...Nosal never was accused of traditional hacking. Among other things, what the jury concluded was that he coaxed, sometimes through monetary payments, his former colleagues at Los Angeles-based executive search firm Korn/Ferry International to access the firm’s proprietary database and provide him with trade secrets to help him build a competing firm. Those associates cooperated with the government and were not charged.

• The big issue: privilege escalation/kernel exploit where someone with access to the phone can become root and run whatever they want on the phone.
• Physical attack by plugging a device into the rear ethernet jack on the phone and then executing arbitrary code to own the phone, leveraging item #1.
• Local network ("remote") SSH authentication bypass by impersonating the TFTP server the phone interrogates for authorized SSH user keys, and then leveraging item #1. (skip to 38:00 in the preso.)

• The physical attack is neat, but has a few components to it. First, the attack hasn't (to my knowledge) been yet made public, so many people know this is possible, but don't have the tools (yet) to do anything about it. Second, Cisco will certainly be working to patch the issue. Third, leveraging item #1 above requires some sort of access, either physical or local network, to a target phone.
• Even if the "eavesdropping mic" attack is successful and the attacker turns on the mic, the recorded data still needs to be sent somewhere for the attacker to listen to or retrieve. This is possible in many ways, but keep in mind the above presentations pretty much avoid that hurdle.
• These phones are basically little computers. If an attacker can take control of it, they can do the same things from it that they could by using a rogue or compromised system on a network. The "eavesdropping mic" is just one of many ways the compromised phone could be used.
• Physical security is still paramount, even for phones placed in semi-public locations.
• Keep unauthorized devices off your network so they aren't able to do things like impersonate TFTP servers or make SSH attempts to your phones. In addition, make sure your network monitoring is set up to let you know when even someone authorized tries to do suspicious things. This isn't new.
• It's up to Cisco to fix the privilege escalation and other various issues in their firmware.
• Always be vigilant and report any strange devices, electronics, dongles, or other things hanging off phones, systems, or plugged into jacked that aren't normally used or have not been sanctioned/installed by your local IT. And even then, question what things are in case an insider is planting devices.

Perhaps having breach insurance is the prudent, responsible business way to handle this? Does your organization even have breach insurance? Breach insurance is one way of managing your risk, but all it can do is replace money lost. Some breaches are hard to put a price tag on.

A lot of QSAs are great technologists, but would not know a good or bad control environment if it bit them in the posterior. Fewer QSAs and most ISAs know controls, but would not know a proper firewall or router configuration to save their lives. And finally, there are a very, very few QSAs and some ISAs that know the technology and controls. Unfortunately, the PCI SSC has not found the way to winnow out the QSAs and ISAs so that only the ones that know both technology and controls remain.