MasterCard halts remote POS security upgrades

Gartner says move would slow migration to stronger encryption for payment systems

In a purported second major security change in recent weeks, MasterCard has decided to disallow merchants' use of remote key injection (RKI) services to install new encryption keys on point-of-sale (POS) systems, says a Gartner analyst.

Such a decision would mean that merchants hoping to upgrade the encryption on their POS terminals in an automated fashion over their networks would instead need to continue doing it manually and one terminal at a time in a secure off-site facility.

MasterCard's decision would also raise questions about the considerable investments made by payment systems vendors in developing remote key injection (RKI) capabilities over the past few years.

"Nobody understands the rationale for this," Gartner analyst Avivah Litan said, adding that she was informed recently of the development by two major retailers.

MasterCard did not respond to multiple requests for comment and would neither confirm nor deny Litan's finding.

"This really [has thrown] a wrench in people's plans," Litan said. Merchants were counting on remote key injection for quickly upgrading their terminals to Triple Data Encryption Algorithm standards (TDES) as required under the Payment Card Industry Data Security Standard (PCI), she said. "POS vendors were all about to release this capability after spending lots of R&D and engineering money making it happen."

RKI technologies and services are designed to make the process of upgrading data encryption keys on POS terminals quicker and cheaper than current manual methods because keys can be distributed to multiple POS systems directly over secure network connections and the Internet.

The approach is believed to be faster and cheaper than current processes, which typically require each terminal to be removed from its usual location and taken to a secure room at an Encrypting Service Organization, where the key is installed manually by specialists.

The process can be especially cumbersome and time-consuming in situations where a company might have thousands of POS terminals which need to be upgraded at the same time.

Though it is still a relatively new capability, vendors such as Hypercom and Futurex have begun offering RKI services.

MasterCard's move, if confirmed, is "quite interesting," said Jim Huguelet, an independent PCI analyst. "Although not widespread, there is growing interest by merchants in RKI technologies that reduce the cost of ownership associated with periodic encryption key replacement," he said.

MasterCard's purported surprise decision comes at a time when merchants are under a deadline to migrate all of their point of sale terminals from DES to Triple DES by July 2010.

The deadline is part of a PCI requirement aimed at getting merchants to implement stronger encryption at retail locations. A move by MasterCard to disallow RKI would make it all but certain that many organizations would miss that deadline by a wide margin, Litan said.

The move would mark a second major change MasterCard has made on security. On June 15, the company sent out an advisory to acquiring banks and payment processors stating that all Level 2 merchants -- or those processing between 1 million and 6 million payment cards annually -- would be required to undergo annual security audits by third-party assessors.

Previously, such merchants were only required to submit self-assessment questionnaire attesting to their compliance with PCI standards.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags PCI secuity standardGartnerposmastercard

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Computerworld
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?