Tim Thomas • Product Management, ControlScan

Tim Thomas oversees the product management function for ControlScan. Tim is focused on enhancing the company’s product and service deliverables to guide businesses through the complexity of the Payment Card Industry Data Security Standard (PCI DSS) as well as other security and privacy compliance processes.

Prior to joining ControlScan, Tim built and led technical support teams for TeleMate.Net software, a network monitoring and security solutions company, as well as ServiceCentral Software and CipherTrust, an email security and anti-spam software company that is now part of McAfee/Intel. Tim is a member of the PCI Security Standards Council’s SMB Task Force. He tweets at @tethomas_99.

Chris Bucolo • Director of Market Strategy, ControlScan

Chris Bucolo has over 30 years’ experience in the financial technology and payments industries. In his current role as Director of Market Strategy for ControlScan, Chris is responsible for enhancing the company’s payments industry partnerships by identifying and delivering data security and compliance solutions that maximize the relationship between merchant service providers and their customers. Previously he managed business development for the company’s security consulting and security engineering services.

Chris possesses a wealth of knowledge in payment security best practices and merchant relationships, having built and sold his own Independent Sales Organization (ISO), which was one of the first in the country to embrace Payment Card Industry (PCI) security standards and include related services among its core merchant offerings. He is a regular speaker at payments and security industry events, and his commentary has appeared in several notable publications as well as AP stories and live television interviews.

Small Business Data Breaches are Costly [Video]

September 5, 2017 • Published by Steve Robb PCI 101Data Breaches, POS, Small Business

Got 100 grand to spare? Or would a breach be a death sentence for your small business? Seems like just about every day there’s a familiar company name in the news, along with the words “hacked” or “breached.” These are typically medium to large-sized businesses … Read more

The Three Essential Elements of Authentic PCI Compliance

March 27, 2017 • Published by Steve Robb Acquirer ProgramsAcquirers, Merchants, PCI Risk, Vulnerability Scanning

Authentic PCI compliance goes beyond simply checking the boxes of your SAQ

How many of your merchants are just checking the boxes? Checkbox compliance is nothing new in the payments industry. In fact, Google “checkbox compliance” and you quickly see that thousands of posts have been written about it. These posts describe the exercise of racing to … Read more

Penetration Testing: Ask the Right Questions Before You Sign

February 24, 2016 • Published by Steve Robb Best PracticesPenetration Testing, Security Testing

Find an Experienced Penetration Tester Like most security testing services, the quality of service you get in a penetration testing engagement can vary tremendously from vendor to vendor. That’s because penetration testing is human-driven, relying upon the tester’s expertise and diligence. Evaluate Potential Providers Asking the … Read more

The Who, How and Why of Intrusion Detection

December 1, 2015 • Published by Steve Robb PCI 101Data Breaches, Intrusion Detection, Log Monitoring

Understanding the need for intrusion detection. At 115-pages, PCI DSS v3.1 makes it clear there’s much to consider when evaluating the security of your payment card environment. In fact, you may be questioning how much effort to put into the task. Is it all futile … Read more

Microsoft Ending Support for Windows Server 2003

April 13, 2015 • Published by Steve Robb Industry TopicsASV, Ecommerce, External Vulnerability Scan, Windows Server 2003

Microsoft recently announced that it is ending support for the Windows Server 2003 operating system on July 14, 2015. Windows Server 2003 is heavily relied upon in e-commerce. Therefore, if your business conducts e-commerce (i.e., has a website with a shopping cart), then it’s possible … Read more

PCI DSS v3.1 and SSL: What you should do NOW.

March 5, 2015 • Published by Steve Robb Best PracticesCouncil, Encryption, PCI 3.0, PCI 3.1, POODLE, Remote Access, SAQ, SSL, SSL/TLS, TLS, Windows XP

12/21/15 Update: The PCI SSC is extending the migration completion date to 30 June 2018 for transitioning from SSL and TLS 1.0 to a secure version of TLS (currently v1.1 or higher). Learn more here. 4/15/15 Update: The PCI SSC released PCI DSS v3.1 on its … Read more