This document describes and specifies a framework for the management of the security of MFS. It includes<\/p>\n
a generic model for the design of the security policy,<\/p>\n<\/li>\n
a minimum set of security requirements,<\/p>\n<\/li>\n
recommended cryptographic protocols and mechanisms for mobile device authentication, financial message secure exchange and external authentication, including the following:<\/p>\n
point-to-point aspects to consider for MFS;<\/p>\n<\/li>\n
end-to-end aspects to consider;<\/p>\n<\/li>\n
security certification aspects;<\/p>\n<\/li>\n
generation of mobile digital signatures;<\/p>\n<\/li>\n<\/ol>\n<\/li>\n
interoperability issues for the secure certification of MFS,<\/p>\n<\/li>\n
recommendations for the protection of sensitive data,<\/p>\n<\/li>\n
guidelines for the implementation of national laws and regulations (e.g. anti-money laundering and combating the funding of terrorism (AML\/CFT), and<\/p>\n<\/li>\n
security management considerations.<\/p>\n<\/li>\n<\/ul>\n
In order to avoid the duplication of standardization work already performed by other organizations, this document will reference other International Standards as required. In this respect, users of this document are directed to materials developed and published by ISO\/TC 68\/SC 2 and ISO\/IEC JTC 1\/SC 27.<\/p>\n
| PDF Pages<\/th>\n | PDF Title<\/th>\n<\/tr>\n | ||||||
|---|---|---|---|---|---|---|---|
| 7<\/td>\n | Foreword <\/td>\n<\/tr>\n | ||||||
| 8<\/td>\n | Introduction <\/td>\n<\/tr>\n | ||||||
| 11<\/td>\n | 1 Scope 2 Normative references <\/td>\n<\/tr>\n | ||||||
| 12<\/td>\n | 3 Terms and definitions <\/td>\n<\/tr>\n | ||||||
| 14<\/td>\n | 4 Abbreviated terms <\/td>\n<\/tr>\n | ||||||
| 15<\/td>\n | 5 Summary of the technical nature of the clauses <\/td>\n<\/tr>\n | ||||||
| 17<\/td>\n | 6 Security management considerations 6.1 General <\/td>\n<\/tr>\n | ||||||
| 18<\/td>\n | 6.2 Three-layer model to manage security for mobile financial services <\/td>\n<\/tr>\n | ||||||
| 19<\/td>\n | 6.2.1 Process layer <\/td>\n<\/tr>\n | ||||||
| 20<\/td>\n | 6.2.2 Application layer 6.2.3 Infrastructure layer <\/td>\n<\/tr>\n | ||||||
| 21<\/td>\n | 7 Security principles and minimum requirements for mobile financial services 7.1 Security architecture aspects to be considered <\/td>\n<\/tr>\n | ||||||
| 23<\/td>\n | 7.2 Mobile financial services hardening techniques overview 7.2.1 General 7.2.2 Mobile device hardening techniques overview 7.2.3 Wireless networks hardening techniques overview <\/td>\n<\/tr>\n | ||||||
| 24<\/td>\n | 7.2.4 Secure remote management of mobile device components using OTA 7.2.5 Mobile financial applications hardening techniques <\/td>\n<\/tr>\n | ||||||
| 25<\/td>\n | 7.2.6 Platform security services <\/td>\n<\/tr>\n | ||||||
| 26<\/td>\n | 7.2.7 Application level security services for mobile financial applications <\/td>\n<\/tr>\n | ||||||
| 27<\/td>\n | 7.2.8 Application management security services 7.3 Minimum set of security requirements for mobile financial services 7.3.1 General 7.3.2 Remote MFS access requirements <\/td>\n<\/tr>\n | ||||||
| 28<\/td>\n | 7.3.3 Transaction processing requirements <\/td>\n<\/tr>\n | ||||||
| 29<\/td>\n | 7.3.4 Protection of sensitive data <\/td>\n<\/tr>\n | ||||||
| 30<\/td>\n | 7.3.5 Mobile device requirements 7.3.6 Customer education <\/td>\n<\/tr>\n | ||||||
| 31<\/td>\n | 7.4 Minimum set of security requirements for mobile application management 7.4.1 Customer enrolment and provisioning requirements 7.4.2 Key management <\/td>\n<\/tr>\n | ||||||
| 32<\/td>\n | 7.4.3 Mobile financial service provider and trusted service manager exchanges 7.4.4 Application downloading 7.4.5 Application deactivation 7.5 Summary: Requirements for security services for mobile financial services <\/td>\n<\/tr>\n | ||||||
| 33<\/td>\n | 8 Security requirements for cryptographic components used for MFS 8.1 Mobile device secure environments 8.1.1 Mobile Device requirements for MFS <\/td>\n<\/tr>\n | ||||||
| 34<\/td>\n | 8.1.2 Software-based secure environment 8.1.3 Trusted execution environment (TEE) <\/td>\n<\/tr>\n | ||||||
| 36<\/td>\n | 8.1.4 Secure element requirements <\/td>\n<\/tr>\n | ||||||
| 38<\/td>\n | 8.1.5 Secure element requirements for digital signature services <\/td>\n<\/tr>\n | ||||||
| 40<\/td>\n | 8.2 Security requirements for cryptographic modules used for MFS 8.2.1 General 8.2.2 List of requirements for cryptographic hardware modules <\/td>\n<\/tr>\n | ||||||
| 41<\/td>\n | 8.2.3 Requirements for cryptographic software modules 9 Security evaluation and certification aspects 9.1 General recommendation 9.2 Cryptographic modules <\/td>\n<\/tr>\n | ||||||
| 42<\/td>\n | 9.3 Software modules 9.4 Interoperability of security certifications <\/td>\n<\/tr>\n | ||||||
| 43<\/td>\n | 9.5 Guidance for TEE security evaluation and certification 10 Security requirements for mobile proximate payments 10.1 General <\/td>\n<\/tr>\n | ||||||
| 44<\/td>\n | 10.2 Common security requirements 10.2.1 Integrity of sensitive data and applications at rest 10.2.2 Authentication 10.2.3 Data protection in transit 11 Security requirements for mobile remote payments 11.1 General <\/td>\n<\/tr>\n | ||||||
| 45<\/td>\n | 11.2 Security requirements 11.2.1 Authentication 11.2.2 Proof of consent 11.2.3 Payment gateway processing requirements 12 Security requirements for mobile banking 12.1 General <\/td>\n<\/tr>\n | ||||||
| 46<\/td>\n | 12.2 Authentication considerations <\/td>\n<\/tr>\n | ||||||
| 47<\/td>\n | 12.3 Security requirements 13 Electronic money 13.1 General 13.2 Anonymity requirements 13.3 Security requirements <\/td>\n<\/tr>\n | ||||||
| 48<\/td>\n | 14 Data protection requirements 14.1 General considerations and legal framework for compliance <\/td>\n<\/tr>\n | ||||||
| 49<\/td>\n | 14.2 Requirements and recommendations for data protection 14.2.1 Requirements 14.2.2 Recommendations for data protection 14.3 Privacy assessment <\/td>\n<\/tr>\n | ||||||
| 50<\/td>\n | Annex\u00a0A (informative) Risk analysis guidelines <\/td>\n<\/tr>\n | ||||||
| 55<\/td>\n | Annex\u00a0B (informative) Mobile financial system implementation of Know-Your-Customer requirements <\/td>\n<\/tr>\n | ||||||
| 56<\/td>\n | Annex\u00a0C (informative) Cryptographic mechanisms for mobile financial services <\/td>\n<\/tr>\n | ||||||
| 61<\/td>\n | Annex\u00a0D (informative) Vulnerabilities and attacks on mobile financial services <\/td>\n<\/tr>\n | ||||||
| 65<\/td>\n | Bibliography <\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":" Core banking. Mobile financial services – Security and data protection for mobile financial services<\/b><\/p>\n |