3 ms·
I think you're looking for something like PCI DSS compliance, which requires you to store keys in a HSM, and is much more prescriptive with key management.
by 1970-01-01 4y ago
I think you're looking for something like PCI DSS compliance, which requires you to store keys in a HSM, and is much more prescriptive with key management.
- bob1029 4y agoPCI-DSS is incredibly aggressive with key management considerations. They get down to radio frequency concerns in pin pad hardware, etc. It took us ~2 years of back & forth with various parties & auditors to get per-client exclusions for accepting end-customer debit PIN codes in-branch on an iPad screen. These banks do not have fully-compliant solutions and must have exceptions on file.
- joezydeco 4y agoWasn't SPoC supposed to help with that?
- bob1029 4y agoIt showed up too late. We did our integration 2016-2017. We were held to far more unrealistic standards at the time.
- patch_cable 4y agoYou may be confusing PCI-DSS versus PCI-PIN, which are a little different. You’re right about the requirements around acquiring pins though.