MasterCard halts remote POS security upgrades

Gartner says move would slow migration to stronger encryption for payment systems

In a purported second major security change in recent weeks, MasterCard has decided to disallow merchants' use of remote key injection (RKI) services to install new encryption keys on point-of-sale (POS) systems, says a Gartner analyst.

Such a decision would mean that merchants hoping to upgrade the encryption on their POS terminals in an automated fashion over their networks would instead need to continue doing it manually and one terminal at a time in a secure off-site facility.

MasterCard's decision would also raise questions about the considerable investments made by payment systems vendors in developing remote key injection (RKI) capabilities over the past few years.

"Nobody understands the rationale for this," Gartner analyst Avivah Litan said, adding that she was informed recently of the development by two major retailers.

MasterCard did not respond to multiple requests for comment and would neither confirm nor deny Litan's finding.

"This really [has thrown] a wrench in people's plans," Litan said. Merchants were counting on remote key injection for quickly upgrading their terminals to Triple Data Encryption Algorithm standards (TDES) as required under the Payment Card Industry Data Security Standard (PCI), she said. "POS vendors were all about to release this capability after spending lots of R&D and engineering money making it happen."

RKI technologies and services are designed to make the process of upgrading data encryption keys on POS terminals quicker and cheaper than current manual methods because keys can be distributed to multiple POS systems directly over secure network connections and the Internet.

The approach is believed to be faster and cheaper than current processes, which typically require each terminal to be removed from its usual location and taken to a secure room at an Encrypting Service Organization, where the key is installed manually by specialists.

The process can be especially cumbersome and time-consuming in situations where a company might have thousands of POS terminals which need to be upgraded at the same time.

Though it is still a relatively new capability, vendors such as Hypercom and Futurex have begun offering RKI services.

MasterCard's move, if confirmed, is "quite interesting," said Jim Huguelet, an independent PCI analyst. "Although not widespread, there is growing interest by merchants in RKI technologies that reduce the cost of ownership associated with periodic encryption key replacement," he said.

MasterCard's purported surprise decision comes at a time when merchants are under a deadline to migrate all of their point of sale terminals from DES to Triple DES by July 2010.

The deadline is part of a PCI requirement aimed at getting merchants to implement stronger encryption at retail locations. A move by MasterCard to disallow RKI would make it all but certain that many organizations would miss that deadline by a wide margin, Litan said.

The move would mark a second major change MasterCard has made on security. On June 15, the company sent out an advisory to acquiring banks and payment processors stating that all Level 2 merchants -- or those processing between 1 million and 6 million payment cards annually -- would be required to undergo annual security audits by third-party assessors.

Previously, such merchants were only required to submit self-assessment questionnaire attesting to their compliance with PCI standards.

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags PCI secuity standardGartnerposmastercard

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?