11 December 2017
visit http://response.ncr.com

PCI SSC rolls out security standard for 3DS protocol

25 October 2017  |  5284 views  |  0 Source: PCI SSC

Today at the PCI Europe Community Meeting the PCI Security Standards Council (PCI SSC) announced two new security standards to support secure implementation of EMVCo’s EMV 3-D Secure (3DS) protocol.

EMV® 3DS helps prevent unauthorized card-not-present (CNP) transactions. It protects merchants from exposure to CNP fraud by enabling consumers to authenticate themselves with their card issuers when making online purchases through web browsers or via mobile applications. Together the work of EMVCo and PCI SSC ensures an agile and workable structure is established for both functional testing and security evaluation of EMV® 3DS solutions.

“EMV® 3DS solutions will make it increasingly difficult for criminals to obtain cardholder data (CHD) in online payment channels,” said PCI SSC International Director Jeremy King. “As CNP fraud continues to be a challenge here in Europe and globally, PCI SSC is pleased to be able to provide support for the secure implementation of these solutions.”

“Dynamic authentication is becoming increasingly important to securing payments in an omni-channel world,” added PCI SSC Chief Technology Officer Troy Leach. “A new and improved EMV® 3DS protocol supported by PCI Security Standards will enhance the security of 3DS infrastructures and transactions and improve dynamic authentication for e-commerce and m-commerce environments.”

The PCI Security Requirements and Assessment Procedures for EMV® 3-D Secure Core Components: ACS, DS, and 3DS Server (referred to as PCI 3DS Core Security Standard) and the PCI Security Requirements and Assessment Procedures for EMV® 3-D Secure SDK (referred to as PCI 3DS SDK Security Standard) focus on securing the EMV® 3DS infrastructure that supports 3DS transactions:

• The PCI 3DS Core Security Standard supports the EMV® 3-D Secure Protocol and Core Functions Specification, and is for entities that manage, provide or assess 3DS Access Control Server (ACS), Directory Server (DS), and 3DS Server components. The PCI 3DS Core Security Standard defines appropriate security controls to protect these specific 3DS environments, which are critical to the 3DS transaction process. Training will be available for eligible Qualified Security Assessors (QSA) to support assessments of these PCI 3DS environments to the PCI 3DS Core Security Standard.
• The PCI 3DS SDK Security Standard supports the EMV® 3-D Secure SDK Specification, which defines EMV® 3DS requirements for entities developing 3DS Software Development Kits (SDK) for use in mobile-based 3DS transactions. The standard is for developers and vendors of 3DS SDK products, and it is focused on ensuring the SDK has been designed and developed with security in mind. The PCI SSC is also developing a supporting validation program for early 2018, which it will first test as a pilot program in 2017. The final program will include a PCI SSC listing of SDK solutions that meet the PCI 3DS SDK Security Standard.

The PCI 3DS Core Security Standard is available now on the PCI SSC website. For additional information, view PCI Perspectives Blog post: What to Know About the New PCI 3DS Core Security Standard.

The PCI 3DS SDK Security Standard will be available on the PCI SSC website next month.

Comments: (0)

Comment on this story (membership required)

Related company news

 

Related blogs

Create a blog about this story (membership required)
visit www.atos.netvisit www.solutions.lexisnexis.comvisit http://info.nice.com

Who is commenting?

Top topics

Most viewed Most shared
Revolut lets customers buy Bitcoin, Litecoin and EthereumRevolut lets customers buy Bitcoin, Liteco...
18354 views comments | 26 tweets | 22 linkedin
Saxo Bank's 'Outrageous Prediction': Bitcoin to peak at $60k next year before spectacular crashSaxo Bank's 'Outrageous Prediction': Bitco...
11265 views comments | 7 tweets | 7 linkedin
Deutsche Bank paper hails 'huge' blockchain potentialDeutsche Bank paper hails 'huge' blockchai...
7515 views comments | 14 tweets | 21 linkedin
Santander UK poaches Barclays innovation chief Michael HarteSantander UK poaches Barclays innovation c...
6567 views comments | 8 tweets | 17 linkedin
Barclays, First Direct and Nationwide join FCA sandbox cohortBarclays, First Direct and Nationwide join...
5977 views comments | 5 tweets | 12 linkedin

Featured job

Competitive
London, UK (or flexible)

Find your next job