Identifying Payment Cards at Rest – Going Beyond the Key Word Search

Introduces dataLoc, a standalone tool that scans live MSSQL databases for payment card data using pattern scoring and Luhn checks instead of keywords, aimed at DBAs, auditors, and testers.

MSSQL linked server credentials are reversibly encrypted, letting sysadmin-level attackers recover cleartext passwords via a new PowerShell script. Defensive advice on database links included.

ADPathFinder extends BloodHound CE by unifying SharpHound with OpenGraph collectors, mapping privilege escalation paths across AD, ADCS, MSSQL, and SCCM plus context-aware password audits.

An engagement walkthrough: root access via Apache NiFi, recovered NIS hashes and Duo Auth Proxy secrets, decrypted MFA traffic, then a DA MSSQL relay via xp_cmdshell to domain admin and DCSync.

PCI Council's John Markh discusses securing payment card data, the evolution of PCI DSS and related standards, and new frameworks for mobile payments, cloud, and IoT emerging technologies.

Compliance frameworks like HIPAA, PCI-DSS, and NERC-CIP prove you are compliant, not secure; mature programs shift from checking boxes to risk-based, continuous monitoring of internet-facing assets.