Before we begin to examine the details of MPoC Standard requirements and how to comply with them, we will answer some questions about the Standard’s purpose, structure, and measurement criteria.
PCI MPoC is the PCI Mobile Payments on COTS standard, here referred to as the MPoC Standard. It defines security and test requirements for entities involved in the development, deployment, and operation of mobile payment solutions that use COTS (commercial-off-the-shelf) devices.
The Standard covers mobile payment acceptance solutions designed for use on COTS devices like smartphones and tablets with or without a dedicated hardware security element (e.g., PIN entry on the touchscreen). MPoC supports both attended and unattended payment scenarios.
The ultimate goal of the requirements in the MPOC Standard is to provide a flexible and future-proof security framework that protects the confidentiality and integrity of the sensitive payment information process by MPoC solutions.
The PCI MPoC Standard contains a section on its relationship with other PCI standards (pp. 33-35).
The requirements in PCI MPoC have a modular, risk-based division for different deployment models. They are split up into five domains with each domain containing multiple modules and subsections.
Domain 1 is the largest domain and will be the main (although not exclusive) focus for this compliance checklist. It lays out security and test requirements that apply to MPoC software, lifecycle processes, sensitive information, and secure channels.
The online PCI SSC Glossary provides relevant list of abbreviations and acronyms. However, there is a further Glossary of Terms in the PCI MPoC document (Table 1). It contains important definitions for cybersecurity terms like Attestation, Encryption, Obfuscation, and Tamper detection that are vital in understanding the security and test requirements contained in the MPoC Standard.
Appendix B of the PCI MPoC Standard contains an Attack Costing Framework. This framework outlines a method for testers to rate attack feasibility according to the prescribed Test Requirements contained in each section. These are the relevant factors for attack rating.
At five places in the PCI MPoC Standard, a minimum of 25 points is required to pass a particular requirement. Four of these are relevant to Promon’s offerings and will be highlighted below. It is the contention of Promon that our products enable MPoC software to meet these requirements and protect assets to an attack rating of at least 25 points using this framework.
Our approach at Promon is to communicate with honesty and present compliance material you can trust. We believe in the need for a transparent and targeted appraisal of what Promon products can offer, and where we can provide the most help.
Our method in this PCI MPoC Standard compliance checklist will break down the material into the modules and sections most relevant to our products and the attack rating score. Then, we will summarize the requirements for that module. Finally, we will outline how Promon products can help you to meet those requirements.
These are the modules that provide the focus for our compliance checklist:
Module 1A-3 covers cryptography. This is employed to ensure data confidentiality and process integrity in MPoC solutions. Only industry-recognized standard cryptographic algorithms and operations may be employed. Any cryptographic keys must be used for a single specific purpose.
Promon products provide a high level of compliance relevance to this section.
Promon Asset Protection™ offers security mechanisms such as:
Module 1B-1 covers the topic of those software security mechanisms that protect the COTS-based MPoC software from cyberattacks like reverse engineering, modification, and monitoring. These mechanisms need to play both preventive and detection roles in protecting MPoC assets. Those who design them must consider issues such as coverage, integration between mechanisms, and protection strength.
Two important sections in 1B-1 are:
Promon products provide a high level of compliance relevance to this section.
Promon SHIELD® for Mobile, IP Protection Pro™ and Promon Asset Protection™ offer security mechanisms such as:
Although protection for cryptographic operations can be provided by tamper-responsive hardware devices, software methods may also be used. These software methods could include the obfuscation of cryptographic functions and white-box cryptography. The MPoC standard doesn’t mandate any methods, as long as they are robust.
An important section of 1B-2 is 1B-2.7. This requires that the software-protected cryptography prevents the extraction of partial or complete cryptographic material to an attack rating of 25 points.
Promon products provide a partial level of compliance relevance to this section.
Promon Asset Protection™ offers security mechanisms such as:
Attestation and monitoring (A&M) must cover the COTS platform, and the COTS-based MPoC software. The goal here is to assess the integrity of the platform and software. The standard requires that this is assessment must cover the complete software lifecycle and may involve different levels of checks. But it must possess some level of A&M at runtime, so that compromises such as rooting, jailbreaking, and other vulnerable states are detected.
Promon products provide a high level of compliance relevance to this section.
Promon SHIELD® for Mobile and Promon App Attestation™ offer security mechanisms such as:
Attestation is performed by measuring the ability of the COTS platform, and COTS-based MPoC Software to detect potential attacks. Measurements are collected by the A&M back-end, along with the analysis performed on measurements. All COTS devices must contribute to measurement data, enhancing its quality and that of any detection methods used.
Specific requirements include methods to ensure that all measurement data is fresh and authentic, and that data monitoring is continual. The standards recommend the employment of continual background checks that are not resource intensive or intrusive e.g., debugging (1C-2.4).
Promon products provide a high level of compliance relevance to this section.
Promon SHIELD® for Mobile and Promon App Attestation™ offer security mechanisms such as:
A&M must possess the ability to respond to any potential attacks that it has identified. The response process must be data-led and documented. Attacks detected by the A&M of the COTS-based MPoC Software must be reported to the A&M back-end.
Promon products provide a complete level of compliance relevance to this section.
Promon SHIELD® for Mobile and Promon App Attestation™ offer security mechanisms such as:
A&M is a high-value target for attackers. Modification of A&M data or code can allow for the bypass of security mechanisms. The COTS-based MPoC Software needs to be protected against tampering and secured from alteration. The back-end must be able to detect failures in A&M functions.
An important section in the anti-tampering requirements of 1C-4 is 1C-4.4. It requires that any A&M used by the COTS based MPoC software is resistant to tampering to an attack rating of 25 points using the attack-costing framework. This is important, since a compromise on A&M component on the COTS device or data transmitted to the back-end “may be the same as effectively disabling security checks”, according to the Standard.
Promon products provide a complete level of compliance relevance to this section.
Promon SHIELD® for Mobile and Promon App Attestation™ offer security mechanisms such as:
Application security requirements covers all security mechanisms that MPoC Applications that share or access the memory of the COTS-based MPoC Software they are integrating. These MPoC apps must be created using secure software development best practices and meet the Secure Software Lifecyle (SLC) requirements.
An important section of 2B-1 is 2B-1.2, which requires that MPoC Application data and code are protected against modification to an attack rating of 25 points using the attack costing framework. The standard is explicit that such anti-tampering resistance must include protection at runtime, as well as the configuration files and binary code of the app.
Promon products provide a complete level of compliance relevance to this section.
Promon SHIELD® for Mobile, Promon IP Protection Pro™, Promon App Attestation™, Promon Asser Protection™, and Promon SDK Protection™ offer security mechanisms such as:
There are two more points made by the PCI MPoC Standard that are important to highlight in this compliance checklist.
When discussing the MPoC solution in Domain 5, the Standard makes these points about liability:
Promon products can contribute to this composite security solution for PCI MPoC compliance.
The Standard is clear on the need for a multi-layered approach to security. Layered security architecture means that multiple levels of protection must be bypassed before an attacker can extract an asset, whether in a full or partial attack.
When covering the Attack Costing Framework in Appendix B, the Standard explains the requirement of “Layered security” in software tamper-response systems and technology. Such a layered approach must give consideration to layer numbers, relevance, and likely attack stages.
Promon’s products and technology work together in building protection layers for the MPoC software. So, for example, while the SHIELD RASP benefits by themselves are significant and add multilayered runtime security, they should be considered together with the solutions for obfuscation, software, and hardware attestation as well as cryptography. Together, these protections reinforce each other providing world-class, state-of-the-art protection.