PCI 3DS is the Council’s standard for the systems behind 3-D Secure, the authentication step behind “verified by” card payments online. A processor that runs those systems for its banks needs a 3DS Assessor to assess them. This one was mature, well staffed, already PCI DSS compliant, and expected the 3DS assessment to be PCI DSS with a different cover page.
Day one
Three days on site, with the agenda organised by the standard’s domains. By the end of the first morning the shape of the engagement was clear, and it was not technical.
There was no formal definition of the 3DS environment. There was no 3DS data-flow diagram. The list of critical hardware and software did not include the main 3DS applications. Two scope documents disagreed about the operating system of the cryptographic servers. The company running the data centre had responsibilities nobody had written down. Twenty-one people were interviewed over the three days, from the security director to procurement, legal, cryptography support and backup administration, and most of them were doing the right things. Almost nobody could show it for the 3DS environment specifically.
The mantrap
One moment from the site visit is worth telling. Four of us, the assessor included, walked up to the single-entry mantrap that protects the sensitive area. Four badges were presented. Four people went through together. Nobody said a word, and we said nothing either, waiting to see whether anyone would. Nobody did. It was normal.
Back in the meeting room we raised it and met genuine surprise. It had been fine for years, with every previous auditor, and besides, there was security at the entrance. That security was a guard at the building’s reception a few metres away, and turnstiles anyone could step over.
A mantrap that four people walk through together is a door. The requirement exists to stop exactly that, and “the last auditor did not mind” is not a control. A compensating control was agreed and documented for the cycle, with the understanding that the habit, not the hardware, was the finding.
A mantrap that four people walk through together is a door.
Five weeks of evidence
The post-assessment notes went through four versions in five weeks. Each version listed every requirement with an open point, what had been received, and what would close it. The working rule was written into the first version and never changed: if we cannot review the evidence, the requirement is not in place.
The findings that stayed open longest:
- Scope. The critical-software list and the two conflicting scope documents had to become one dated inventory of the 3DS environment, with a diagram and a matrix of where each 3DS data element is stored and for how long.
- Data retention. Authentication values were being kept beyond what the standard allows. They must go once authorisation completes, and old copies had to be found and purged from every place they had been written.
- Web security. The content security policy on the 3DS pages allowed inline scripts, which removes most of its protection.
- Recurring processes. Several controls were evidenced with a single review record or a screenshot of a document’s cover page. Recurrence is shown by several dated records, not one.
Along the way the processor’s partners wanted reassurance before the report existed. We issued a status letter three weeks in: the engagement was under way and no finding represented a significant risk. It said in plain words that it gave no opinion on compliance. A status letter can help commercially. It is not an attestation, and we will not write one that pretends to be.
One more thing the processor did well: it could not let confidential evidence leave its walls. Access ran through a rights-management tool, revoked at the end, and every file was hashed and held by the head of internal audit under a signed custody form for the Council’s review period. That is what the evidence custody procedure is for. Agree it at kickoff, not at the end.
Two months
Six requirements were still open five weeks after the site visit. All were closed a week later. The Report on Compliance, the Attestation and the certificate were issued two months after the on-site days, with forty-four documents referenced in the report.
What people get wrong
They assume PCI DSS compliance covers most of 3DS. The 3DS standard’s second part is about governance, scope evidence, 3DS data handling and key management, and all of it has to be documented for the 3DS environment specifically. A mature PCI DSS programme is a head start on the technology and almost no help with the paperwork.
They treat the on-site days as the assessment. The on-site days are the start. Most of the work is the evidence loop afterwards, and the organisation that prepares its scope documents before the assessor arrives saves itself most of it.