Visa Inc. · NYSE:V
Visa — Technical Presentation (September 2008)
23 slides from Visa's technical presentation, September 2008
Slide 1: PIN Security and Key Management Best Practices for Debit Issuers with ATMs
PIN Security and Key Management Best Practices for Debit Issuers with ATMs Payment System Risk September 2008 Visa Public
Slide 2: Agenda
Agenda • Financial Institution’s Security Environment • Impact of a Data Security Breach on Banks • Is Your Bank a Target? • How PCI Security Requirements Apply? • PIN Security and Key Management Controls – Acquirer – Issuer • Key Learnings Visa Public 2
Slide 3: Security Environment
Security Environment • Hackers are attacking: – Small Financial Institutions • Credit Unions are increasingly targeted – Banks that drive ATMs directly – Banks that support Debit card processing • PIN Validations • PIN Changes / Updates • PIN Offset tables • Use of stale Single-DES PIN Verification
Slide 4: Security: A Customer POV
Security: A Customer POV Cardholder awareness of security issues 1. at record high levels 2. Concerns permeate all facets of their financial life and could impact their usage at ATMs 3. Maintaining consumer confidence in electronic payments is mutually beneficial Visa Public 4
Slide 5: Impact of a Data Security Breach on Banks
Impact of a Data Security Breach on Banks • Damaged reputation to your Bank and Brand • Potential loss of client goodwill • Financial liability for fraud • Potential legal liability • Fines and penalties • Increased regulatory compliance Visa Public 5
Slide 6: Don't Store It If You Don't Need It!
How Banks Can Protect PIN and Cardholder Data Don’t Store It If You Don’t Need It! Know exactly what you NEED to store and store ONLY 1. that. Most banks don’t need to store PIN and payment card data 2. Know what your Host and ATM applications are storing, if anything 3. Know what your vendors are s
Slide 7: PIN Flow – Bank with HSM
PIN Flow – Bank with HSM Debit ATMs Processor Network performs Processor performs PIN translation – Bank PIN translation – decrypts PIN using decrypts PIN using processor AWK and with encrypts PIN with Bank AWK and HSM encrypts PIN with Issuer Working Key Bank drives their own Network AWK ATMs and p
Slide 8: Is Your Bank a Target?
Is Your Bank a Target? ASK YOURSELF: 1. Are you driving your own ATMs directly using a: a) Hardware Security Module (“HSM”) performing PIN translations? b) Third-Party processor? 2. Do you have multiple systems connected with any having Internet access? 3. Does the bank have web-facing applications?
Slide 9: Top PCI DSS and PCI PIN Violations
Top 7 PCI DSS and PCI PIN Violations Based on compromises of PIN and cardholder data, Visa has found the following common issues: 1. Vulnerable payment applications (e.g., inappropriate storage of full track, CVV2 and PIN data, insecure remote access) 2. Inadequate perimeter security (e.g., improper
Slide 10: How Banks Can Protect Their On-Us And Not On-Us Transactions
How Banks Can Protect Their On-Us And Not On-Us Transactions Know what payment applications you use within Host 1. and ATM environments and ensure they are not storing inappropriate data and never allow software encryption of PINs Determine if payment application vendors or other 2. parties have rem
Slide 11: PCI DSS and PA-DSS
PCI DSS and PA-DSS • PCI Data Security Standard (“PCI DSS”) – 12 security requirements – Demonstration of compliance is tiered for merchants and service providers based on volume – Annual compliance verification cycle • PCI Payment Application Data Security Standard (“PCI PA-DSS”) – The PA-DSS appli
Slide 12: Visa PIN Security and Key Management Compliance Program: Acquirer Requirements
Visa PIN Security and Key Management Compliance Program: Acquirer Requirements • Payment Card Industry PIN Entry Device (“PED”) security (all five card brands) – PCI Encrypting PIN Pad (“EPP”) Security Requirements – PCI POS PIN Entry Device Security Requirements • Visa, MasterCard and JCB – EMV (of
Slide 13: Visa PIN Security and Key Management Compliance Program
Visa PIN Security and Key Management Compliance Program • Types of Acquiring Participants: – VisaNet Endpoints – Acquirers / ISO Agents with ATMs – Third Party Agents (Downstream Processors) – Certificate Authorities – Encryption and Support Organizations (“ESOs”) • Validation – Visa field review –
Slide 14: Global TDES and PED Testing Timeline
Global TDES and PED Testing Timeline Newly Newly Newly All US ATMS All PEDs must deployed deployed deployed must be using be using ATMS must ATMS must unattended TDES end-to- TDES. All support TDES have a Visa- POS PEDs end Attended POS approved EPP must have PCI PEDs must be approved EPP pre-PCI /
Slide 15: Acquirer PIN Security and Key Management Controls
Acquirer PIN Security and Key Management Controls • ATMs, point-of-sale PEDs, EPPs and Hardware Security Modules (“HSM”) must be securely loaded with encryption keys, when first initialized • All keys used for the protection of PINs must be securely managed during all key life cycle stages – creatio
Slide 16: Review ATM Environment
Review ATM Environment • Validate that: – PIN Blocks are not stored in ATM log files – Sensitive cardholder data (e.g., PANs) is properly protected in ATMs – Proper controls for remote access of ATMs are in place – ATM anti-virus mechanisms are current and actively running – ATM applications are PCI
Slide 17: Issuer PIN Security and Fraud Management Controls
Issuer PIN Security and Fraud Management Controls – Use the PCI PIN Security Requirements as a best practice for issuer key management – Validate the Card Verification Value (“CVV”) results for ATM transactions – Apply risk factors to POS spending, cash-back and quasi-cash to ATM withdrawal limit as
Slide 18: Issuer Critical Applications and Key Management Controls
Issuer Critical Applications and Key Management Controls – The issuer core processing application should not store sensitive authentication data or expose keys in software: • Full magnetic-stripe data, CVV, CVV2, PIN-blocks – Properly segment production HSM activities • Recommend hardware encryption
Slide 19: Key Learnings
Key Learnings Security breaches can be prevented if participants comply with: • PCI PIN Security Requirements • PCI Data Security Standard (“PCI DSS”) • PCI Payment Application DSS (“PCI PA-DSS”) • PCI Encryption PIN PAD (“EPP”) PIN Security Requirements And adhere to: • Compliant issuer key managem
Slide 20: For More Information
For More Information www.visa.com/pin www.visa.com/pinsecurity • PCI PIN Security Requirements v2 Jan. 2008 • PCI PIN Entry Device Testing and Approval Program Guide • Visa PIN Security Program: Auditor’s Guide • Frequently Asked Questions www.visa.com/cisp • Has PCI PIN, PCI DSS and PCI PA-DSS info
Slide 21: For More Information
For More Information • Visa Online – www.us.visaonline.com – PIN Fraud Management Issuer Quick Reference Guide – Visa Issuer Risk Management Guide - Tools and Best Practices for controlling Debit and Credit Card Fraud Losses • PCI Security Standards Council www.pcisecuritystandards.org – PCI POS PIN
Slide 22: Upcoming Visa PIN Security Trainings
Upcoming Visa PIN Security Trainings • One Day Visa Key Management Workshop – October 9, 2008 – Foster City, CA • Three Day Visa PIN Security Compliance Validation Training – October 28 - 30, 2008 – Foster City, CA To receive information on PIN Security trainings contact: pinusa@visa.com Visa Public
Slide 23: Questions?
VISA Questions? > | Visa Public