Visa Biometric M & E Guide

8.1. SSL(Secure Sockets Layer)

SSL is a standard IT security technology offering for establishing an encrypted link between a server and a client—typically a web server (website) and a browser, or a mail server and a mail client (e.g., Outlook).

SSL allows sensitive applicant’s information such as credit card numbers, social security numbers, personal identification numbers and login credentials to be transmitted securely. Normally, application data sent between browsers and web servers is sent in plain text—leaving the applicant vulnerable to eavesdropping and hacking. If an attacker is able to intercept the data being sent between a browser and a web server, they can see, steal, distort or use that information.

More specifically, SSL is applicable to the Visa Biometric platform as a security protocol which describe how algorithms should be used. In this case, the SSL protocol determines variables of the encryption for both the link and the data being transmitted. Availability of SSL is therefore an absolute necessity.

The Assessor must confirm the presence of SSL applying www.ssltools.com or https://www.sslshopper.com/ssl-checker.html.

8.2. PCI DSS (Payment Card Industry Data Security Standard)

The Assessor is to note that PCI compliance where the Visa Biometrics offering is concerned is not a single event, but a process. The PCI DSS was established by the major card brands (Visa, Mastercard, American Express, etc,). All businesses that process, store, or transmit payment card data are required to implement the standard to prevent cardholder data theft and in the case of the Visa Biometric Project, loss of revenue to Project Owner. As technology and card processing situations change, Security Metrics (Tool Makers) provide a fully-supported PCI solution designed to help the user achieve and maintain PCI compliance. The Assessor is well advised to check for the availability of this resource.

The Assessor must determine the presence of PCI DSS in the payment platform applying www.checkpcidss.com.

8.3. Tokenization Standard

Tokenization is another form of security measure often adopted by payment platforms. It is the process of replacing sensitive data with unique identification symbols that retain all the essential information about the data without compromising its security. Tokenization, seeks to minimize the amount of data a business needs to keep on hand. It has become a popular way for small and midsized businesses to bolster the security of credit card and e-commerce transactions while minimizing the cost and complexity of compliance with industry standards and government regulations.

Payment card industry (PCI) standards do not allow credit card numbers to be stored on a retailer’s point-of-sale (POS) terminal or in its databases after a transaction. To be PCI compliant, therefore, merchants must install expensive end-to-end encryption systems or outsource their payment processing to a service provider who provides a “tokenization option.” The service provider handles the issuance of the token value and bears the responsibility for keeping the cardholder data locked down.

In such a scenario, the service provider issues the merchant a driver for the POS system that converts credit card numbers into randomly-generated values (tokens). Since the token is not a primary account number (PAN), it can’t be used outside the context of a specific unique transaction with that particular merchant. In a credit card transaction as is expected to be encountered daily with the Visa Biometric transaction, for instance, the token will typically contain only the last four digits of the actual card number. The rest of the token will consist of alphanumeric characters that represent cardholder information and data specific to the transaction underway.

Tokenization makes it more difficult for hackers to gain access to cardholder data, as compared with older systems in which credit card numbers were stored in databases and exchanged freely over networks. Tokenization technology can, in theory, be used with sensitive data of all kinds including biometric visa transactions, bank transactions, medical records, criminal records, vehicle driver information, loan applications, stock trading and voter registration.

The Assessor may therefore feel free to recommend Tokenization standard where there is doubt about the safety/security of any aspect of the visa biometrics offering.

8.4. 3D Secure

3-D Secure is an authenticated payment system to improve online transaction security and encourage the growth of e-commerce payments. Collectively Visa, MasterCard and AMEX secure systems are the GOLD standards and brand identities of the 3-D Secure Cardholder Authentication Scheme.

3-D Secure systems recreate the high level of security of a physical payment environment by requesting further payment authentication. The objective is to provide a safe and secure online payment experience across all three domains using a password that is validated by the card issuer and further checked by all other parties involved in the transaction.

8.5. Data Masking

Data masking is a security feature which refers to the process of changing certain data elements within a data store so that the structure remains similar while the information itself is changed to protect sensitive information. Data masking ensures that sensitive applicant information is unavailable beyond the permitted production environment. Acquisition of this feature should be highly encouraged.

8.6. Data erasure

Data erasure (also called data clearing or data wiping) is a software-based method of overwriting the data that aims to completely destroy all electronic data residing on a hard disk drive or other digital media. Permanent data erasure goes beyond basic file deletion commands, which only remove direct pointers to the data disk sectors and make the data recovery possible with common software tools. Unlike degaussing and physical destruction, which render the storage media unusable, data erasure removes all information while leaving the disk operable.

Data erasure features are to be discouraged altogether in all the Visa Biometrics offerings as it may be used for purpose of fraud. The Assessor should watch out for this and other similar features and ensure its presence in the platform is escalated.

8.7. Communication Protocol

Communication protocols are formal descriptions of digital message formats and rules. They are required to exchange messages in or between computing systems and are required in telecommunications.

Communications protocols cover authentication, error detection and correction, and signaling. They can also describe the syntax, semantics, and synchronization of analog and digital communications. For the Visa Biometric offerings, communications protocols are implemented in both hardware and software. There are thousands of communications protocols that are used everywhere in analog and digital communications. Computer networks cannot exist without them.

8.8. IT Disaster Recovery Plan

Disaster recovery in the context of the Visa Biometrics project refers to action taken by the Service Provider to restore hardware functionality, applications and data in time when the system suddenly crashes or stops working due to lack of adequate maintenance, accident, power failure or even deliberate enemy action.

The eVisa project disaster recovery plan is designed to take cognizance of the Nigerian Immigration Service business continuity plan. Priorities and recovery time objectives are therefore tailored towards ensuring minimum disruption to organizational activities. The strategy must be to restore hardware, applications and data functionality in time to meet the needs of the business recovery.

The large volumes of sensitive electronic information or data are so important and vital to national security and the continued relevance of the operation of the Immigration Service. The impact of data loss prolonged disruption or corruption from hardware failure, human error, hacking or malware is capable of creating a national emergency. The assessor must therefore ensure that a plan for data backup and restoration of electronic information is available and well documented for training purposes.