6
Important Security Notice
• Index tokens and pads (pads must be securely stored)
• Strong cryptography with associated key management processes and procedures. The MINIMUM account
information that must be rendered unreadable is the PAN. PCI Data Security Standard Requirement 3.4
The PAN must be rendered unreadable anywhere it is stored, even outside the payment application. Note: Strong
cryptography is defined in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms.
2.4 If disk encryption is used (rather than file- or column-level database encryption), logical access must be managed
independently of native operating system access control mechanisms (for example, by not using local user account
databases). Decryption keys must not be tied to user accounts. PCI Data Security Standard Requirement 3.4.2
2.5 Payment application must protect cryptographic keys used for encryption of cardholder data against disclosure
and misuse. PCI Data Security Standard Requirement 3.5
2.6 Payment application must implement key management processes and procedures for cryptographic keys used
for encryption of cardholder data. PCI Data Security Standard Requirement 3.6
2.7 Securely delete any cryptographic key material or cryptogram stored by previous versions of the payment ap-
plication, in accordance with industry-accepted standards for secure deletion, as defined, for example the list of
approved products maintained by the National Security Agency, or by other State or National standards or reg-
ulations. These are cryptographic keys used to encrypt or verify cardholder data. PCI Data Security Standard
Requirement 3.6
Note: This requirement only applies if previous versions of the payment application used cryptographic key materials
or cryptograms to encrypt cardholder data.
3. Provide secure authentication features
3.1 The payment application must support and enforce unique user IDs and secure authentication for all administra-
tive access and for all access to cardholder data. Secure authentication must be enforced to all accounts, generated
or managed by the application by the completion of installation and for subsequent changes after the "out of the
box" installation (defined at PCI DSS Requirements 8.1, 8.2, and 8.5.88.5.15) for all administrative access and for
all access to cardholder data. PCI Data Security Standard Requirements 8.1, 8.2, and 8.5.88.5.15
Note: These password controls are not intended to apply to employees who only have access to one card number
at a time to facilitate a single transaction. These controls are applicable for access by employees with administrative
capabilities, for access to servers with cardholder data, and for access controlled by the payment application. This
requirement applies to the payment application and all associated tools used to view or access cardholder data.
3.1.10 If a payment application session has been idle for more than 15 minutes, the application requires the user to
re-authenticate. PCI Data Security Standard Requirement 8.5.15.
3.2 Software vendors must provide guidance to customers that all access to PCs, servers, and databases with
payment applications must require a unique user ID and secure authentication. PCI Data Security Standard Re-
quirements 8.1 and 8.2
3.3 Render payment application passwords unreadable during transmission and storage, using strong cryptography
based on approved standards
Note: Strong cryptography is defined in PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms.
PCI Data Security Standard Requirement 8.4
4. Log payment application activity
4.1 At the completion of the installation process, the out of the box default installation of the payment application
must log all user access (especially users with administrative privileges), and be able to link all activities to
individual users. PCI Data Security Standard Requirement 10.1
4.2 Payment application must implement an automated audit trail to track and monitor access. PCI Data Security
Standard Requirements 10.2 and 10.3
5. Develop secure payment applications
#80136501-001 IDTech Windows SDK Guide for Kiosk III/IV
