Соответствие требованиям

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Payment Card Industry 3-D Secure (PCI 3DS)

Стандарт

Security Objective 2.5

Для проведения оценки соответствия по документу войдите в систему.

Список требований

3DS SDK Security Requirements and Assessment Procedures
Security Objective 2: Protect Sensitive 3DS SDK Data Elements
Certain types of information collected in association with 3DS transactions are highly sensitive in nature and must be protected from unauthorized disclosure. Such information might include, but is not limited to, cardholder data (CHD), 3DS authentication data, cryptographic keys, and consumer device information. Refer to Table 2, “Sensitive 3DS SDK Data Elements,” in the “Scope of Security Requirements” section for more information on which specific 3DS SDK dataelements require protection from unauthorized disclosure.
Requirement 2: Sensitive 3DS SDK data elements are protected from unauthorized disclosure.
Requirements:
2.5 Hardcoded 3DS SDK Data Elements
Sensitive 3DS SDK data elements are not hard-coded in 3DS SDK code unless explicitly permitted.
Assessment Procedures:
T.2.5.1 Referring to testing performed in Requirement 2.4, “Protection against Disclosure through Unintended Channels,” the tester shall confirm that sensitive 3DS SDK data elements are not hardcoded in the 3DS SDK except where the vendor has maintained reasonable and documented justification for their use.
T.2.5.2 The tester shall test the 3DS SDK by performing a series of 3DS operations, ensuring that these cover all functionality provided by the 3DS SDK, and observe the use of sensitive 3DS SDK data elements across multiple operations and executions of the 3DS SDK. Where sensitive 3DS SDK data elements appear to have the same value or a limited range of values, the tester shall confirm that these values correctly and completely align with those values noted in T.2.5.1.
Note: This testing must be performed against a 3DS test host/harness that has been confirmed to provide all required 3DS functionality and data elements.
Guidance:
The 3DS SDK, as part of its normal functionality, will be exposed to and handle various sensitive 3DS data elements. For example, the directoryServerIDs public keys will be issued after certification and stored by the 3DS SDK. It is fairly trivial to reverse-engineer mobile applications (for example, using dex2jar or JAD) and perform analysis on the source code itself with intent to harvest hard-coded sensitive information. To prevent that, the 3DS SDK should not store any sensitive 3DS SDK data elements in the source code unless explicitly permitted. Instead⎯in the case of cryptographic keys, for example⎯the 3DS SDK could fetch the data from an HSM, then store the keys locally utilizing the most secure storage options (for example, keychain, key store, or shared preferences) provided by the operating system where appropriate. Refer to Table 2, “Sensitive 3DS SDK Data Elements,” in the “Scope of Security Requirements” section for more information on which sensitive 3DS SDK data elements are permitted to be retained.

Название	Severity	IP	Integral
1111111 111 11 1111 11111111111111111 1111111 1 11111111111111111	-	1	-
11 111111111 111 1111111111111111111111111 1111 1 11111 1111111	-	1	-

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.