# W/ Campus: Payment Security Learning Lab

Status: **Practitioner Review Pending**

> Students learn how payments, architecture, responsibility, evidence, testing, and professional judgment fit together—then leave with safe, explainable portfolio work instead of memorized compliance vocabulary.

## Safety and authority boundary

W/ Campus is independent practitioner education. It is not an accredited course, official PCI SSC training, a PCI SSC qualification, a PCI DSS assessment, permission to test a real system, or a hiring guarantee. Exercises use fictional or explicitly sanitized environments and must never collect account data, credentials, sensitive architecture, or client evidence.

## Five-step learning path

1. **W/? Follow the transaction** — Trace one fictional payment from customer action through authorization, settlement, refund, failure, and support paths.
2. **W/→ Map influence** — Identify systems, identities, providers, networks, software, and people that handle payment data or can affect its security.
3. **W/↔ Separate responsibility** — Distinguish provider, customer, shared, assessor, and compliance-accepting authority without turning outsourcing into invisibility.
4. **W/! Challenge the claim** — Ask what is asserted, what evidence exists, what was tested, who made the decision, and what would reopen it.
5. **W/✓ Build the portfolio** — Produce a sanitized, source-linked artifact that another person can review, reproduce, and challenge safely.

## Focused learning streams

- **Payments + architecture** — What actually happens when a customer pays? _Output:_ A narrated payment journey with normal, alternate, failure, refund, and administrative paths.
- **Scope + responsibility** — Who and what can affect payment security? _Output:_ A relationship map separating facts, provider reliance, customer duties, and open applicability questions.
- **Evidence + testing** — What makes a security claim believable? _Output:_ A claim-evidence-test matrix that distinguishes scans, penetration tests, control evidence, and assessment judgment.
- **Cloud + software** — What remains when infrastructure is ephemeral or outsourced? _Output:_ An ownership and change model for SaaS, cloud, serverless, APIs, identities, and providers.
- **Career + ethics** — How does a learner become useful without pretending to be qualified? _Output:_ A role map, learning plan, ethical boundary, and sanitized portfolio brief.

## Fictional scenario labs

- **The Campus Bookstore Checkout** — A university bookstore combines physical terminals, an ecommerce storefront, returns, gift cards, and student employees. _Challenge:_ Tell the complete payment story without assuming one processor means one environment.
- **The Student Event Reader** — A student organization borrows mobile readers for a weekend event and uses personal phones, temporary accounts, and venue Wi-Fi. _Challenge:_ Separate convenience, ownership, authorization, evidence, and post-event access removal.
- **The Alumni Donation Page** — A hosted donation form is embedded in a university-managed site with analytics, scripts, DNS, developers, and provider callbacks. _Challenge:_ Map security influence beyond the system that receives the card data.
- **Dining, Vending, and the Mystery Network** — Dining terminals, kiosks, vending devices, guest Wi-Fi, facilities vendors, and central identity share an incomplete diagram. _Challenge:_ Reconcile inventory, data flow, administrative access, segmentation claims, and provider responsibilities.
- **The Serverless Startup Capstone** — A fictional startup uses hosted checkout, APIs, functions, containers, cloud identity, webhooks, and several SaaS providers. _Challenge:_ Find durable ownership and evidence in an architecture whose compute is intentionally short-lived.

## 1. Fictional Payment Journey Canvas

Narrate one payment beyond the happy path.

- [ ] Where does the customer begin?
- [ ] What handles or influences the transaction?
- [ ] What happens on failure or retry?
- [ ] How are refunds and support performed?
- [ ] Which facts remain unknown?

## 2. Transaction Actor and Handoff Map

Make people, systems, providers, and handoffs visible.

- [ ] Which actor performs each action?
- [ ] Which identity authorizes it?
- [ ] What crosses the handoff?
- [ ] Who owns the receiving side?
- [ ] What evidence records the handoff?

## 3. Scope Relationship Sketch

Practice relationship-based scoping without declaring a compliance result.

- [ ] What stores, processes, or transmits account data?
- [ ] What connects to those components?
- [ ] What can affect their security?
- [ ] What segmentation is asserted?
- [ ] Which conclusion requires qualified judgment?

## 4. Claim Evidence Matrix

Turn an assertion into a reviewable claim.

- [ ] What exactly is claimed?
- [ ] What is the subject and period?
- [ ] What evidence supports it?
- [ ] What test or observation was performed?
- [ ] Who has authority to conclude?

## 5. Provider Responsibility Interview

Practice describing provider reliance without saying the vendor handles everything.

- [ ] What exact service is consumed?
- [ ] What current assurance applies?
- [ ] What does the provider perform?
- [ ] What remains with the customer?
- [ ] What change reopens the answer?

## 6. Assurance Activity Comparison

Separate scanning, penetration testing, evidence review, and assessment.

- [ ] What question does the activity answer?
- [ ] What population is covered?
- [ ] What method is used?
- [ ] What output is produced?
- [ ] What conclusion cannot be inferred?

## 7. Safe Portfolio Project Brief

Design demonstrable work without exposing real systems or sensitive data.

- [ ] What fictional scenario will be used?
- [ ] Which sources will be cited?
- [ ] What artifact will be produced?
- [ ] What sensitive material is prohibited?
- [ ] How can a reviewer reproduce the reasoning?

## 8. Career Role and Learning Plan

Connect interests to real work rather than chasing titles alone.

- [ ] Which tasks energize the learner?
- [ ] What knowledge is missing?
- [ ] Which skills need practice?
- [ ] Which adjacent roles expose the work?
- [ ] What is the next ethical, verifiable learning step?

---

_Independent practitioner education. No real account data, credentials, sensitive architecture, client evidence, or unauthorized testing._