I'll be doing two one-hour book signings at Black Hat USA 2014 and DEF CON 22 conferences in Las Vegas:

Black Hat USA 2014: 
August 6, 2014, 5:30 pm
Mandalay Bay Conference Center, Tripwire booth 141
(I'll be doing a short presentation before the book signing)

DEF CON 22:
August 8, 2014, 11:00 am
Rio Hotel & Casino, No Starch Press community table in Vendor Area

The PCI SSC meeting (1400 participants) is over. Mostly, minor clarifications in PCI DSS and PA-DSS 3.0, changes in PTS testing requirements 4.0. Unfortunately, no significant changes in PCI standards means no good news for merchants and cardholders. No regulation or tech breakthroughs means the show will go on.

I am going to the PCI SSC community meeting in Las Vegas next week. 
Anyone who knows what it is :) - see you there!

PCI SSC has released a document that "highlights anticipated changes to the PCI Data Security Standard (PCI DSS) and Payment Application-Data Security Standard (PA-DSS) in order to prepare organizations for the introduction of Version 3.0 in November 2013".
I could not find any significant changes that would help to improve the security of card payment transactions. I wasn't surprised though.

I have created a separate menu entry -- "PCI ISA" -- which contains a link to the one of the most popular blog entries - PCI ISA Training Experience. So everyone can just click on the direct menu link and share her/his experience about ISA certification process - training, exam, and more.

I have been comparing several Track/PAN detection tools and this one looks pretty good. Later on I am going to publish a comparison chart of several such products (both commercial and free). If you have any comments/links please let me know.

I just received the PCIP Certificate from the PCI SSC!
Main difference from PCI ISA certification is that PCIP is personal certification while PCI ISA is linked to particular employer...

I would like to update you on most notable news from the PCI 2012 community meeting which took place in Orlando, Florida. 

1. There were no announcements regarding any major changes in either PCI DSS or PA-DSS, but there is a tendency of expanding these standards into the new areas such as Tokenization, Mobile Payments, and P2PE (see below).

2. Tokenization guidelines will become a standard in near future which means the rules around tokenization must be followed and any token implementation must be assessed by auditors. It is still unclear whether it is going to be separate standard or part of the existing one such as PCI DSS. The standard will cover all aspects of tokenization such as token generation, token storage (token vault), usage, etc. Final delivery of the standard: 2013-2014.

3. Mobile Payments
  - The Mobile payments solutions are going to be divided into 3 major categories with several sub-categories – based on different technologies and hardware/software configurations. For example, smart phone based solutions fall under 3rd category. The idea is to gradually release guidelines for each and every category/sun-category, and eventually create a mobile payments standard, so most probably, the mobile payments guidelines eventually will become a standard - similar to Tokenization. There were no timelines provided for the future guidelines or standards.

- New PCI Mobile Payment Acceptance Security Guidelines for Developers were released during the meeting.

4. P2PE
- Next Steps:
  The next step is releasing the Hybrid P2PE Requirements (there is an existing draft), and the next one is going to be software P2PE. No dates were provided.

- SAQ-P2PE-HW: I don’t know if you have noticed but there is new SAQ-P2PE-HW (Self-Assessment Questionnaire for Hardware/Hardware P2PE) available on PCI website since June. It still cannot be used because there are no listed PCI P2PE solutions yet. Once the P2PE solutions listing is published on the PCI website, merchants that implement PCI approved P2PE solution will be eligible to complete special SAQ which is supposed to be “easier” than regular one.

Note: this is still only applicable to merchants that are eligible for SAQ. Others will still go through the regular QSA assessment.

5. New PCIP (PCI Professional) certification program was just launched (in September). The idea is that each organization would have PCIP-certified employees who understand the PCI and help to maintain PCI compliance. The difference between PCI ISA and PCIP is that PCI ISA is linked to specific employer while PCIP is a personal certification.

Criteria:
All candidates - training course and exam;
CISSP holders - only exam;
PCI ISA holders - no training or exam, can be earned automatically (I signed in already).

I have received the PCI ISA certificate. At least I will be able to speak with QSA on their language.

    I just returned from the 2 days PCI ISA training in Florida. The environment in Orlando (sun, close proximity to Disney, pools, and bikinis) does not help to concentrate on study of such a topic. And the exam... Even though, of course, you cannot compare it to something like CISSP, but still - it would require some efforts to pass (I don't know about the results yet though). 
    Anyway, it was good experience - observing the QSA program from inside (basically, the ISA is the same as QSA but without ability to work as QSA). Now I even better understand the reason for ambiguous definitions and weird interpretations of PCI. The PCI DSS consists of 12 main requirements. In order to validate each of 12 requirements during the audit, QSA is provided with Testing Procedures which are listed in the same document. There are total of 310 (!) testing procedures. The net duration of training is about 10 hours or 600 minutes (2 days minus time for introduction, final exam, and breaks) which leaves the instructor with less than 2 minutes per testing procedure - including explanation, samples, questions, knowledge check etc.     
    Note: Information about PCI DSS Requirements (including Testing Procedures) and QSA Training is publicly available which allows to calculate the numbers above without any "inside" knowledge.