Current analysis on payment security, fraud prevention, AML/KYC, and PCI DSS compliance.
AML and KYCThe FinCEN Files leak highlighted a major issue: filing 12 million Suspicious Activity Reports (SARs) between 2011 and 2017 didn t ensure those reports were useful. With FinCEN s staffing dropping by
Key ManagementPurpose of the Template You can t protect what you can t see. When your QSA asks where all your cryptographic keys are, or when an expired certificate brings down your payment gateway at 2 a.m., you l
PCI DSS ComplianceThe PCI SSC s August 2026 FAQ #1588 highlighted a documentation gap causing compliance issues: if your e-commerce site uses redirect-based payment flows instead of iFrames, you re still expected to co
Access ControlYou ve read the directive, mapped requirements to controls, and convinced management to approve the budget. But when the auditor asks to see your access management evidence, you ll find that having a
Get weekly security insights and compliance updates delivered to your inbox.
Cryptography FundamentalsWhat Changed Two witness encryption constructions, the affine determinant program (ADP) and its arithmetic extension (AADP), have been compromised. Attacks can now recover encrypted messages directly
AML and KYCThe Conventional Wisdom Many believe that buying advanced AML compliance software will improve fraud detection. Vendors promise that automating transaction monitoring , flagging suspicious patterns, a
Cryptography FundamentalsYour payment infrastructure likely relies on cryptographic methods that haven t been fully tested at the parameters you re using. This is more important now than it was six months ago. SQIsign , a pos
Cryptography FundamentalsYou ve seen the NIST announcements. You ve read the vendor whitepapers. Now someone in your organization is asking when you re planning to implement post-quantum cryptography to protect cardholder dat
Cryptography FundamentalsWhat Happened A research team has developed a fully homomorphic encryption (FHE) scheme with chosen-ciphertext attack (CCA) security, based solely on the learning with errors (LWE) assumption in the s
Vulnerability and Software SecurityThe Challenge Researchers at the University of Massachusetts Amherst found that expired Visa contactless cards can still be used for real purchases. The issue lies in the Visa Kernel 3 contactless flo
Cryptography FundamentalsMany believe that once a payment card expires, it s useless. Chip-and-PIN technology and cryptographic validation supposedly render an expired card incapable of completing transactions. So, why bother
Regulations and StandardsYour IAM policy documents look perfect. Your access reviews happen quarterly. Yet, when your auditor asks for proof that your applications enforce those policies, you find a gap you didn t know existe
Cryptography FundamentalsYour compliance team manages cardholder data across multiple processors, each needing access under different conditions. Traditional encryption forces a choice: encrypt separately for each party (lead
Cryptography FundamentalsAre you still using the same encryption algorithms you chose five years ago? Your compliance documentation might list approved cryptographic standards, and your quarterly reviews confirm you re still
Regulations and StandardsThe shift to quantum-resistant cryptography in the payment industry is urgent. With China s 2025 cryptographic standards requiring 128-bit, 256-bit, and 512-bit security levels, your compliance team m
Cryptography FundamentalsWhen your team selects a cryptographic primitive to protect cardholder data, you re choosing from a family of related constructions that share fundamental security properties. Understanding these rela
