Not trying to be paranoid but if I'm running a userscript on a checkout page, that script has access to everything on the page. Makes me wonder how sites actually monitor for this kind of thing or if they even do.
What commonly accidentally gets pulled into PCI scope?
Not your biggest crowd pleaser but that one track where you have to read the room first. Could be a weird edit or a risky vibe switcher.
There's a lot of big names, but who are the villains that should get more love?
For things like chat widgets, session replay, A/B testing and analytics, are you blocking the scripts entirely until consent, or loading them in some restricted mode first?
This comes up more often than I'd expected with support tickets, bug reports and internal documentation. Do you have a formal process for redacting them, or is it mostly left to individual employees?
For things like chat widgets, session replay, A/B testing and analytics, are you blocking the scripts entirely until consent, or loading them in some restricted mode first?
We’re looking at PCI DSS requirements around the scripts running on our checkout page after adding a tag manager.
The issue is that marketing wants to keep adding pixels and analytics scripts, while security wants to know exactly what’s executing on the payment page and when it changes.
For anyone who’s dealt with this, do you review every new script manually or restrict the tag manager to an allowlist, or have automated monitoring in place?
Basically how are you handling situations where a SaaS vendor doesn't quite meet one of your internal security requirements?
For example, a vendor might not support SSO or have a specific security control you normally require, but the business still wants to use them.
Do you record that as a formal exception, accept the risk based on their SOC 2/ISO evidence, or have another process for it?
We're preparing for another audit and one thing that still feels messy is collecting evidence for controls that rely on Slack or Teams conversations.
Things like:
Curious what everyone's workflow looks like.
House, techno, DnB, hip-hop, garage, trance, open format... what takes the most skill to make sound good when mixing?
Whether it's vulnerability management, MFA, logging, segmentation, documentation, or evidence collection, which requirement consistently takes the most time and why?
Whether it's evidence collection, policy management, risk assessments, monitoring, or something else, where do you think automation would have the biggest impact?
I still come across people confidently repeating things about GDPR that just aren't true, whether it's "you need consent for everything" "GDPR only applies to companies in the EU," or "we'll never get fined because we're too small". Whether you work in privacy, legal, security, or compliance, what's the myths that just doesn't seem to go away?
What made you bounce off it at first and what changed your mind?
My pick would be cyberpunk
Trying to start off strong. I want to know things you experienced DJs didn't get stuck in the habit of doing. Thanks!