If you ever find yourself in a hostage situation, this video might be of use to you.

Small disclaimer: your mileage may very, this video is meant for educational purposes only and finally, don’t try this at home:

I especially like how at the end he says “try them.” Good to know. Welcome to April

PCI regulations require companies to protect credit card numbers. But first you have to know where they are.

Here’s what I’ve learned from retailers and PCI auditors about step one of PCI compliance.

It’s simple to track credit card data from the point of sale to your databases and the bank that processes the transaction.

More challenging is uncovering the nooks and crannies it falls into throughout the organization.

Depending on your business processes, credit card data could be stored on customer service PCs, inside spreadsheets in the marketing department, or on backup tapes being shipped off-premises.

As I research an upcoming feature on PCI, I’ve been speaking with a number of retailers and PCI auditors. Here are a few tips you might find useful.

1. Self assessments. CIOs are conducting internal audits of their IT teams and business units to find out who touches credit card data and where they keep it.

It’s important to get this information from all the stakeholders, particularly business units that take customer orders or use card data to analyze buying trends.

2. 3rd-party audits. It’s often instructive to bring in outside experts to help you ferret out credit card data. One auditor told me about a major grocery chain that had made significant efforts to purge card data from systems that didn’t specifically need it.

However, when he bought a pack of gum with his credit card and then reviewed the logs of the point of sale system, he found it was recording the full card number and expiration date.

Of course, third-party audits are expensive, so you have to weigh the cost against the potential fines of PCI violation—along with the risk of a malicious party getting access to that data source.

3. Use tools. One retailer bought a data leak prevention product to make sure intellectual property and other sensitive data didn’t leave the network.

He also used its discovery feature to crawl his headquarters network and remote offices for repositories of card numbers. He used the findings to approach the business units holding the data to ensure they were following IT policies for encryption.

He also crawls the network regularly for rogue data or non-compliant business units. Which brings us to…

4. Get your processes in order. 99 percent of PCI compliance revolves around having IT and business processes in place to secure card data. You have to ensure that business units understand IT policies—and that they are following them.

You may also want to tweak business processes to minimize (or eliminate) the use of credit card data wherever possible. For instance, credit card numbers can be replaced with unique identifiers to analyze customer purchases.

The Recording Industry of America’s (RIAA) website was attacked – again – over the weekend.

According to numerous breaking news stories it seems a lack of proper security controls enabled some to take parts of the site down, and tweak its pages. Get serious.

It looks like a plain vanilla SQL injection vulnerability was publicized on the social news network site Reddit, and the attacking escalated from there.

The RIAA.org Web site appears fully functioning now, but that probably won’t last too long if history is any indication. During the past five years the site has reportedly been defaced and has undergone several denial-of-service attacks.

Things got really sticky a few years ago when Senator Orin Hatch proposed to give the entertainment industry the right to attack systems used by illegal file swappers.

How about a search warrant?

Other than a laugh, these more recent hacks aren’t going to push their argument against the RIAA, its lawsuits, or the demise of DRM any further.

Energy would be better placed by hounding Congress to improve the Digital Millennium Copyright Act (DMCA) and boycotting the purchase of DRM enabled music files and CDs.

Speaking of DRMed music files, they’re already starting their fade into oblivion.

Nearly every, if not every, major record label is already starting to release DRM-free files. In fact, defacing Web sites is about as petty as trying to sue your customer-base to save a dying business model.

Speaking of petty: why won’t the RIAA spring for the occasional server assessment?