PCI 3-D Secure

Three-Domain Secure (3DS) is a messaging protocol developed by EMVCo to enable consumers to authenticate themselves with their card issuer when making card-not-present (CNP) e-commerce purchases. EMV 3-D Secure is a new payment secure feature that supports app-based authentication and integration with digital wallets, as well as traditional browser-based e-commerce transactions. New cardholder authentication methods are introduced in the new 3-D Secure standards, including face recognition, fingerprint .

Overview

WHAT IS PCI 3DS?

The PCI Security Standards Council (PCI SSC) have announced two new security standards to support implementation EMV 3D Secure (3DS) protocol of EMVCo. EMV® 3DS helps prevent unauthorized card-not-present (CNP) transactions. It protects merchants from exposure to CNP fraud by enabling consumers to authenticate themselves with their card issuers when making online purchases through web browsers or via mobile applications. EMVCo and PCI SSC work together ensure EMV the 3DS function, and the related data and environment security, are all in good order for the successful and complete implementation of the entire 3DS ecosystem.

EMV® 3DS solutions make it more increasingly difficult for criminals to obtain cardholder data (CHD) in online payment channels. “As CNP fraud continues to be a challenge here globally, PCI SSC is pleased to be able to provide support for the secure implementation of these solutions.”

“Dynamic authentication is becoming increasingly important to securing payments in an omni-channel world,” added PCI SSC Chief Technology Officer Troy Leach. “A new and improved EMV® 3DS protocol supported by PCI Security Standards will enhance the security of 3DS infrastructures and transactions and improve dynamic authentication for e-commerce and m-commerce environments.”

More About PCI SSC

3DS Standard

The PCI Security Requirements and Assessment Procedures for EMV® 3-D Secure Core Components: ACS, DS, and 3DS Server (referred to as PCI 3DS Core Security Standard) and the PCI Security Requirements and Assessment Procedures for EMV® 3-D Secure SDK (referred to as PCI 3DS SDK Security Standard) focus on securing the EMV® 3DS infrastructure that supports 3DS transactions:

EMVCo

EMV which represents Europay, MasterCard and Visa are the first three companies to set the standard. Currently, the standard is managed by EMVCo. EMVCo was first established by the three organizations of EMV in February 1999. Currently, it is jointly held by AE, Discover, JCB, MasterCard, Union Pay and Visa.

The main task department develop product specifications, standards and certification for 3DS, supervise and ensure the global security interoperability.ACS, DS, and 3DSS products is required by EMV 3DS 2.0 standard including the 3DS SDK standard for the specification of the mobile device. All 3DS products need to be complied by EMVCo before entering the market of 3DS service.

Card Brands

Participate in 3DS card brands consists of AE, Discover, JCB, MasterCard, the Union Pay and Visa. Card brands prescribe the Implementation Guidance of service institutions and operation specification of 3DS standard connect with the original Payment system.

Card brands also prescribe payment institutions which are issuer , merchants and service providers use the 3DS 2.0 trading card not present (CNP) Liability Transfer deadline. Such as Visa card issuers current do not support 3DS 2.0 then force liability transfer to them on April 2019.

According to Implementation Guidance and test standards, card brands verify 3DS products. After verified , card brands authorize agent which begin to provide 3 DS trading services with Letter of Approval. Payment institutions are required to card data environment and data security by card brands. In order to meet the requirement, payment institutions need to have compliance by QSA company which is approved by PCI SSC.

PCI SSC & QSA Company

PCI SSC is composed of AE, Discover, JCB, MasterCard, and Visa, mainly in setting and maintaining the security standards related to the payment card industry including the PCI DSS, PCI 3DS, PCI 3DS SDK Security Requirements. PCI SSC is responsible for the selecting, training and verifying QSA company (Qualified Security Assessor) which execute standards and compliance assessment. Secure Vectors is the first certificated QSA company in PCI 3DS.

Payment institutions issuer Banks (Issuer) and ACS (Access Control Server) are assessed by EMV product inspection, the card brands operation test, issuer bank operating environment. In order to get report of ROC and AOC with compliance , issuer is required data security by QSA company which based on PCI 3DS security standards requirements. Begin to provide 3DS services after delivering the report to card brands. The 3DSS system used by the service provider or merchant also need to pass the same compliance and meet the implementation specifications of the card brands.

How to do

1. Confirmed products (ACS, DS, 3DSS) have been approved by EMV

EMVCo® 3-D Secure – Protocol and Core Functions provides Specification v2.0 (EMV 3DS 2.0) for 3DS products (ACS, DS, 3DSS, 3DS SDK) features and specifications testing. To ensure Interoperability between products, EMVCo will award the product Letter of Approval and publish that in EMVCo’s website.

2. Establish a PCI 3DS environment based on PCI 3DS Security standard

PCI 3 DS standard (Security Requirements and Assessment Procedures for EMV ® 3-d Secure Core Components: ACS, DS, and 3DS Server) contains two parts :

Part 1: 3DS Baseline Security Requirements include the safety Requirements of the 3DS operating environment.

Part 2: 3DS Security Requirements are the system Security and data Security Requirements of the 3DS system.

The payment institutions or service provider shall conduct all technical and management requirements for the environment, personnel, system and data security in accordance with the corresponding systems and their PCI 3DS standards.

If payment institutions or service supplier with environment or the operation environment of the 3DS system has already passed the PCI DSS compliance, and PCI DSS compliance audit scope is the same as PCI 3DS operation requirements, then only Part 2 of PCI 3DS needs to be assessed .

3. Ensure the preservation and compliance of 3DS data

In order to ensure that the handling process of 3DS transaction Data complies with PCI 3DS standards requirements, payment institutions or service provider shall ensure their existing or planned processes for cardholder data flow and storage are based on PCI 3DS Data Matrix for Data storage, security and protection. These include protection and preservation requirements for Authentication data, Key data and Cryptographic Key (for ACS, DS). Certain types of information shall also not be stored on the system. Please consult our consultants for more details.

4. Prepare and implement related procedures and management assignments

PCI 3DS provides a set of common standards for payment institutions and service providers to establish management policies and procedures to ensure the security management of 3DS services in accordance with PCI 3DS specifications, such as access control policies and software development procedures. PCI 3DS also dictates strict records keeping requirements such as risk assessment results, relevant records of software and hardware, network architecture diagram , data flow diagram and all the testing and implementation records.

5. Technical testing of compliance requirements

PCI 3DS requires the following technical tests.

Software Security Tests
Quarterly Internal and External Vulnerability Scans
Annual Penetration Tests

Relevant tests may be conducted by a professional technology testing company or by an in-house specialist. The external vulnerability scan requires the use of a PCI SSC approved ASV.

6. PCI 3DS Assessment

PCI 3DS assessment can only be performed by a PCI SSC approved PCI 3DS QSA company a list of which can be found on the PCI SSC website. Secure Vectors Information Technologies Inc. is currently among a small group of PCI SSC approved QSA companies to do PCI 3DS review services in the Asia-Pacific region. PCI 3DS assessment work can vary based on the size and environment of the client organization. The first step is a scoping of the work. .The assessment phase which includes on-site reviews range from 3 to 5 days of on-site work. Upon completion of the assessment, the Report On Compliance (ROC) is signed by the QSA company and then signing of Attestation of Compliance (AOC) by the client organization.

The assessed entity shall submit the annual assessment of AOC or ROC according to the requirements of the card brands or the acquiring bank. The PCI 3DS certification is done annually.

Contact us！

About Us

Sitemap