This final set of standards we're going to look at will primarily
be used by financial institutions, so acquirers,
issuers, and the card brands or schemes themselves.
The 3D Core security standard specifies the security and the associated
key management for all the servers that may be involved in
authenticating a customer during a 3D secure session.
There are typically 3 different servers involved in a 3DS
authentication process, 1 at the acquirer,
which is called the 3DS server and which starts the authentication
process once that's been requested by the client, a directory server
that knows how to route requests to issuers, and then the server run
by the issuer that actually authenticates the cardholder and this is
known as the access control server, or ACS. The 3DS standard consists
of 2 parts, the baseline security requirements,
which is a good overall security standard and it broadly
equates to the same level of security as PCI DSS, and then
the 3DS security requirements,
which are focused on protecting the actual 3DS data and processes.
You're probably asking yourself well why is the standard split like this?
And it's because the general standard for all core participants,
but then not all of them see the same type of data so they
don't need to comply with both parts.
The 3DS security requirements are particularly interesting
because unlike PCI DSS, they also include requirements
focused on system availability, as well as confidentiality and integrity.
There is also a second 3DS standard, which is the 3DS software development kit,
or 3DS SDK standard.
This is for software development kit that is sold to
third‑party developers to allow them to use the 3DS protocols
as part of an app running on a device.
The 3DS SDK standard has sections that apply to
specific SDKs made by the company,
but also to the company itself that develops the SDK and those include
requirements around risk management and vulnerability management, so make
sure that if vulnerabilities are found in the SDK,
they're properly managed. Just as a 3DS standard will be only of
interest to financial institutions, the same is true of the security
requirements for a token service provider.
Remember that a token service provider's job is to issue a token that looks
just like a pan to a merchant or to a device and then keep a record of which
tokens relate to which original or funding pans.
The TSP standard requires PCI DSS as a baseline because, of course, the token
service provider has both real pans, as well as tokens.
The TSP standard then adds more stringent,
remote, logical, and physical security requirements,
along with requirements for cryptographic key
management using hardware security modules.
The final payment card industry standard we're going to meet is the card
production standard, it's a set of logical and physical standards that describe
the security around how cards are manufactured, personalized, and distributed
and also how PINs are sent to cardholders.
This standard is split into two documents,
one for physical controls and the other for logical controls, and because
it's concerned with looking after physical payment cards,
often in bulk,
there are actually a lot more physical security requirements than you
normally see in an information security standard.
It's a really interesting read if you normally just do logical
security and you haven't had the experience of a whole lot of
physical security requirements.
So looking back at our example of how a card and a PIN is made for
a consumer, the PCI card production standard will apply to
manufacturers, the Personalization Bureau,
how the Personalization Bureau receives data from the issuer, and how
the card and the PIN are sent to the cardholder.
If all the entities involved in card production comply with the standard,
the idea is it will stop criminals from stealing blank cards or personalized
cards and PINs from the manufacturing and distribution process,
and that will be really damaging for the industry because the
security of the issued card and its associated PIN are really
fundamental to payment card security.