The Payment Card Industry Security Standards Council (PCI SSC) has released v2.0 of the PIN Security Requirements, according to a PCI SSC news release.
The program contains a complete set of requirements for the secure management, processing and transmission of personal identification number data at ATMs and attended and unattended point-of-sale terminals.
PCI PIN Security Requirements v2.0 aims to enhance usability and understanding by stating the requirements in a more granular manner, the council said.
Of note is the incorporation of testing procedures into the requirements, which resulted in two versions of the document — PCI PIN Security Requirements v2.0 and PCI PIN Security Requirements and Test Procedures v2.0. The council said that including testing producers in a separate version will facilitate a smoother evaluation and deeper understanding of the requirements.
The council also has published a Summary of Significant Changes document that provides a high-level look at the significant modifications to the requirements.
Examples of common vulnerabilities for PIN theft addressed by requirements include:
-PINs that are not protected by use of a secure PIN block;
-failure to use approved cryptographic devices for PIN processing;
-cryptographic keys that are non-random and non-unique to each POI device, and keys that never change;
-few, if any, documented PIN-protection procedures; and
-audit trails or logs that are not maintained.
“Criminals are actively targeting the point of sale and it’s up to us as a community to stop them in their tracks,” said Stephen W. Orfei, general manager of the PCI SSC. “The requirements enhance the protection of devices that accept PINs with the end goal of securing cardholder data at the POS.”
“With 1.0 we introduced requirements for the secure management, processing and transmission of PIN data at ATMs, and attended and unattended point-of-sale terminals,” said Troy Leach, chief technology officer for the PCI SSC. “Version 2.0 builds on this by improving clarity to ease understanding. The addition of testing criteria will ensure that these products are being tested and validated against the highest level of security.”
The PIN Security Requirements are included in the current PTS Security Requirements. Program requirements and a list of approved devices are available for download.