CSA Cyber

Most large organisations requiring PCI compliance also adhere to other standards, such as ISO 27001 or SOC 2. Traditionally, audits for each framework are conducted separately, making them time-consuming and resource intensive. By mapping controls across standards and conducting combined audits, organisations can streamline evidence collection and reduce effort. At the same time, modern serverless and cloud-native environments introduce unique challenges, such as shared responsibility models and the inability to apply traditional security controls – all whilst offering significant benefits like scalability and efficiency.

Join Sam as he explores the future of PCI compliance in a serverless world and how to navigate these emerging opportunities.

Attendees will learn:

• Framework Alignment: Map controls across PCI DSS, ISO 27001, and SOC 2 etc., to minimise duplication and streamline compliance.
• Unified Audits: Consolidate audits across multiple frameworks to save time, effort, and costs.
• Cloud Native Challenges: Address complexities in serverless and containerised environments.
• Compensating Controls: Replace traditional methods like FIM with modern approaches such as logging, runtime security, and immutable infrastructure.

MythBusters.

Parminder Lall, CEO and Founder, 1 Cyber Valley    

Following on to last year’s success of “Back To The Future” presentation at PCI London, this year we bring you “MythBusters: Who You’re Gonna Call?”. In an ever-evolving security landscape and with numerous interpretations and opinions about the PCI DSS framework, organisations can often misunderstand their responsibilities or fail to comply fully. We need to identify  ‘Misconception v Reality’.

Attendees will learn:

• Will all QSAs maintain the same perspective?
• Does reliance on outsourcing to a third-party providers eliminates you compliance responsibilities.
• Are you protected by treating PCI DSS as a One-Time effort?
• If you don’t store cardholder data you do not need to comply

Navigating SSL and Email PCI-DSS Compliance with Red Sift

Billy McDiarmid, Director of Solutions Engineering, Red Sift

• Understanding PCI DSS Compliance: Explore the latest updates to PCI DSS requirements and their implications for organizations.
• Certificates: Learn how compliance standards have evolved and the role of certificates in meeting these mandates.
• Email Security as a Key Compliance Driver: Learn how securing your email domain with solutions like DMARC, SPF, and DKIM contributes to PCI DSS compliance by protecting cardholder data from phishing and spoofing attacks.
• Data Protection: Discover how Red Sift solution monitors and secures sensitive information across your digital footprint, supporting critical compliance mandates.
• Streamlining Compliance Efforts: See how automation and actionable insights from Red Sift simplify achieving and maintaining PCI DSS compliance.

The Future of Payment Security: Trends to Watch in 2025 and Beyond

Geoff Forsyth, CISO, PCI Pal

The payment landscape continues to undergo rapid transformation, driven by evolving technologies, regulatory changes, and shifting consumer expectations. This session examines some of the key developments redefining how businesses approach payment security and compliance. 

Attendees will learn:

• Gain practical insights into balancing innovation with risk management, ensuring compliance in a dynamic regulatory environment, and building trust through secure and seamless payment experiences. 
• Prepare your organization to thrive in the future of payments by understanding the trends shaping 2025 and beyond.

Don’t Let Your Security Fall Apart: PCI DSS, Third-Party Software, and the Tetris Effect!

Nadav Shatz, Cyber Security and technology executive, Orange Cyberdefense

• Third-party security risks are one of the top threats to organisations. Within this, the risk posed by third-party software is constantly on the rise as a major emerging threat especially for organisations that develop and offer payment solutions.
• Now more than ever, the PCI DSS places an unprecedented focus on securing both custom and third-party software, including new, future-dated requirements set to come into effect early next year as part of PCI DSS v4.0.1. We will show:
• A real-life demonstration of a customer case, exploiting a third-party software vulnerability to not only gain control of Account Data but also to turn a POS terminal into a music player!
• Explore and suggest solutions for properly addressing this threat, to secure payment environments and ensure compliance with the relevant requirements of PCI DSS v4.0.1.

PCI DSS 4.0 Compliance Made Easy with Thales

Ketan Pyne, Pre Sales team for UK&I, Thales Group 
Matthew Santos, Thales Group 

• Drawing on decades of experience helping banks and financial institutions comply with industry mandates, Thales offers integrated products and services that enable your organisation to protect stored cardholder data, encrypt it for transfer, restrict access on a need-to-know basis and protect applications managing payment transactions. 
• Working with Thales can reduce the scope of your PCI DSS compliance burden.