PCI CFA case studies
PCI CFA · Put your knowledge to work in context.
The PCI Forensic Analyst (often written CFA, and not to be confused with the chartered financial analyst designation) is a specialist credential for investigators who examine payment-card breaches. A PFI company is engaged by an acquirer or card brand when cardholder data is suspected of compromise, and the analysts who do the hands-on work must be able to trace an intrusion across a merchant or service provider environment, preserve evidence defensibly, and produce a report that stands up to review by the card brands. The PCI CFA case studies are 5 cases and about 3,309 words.
1Franchise Retailer Scope After Tokenization Rollout
A 420-store franchise retailer accepts cards at POS terminals on each store LAN. Store routers connect over MPLS to a central data center, where a payment gateway encrypts PANs and returns tokens; the gateway is managed by a PCI-validated service provider.
541 words, about 3 min2Virtualized POS Imaging and a Previously Copied File
A PFI is engaged by an 85-property hotel chain after three properties report POS memory-scraping alerts. The POS application runs on six VMware virtual machines on a centralized vSphere cluster; the same cluster hosts the reservation system and domain controllers.
707 words, about 4 min3E-commerce Skimmer in a Tag Manager Container
An online retailer's checkout page loads a third-party chat widget and a tag manager container. Payment card fields are rendered in an iframe served by a PCI-validated payment service provider, so the retailer believes its site never handles PAN.
708 words, about 4 min4Signed Binary Proxy and DNS Tunneling at a Retail Chain
A retail chain with 260 stores finds abnormal DNS TXT queries from 14 stores to a domain registered 19 days earlier. EDR shows a Windows service named PrinterHostSvc running a signed binary that proxies execution; the binary is validly signed by a legitimate software vendor.
692 words, about 3 min5Payment Gateway Timeline with Time Drift and Cleared Logs
A payment gateway's fraud team sees a 6x spike in card-not-present fraud on tokens issued to one merchant. SIEM review shows a service account, svc batch, authenticating to VPN from an unfamiliar IP range at 02:14, followed by RDP to a jump host at 02:31 and creation of a local administrator account at 02:47.
661 words, about 3 min