Соответствие требованиям

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Payment Card Industry 3-D Secure (PCI 3DS)

Стандарт

Security Checks 1.5

Для проведения оценки соответствия по документу войдите в систему.

Список требований

3DS SDK Security Requirements and Assessment Procedures
Security Objective 1: Protect the Integrity of the 3DS SDK
To protect the sensitive information handled by the 3DS SDK and to facilitate secure and trustworthy 3DS SDK transactions, the 3DS SDK must implement measures to defend itself in what must be assumed to be a hostile environment (such as in a mobile application operating on a consumer mobile device). Some of the key risks associated with mobile applications and components include threats associated with a “rooted” or “jailbroken” device and threats from other applications operating within the same environment (and with access to shared resources). Appropriate detective and protective mechanisms must be implemented to ensure that the integrity of the 3DS SDK and sensitive 3DS SDK data elements is maintained. Refer to Table 2, “Sensitive 3DS SDK Data Elements,” in the “Scope of Security Requirements” section of this document for more information on which specific 3DS SDK data elements require protection from unauthorized modification.
Requirement 1: Mechanisms are implemented to prevent unauthorized modification of the 3DS SDK, the functionality it provides, and the sensitive 3DS SDK data elements it handles.
Requirements:
1.5 Protection of 3DS SDK Reference Data
3DS SDK Reference Data is securely stored within the 3DS SDK code to prevent unauthorized modification.
Assessment Procedures:
T.1.5.1 The tester shall examine vendor materials and other evidence to identify all 3DS SDK Reference Data used or required by the 3DS SDK, which must be protected against modification (see Table 2, “Sensitive 3DS SDK Data Elements”).
T.1.5.2 The tester shall examine vendor materials and other evidence to confirm that features are provided by the 3DS SDK to protect each element of the 3DS SDK Reference Data listed above. Where there is any 3DS SDK Reference Data that is not covered by these protections, the tester shall confirm that the lack of protection does not affect the security of the 3DS SDK or 3DS transaction process.
T.1.5.3 Where cryptography is implemented for the purposes of providing this protection, the tester shall confirm that the cryptographic protections include the protection of the integrity of the data. The tester shall also confirm that cryptography meets PCI requirements for strong cryptography, including applicable cryptography requirements in this standard, and that all keys used for these cryptographic operations are protected.
T.1.5.4 Where obfuscation is implemented to provide the protections, the tester shall confirm that this obfuscation is covered under testing performed in Requirement 1.4, “Protection against Reverse Engineering.”
T.1.5.5 Where device-specific features are relied upon to provide the protections, the tester shall attempt to execute the 3DS SDK on a system that either does not provide such features or has been modified to prevent the secure use of these features to confirm that the 3DS SDK does not execute when such features are absent or disabled.
T.1.5.6 The tester shall attempt to circumvent the features protecting the 3DS SDK Reference Data and modify this data in such a way that the modification is not detected by the 3DS SDK upon execution to confirm the 3DS SDK prohibits such modifications. This testing must consider the different types of protections applied and devices targeted by the SDK.
Guidance:
The 3DS SDK Version Number and 3DS SDK Reference Number are values used during 3-D Secure transactions as part of the cardholder authentication process. To properly vet the cardholder and to identify the trustworthiness of the environment in which a transaction has been created, it is important that the values are protected from unauthorized modification. Examples of methods for securely storing the 3DS SDK Reference Number or 3DS SDK Application ID (sdkAppID) in code might include obfuscation or the use of cryptography.

Название	Severity	IP	Integral
1111111 111 11 1111 11111111111111111 1111111 1 11111111111111111	-	1	-
11 111111111 111 1111111111111111111111111 1111 1 11111 1111111	-	1	-

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.