Technology news and Jobs 
VIRTUALISATION PINs 'strongly protected' by Aussie ATM network
VIRTUALISATION PINs 'strongly protected' by Aussie ATM network | PINs 'strongly protected' by Aussie ATM network |
|
| by Stephen Withers | |
| Tuesday, 21 April 2009 | |
|
Page 1 of 2   
Featured Whitepaper
5 Best Practices for Smartphone Support
One method is to trick a hardware security module (HSM) into revealing the encryption key used to protect data in transit. HSMs are used around the world, so we wanted to find out whether customers of Australian banks and other financial institutions are at risk from this type of attack. Here's what Chris Hamilton, CEO of the Australian Payments Clearing Association (APCA; the body that manages and co-ordinates the EFTPOS and ATM system) had to say: "HSMs are secure cryptographic devices that are used worldwide, including in Australia, to protect cardholders' PINs. "APCA sets additional rules around the evaluation, configuration and management of these devices which are critical in protecting Australia's ATM and EFTPOS system against PIN-based attacks. "APCA's best practice arrangements for device evaluations provide strong protection for PINs. "Both the physical and logical security of HSMs must undergo evaluation by APCA accredited test laboratories against international security standards. "Only HSMs that have been approved by APCA can be deployed for use in Australia. "APCA's rules also set out stringent operational security standards for participating in Australia's ATM and EFTPOS system and regular audits are performed to ensure participants comply. "The rules for managing HSMs include specific requirements to protect against unauthorised software updates and to further protect PINs. "For example, decrypted PINs are only available inside a highly secure tamper-responsive module within the HSM for the minimal time required to process the transaction and are then actively deleted from memory. CONTINUED |
| < Next story in category | Previous story in the category > |
|---|
