SRC confirms that the mobile banking solution Transakt by Entersekt meets the PSD2 requirements
The German Banking Act (KWG) and MaRisk require banks to ensure the integrity, availability, authenticity and confidentiality of data in their IT systems and processes. However, secure and efficient IT is also absolutely essential for the economic success of a credit institution.
The new “Banking Supervisory Requirements for IT” (BAIT) formulate concrete expectations. Among other things, the Federal Financial Supervisory Authority (BaFin) has issued a guideline calling for the new function of the ” Information Security Officer ” to be set up. He or she controls the information security process and reports directly to management.
In cooperation with Bank-Verlag, SRC has already successfully offered three certificate courses to become an “Information Security Officer (ISB) for credit institutions”. After the great response and the continuing demand, we are pleased that the Bank-Verlag has made another date for this four-day certificate course possible.
From 6 to 9 November 2018, you will again have the opportunity to receive further training in Cologne to become an “Information Security Officer (ISB) for credit institutions”.
Teamed up with Heinrich Lottmann (TARGOBANK AG & Co. KGaA) and Alexandros Manakos (HSBC Trinkaus & Burkhardt AG), the SRC experts Sandro Amendola, Florian Schumann and Randolf Skerka will give a lecture on the norms and standards according to ISO and IT-Grundschutz, as well as on all legal/regulatory requirements relevant to you as an ISB. In addition, the topics IT risks and emergency precautions as well as business continuity management will be dealt with.
After passing the final examination, you will receive the certificate “Information Security Officer for Banks”.
Optionally, you will have the opportunity to acquire the basic IT knowledge required for the course in a one-day intensive seminar in Cologne on 5 November 2018 prior to the event. This course deals with the basics, terms, encryption and IT security techniques in information technology.
SRC is pleased to support the 5th Computer Science Conference for University of Bonn Students — CSCUBS 2018, which will take place on May 16, 2018.
Promotion of research and scientific exchange
CSCUBS 2018 is organised by PhD and Masters students. Its goal is the promotion of research in computer science, as well as the scientific exchange between students, researchers and practitioners. “The CSCUBS is an initiative from among the students that SRC gladly supports,” says Detlef Kraus, authorized signatory at SRC. “And especially the professional exchange between research, practice and teaching is urgently needed if our society wants to meet the challenges of IT security with confidence,” Kraus continues.
Starting point for personal and professional exchange
The 5th Computer Science Conference for Students of the University of Bonn (CSCUBS 2018) provides a platform for university projects, dissertations and results from research, development and practice in the field of computer science. The conference will take place on 16 May 2018 at the University of Bonn. SRC supports the event not only as a sponsor. We will also be present with a booth to offer a point of contact for personal and professional exchange.
Presentation of a project result at CSCUBS 2018 included
SRC will also present one of its many projects at the CSCUBS. Practice often provides surprising research approaches and exciting insights. The CSCUBS is a welcome platform for SRC to present our work to an interested, young and competent circle of experts and to exchange ideas. Perhaps the many discussions will also provide qualified starting points for using the expertise gathered at CSCUBS 2018 in joint project work.
Critical infrastructures and their significance | Critical day 2018 makes an exchange possible
Critical infrastructures (KRITIS) are organisations and facilities of major importance to the public sector, the failure or impairment of which would result in sustainable supply shortages, major public security disruptions or other dramatic consequences. These critical infrastructures are exposed to various dangers. Among other things, there are also various scenarios in which the security of information technology systems in critical infrastructures takes centre stage. The starting point for the conference “Critical Day 2018” with accompanying barcamp.
Professional “networking” with each other
With the aim of establishing personal contacts and stimulating professional exchange, the critical day offers a regular meeting place for people responsible for the protection of critical infrastructures. The target group of the critical day are those people who work in a company or institution that supplies the population with essential goods and services. Furthermore, the critical day addresses people who deal with the topic of critical infrastructures in a practical, advisory, regulatory or scientific way. The first critical day will take place on 25 April 2018 at the SRC Conference Centre with accompanying barcamp. Tickets are now available.
The demand of the Critical Day
The Critical Day aims to provide a world-class platform for representatives of affected companies, the public sector, science and research to network and exchange experiences on developments and best practices in IT and physical security of critical infrastructures. It also plays a role that the participants are encouraged to design the second part of the critical day as a barcamp. A barcamp is an open conference with open workshops, the contents of which are developed by the participants themselves at the beginning of the conference and will be designed in the further course. Barcamps therefore serve the exchange of content and discussion.
Focus of the SmartCard Workshop
The SmartCard Workshop will take place on 21 and 22 February 2018 in Darmstadt. It is one of the most important events for smart cards in Germany. The participants come from all areas of industry, science and politics. They particularly appreciate the technical orientation of the workshop and its extensive neutrality. The workshop offers participants and experts a forum to present new operating system concepts and conceivable new features and applications, as well as to discuss the current state of development, cryptography, information security and standardization.
SRC expert explains authentication procedures
This year, SRC expert Sandro Amendola will give a presentation on security-related and regulatory issues in the “Registration of App-based authentication procedures”. Such authentication methods play an important role in many digital applications and have become very important for all users of online banking systems, especially due to the regulation of the banking market by the PSD2.
Evening event with award ceremony
A special highlight is the evening event. Each year, one expert is honored with the SmartCard prize for special achievements. The prize is donated by Fraunhofer SIT.
SRC actively participates in SmartCard Workshop
SRC supports the workshop as sponsor and through active participation in the Programme Advisory Board.
Image source: Fraunhofer SIT
Second EU Payment Services Directive PSD2 comes into force
The second EU Payment Services Directive PSD2 comes into force in January. The business policy, technical and regulatory need for action to be taken by credit institutions is diverse and at the same time individual for each bank. Among other things, the institutions will have to observe and implement stricter security requirements for the authentication of their customers and prove these to the national supervisory authority. For banks and Sparkassen as service providers and for customers as users, there is a risk that login and payment release will become more inconvenient. At the same time, the interface must be implemented for access by authorised third parties.
SRC expert discusses complex challenges and evaluates solution approaches
Sandro Amendola, Division Manager at SRC Security Research & Consulting GmbH, was one of the experts at the table talk of “Banken+Partner”. Mr. Amendola discussed the opportunities and challenges of the PSD2 and outlined possible solutions for banks and Sparkassen.
The challenges for banks and Sparkassen
An example of these challenges are the interfaces for authorised third party providers, which PSD2 requires to be made available by banks. Another example is two-factor authentication, which further enhances account access security. Increased security on the one hand is often not possible without making too great a sacrifice in terms of convenience and customer friendliness on the other. The experts present also explained how this security can be achieved without loss of comfort or customers. Finally, the opportunities that can be exploited through cooperation with the agile FinTechs were discussed.
Possible solutions for banks and Sparkassen
The entire expert discussion, as well as the topics and solutions, can be read in the free e‑paper from “Banken+Partner”. In addition, Sandro Amendola is available for individual workshops and consultations on PSD2 and its implications.
Image source: Banken+Partner/Fotografie Schepp
SRC’s certified Common Criteria security laboratory has recently been enriched by another EMVCo certification. The SRC laboratory has long been approved by the German Federal Office for Information Security (BSI) for the evaluation of hardware and software evaluations for smart cards and similar devices. After SRC has now successfully evaluated chip hardware of a well-known and also EMVCo certified manufacturer, EMVCo confirmed the certification of the SRC security laboratory as EMVCo Security Evaluation IC laboratory, which is now also listed as such on the EMVCo website, following a review of the latest findings provided within the scope of an IC security evaluation project.
Further information on the certifications for SRC by EMVCo can be found here.
The NextGenPSD2 standard of the Berlin Group
In the context of the six-week public market consultation of the Berlin Group on its NextGenPSD2 standard for account access “Access to Accounts” (XS2A), which enables third parties to access payment accounts within the framework of the provisions of the revised EU directive for payment services (PSD2), SRC GmbH is also hosting a NextGenPSD2 conference. This will take place on October 25, 2017 in Deutsche Bank’s Atrium in Berlin. The conference offers a detailed program that shows how NextGenPSD2 builds a bridge into the banking system and reduces the complexity of the revised Payment Services Directive (PSD2) and the requirements for access to accounts (XS2A). It also highlights how Third Party Payment Service Providers (TPPs) can provide innovative solutions for customers using modern application programming interfaces (APIs) for secure access to bank accounts.
Change in payment transactions
The conference offers experienced specialists, developers, FinTechs, banks, processors and other experts involved in the PSD2 standard an excellent opportunity to learn in detail how NextGenPSD2 will change daily payment transactions in the coming years. A variety of policy insiders, experts and stakeholders will provide information on the background, goals and details of the open and collaborative NextGenPSD2 XS2A API standard. Accordingly, the meeting offers a great opportunity for a comprehensive explanation of the topic and to clarify open questions. The conference will also be honoured with an insightful keynote opening speech by the European Central Bank and offers several panel discussions with banks, regulators, FinTechs and consumer organisations.
Networking in Microsoft Lounge and Digital Eatery
The conference also offers exceptional networking opportunities: On the evening of 24 October 2017 (from 6 p.m.), the Microsoft Lounge and Digital Eatery will open their doors to the participants and provide access to a get-together event with delicious cuisine and refreshing drinks at no extra cost.
SRC has been cooperating with alsterarbeit in Hamburg for more than two months now. People with handicaps are working on orders for the individual assembly of computer hardware. As a result, they are able to participate in working life and experience personal professional realization.
The alsterarbeit gGmbH in Hamburg
In 2000, alsterarbeit gGmbH merged from the Alsterdorf workshops and the daycare facilities to form the employment agency alsterarbeit. In 2005 the company was transformed into today’s alsterarbeit gemeinnützige GmbH. Its aim: to offer people with disabilities employment in line with their wishes, abilities and skills. In this way, these fellow human beings can participate fully in professional life.
IT manufacturing at alsterarbeit-it
alsterkontec is the production site for packaging, assembly and technology of alsterarbeit in Hamburg. Besides a wide range of different services, alsterkontec also offers the area of IT manufacturing, the alsterarbeit-it.
It is a manufacturer of high-quality and reliable IT hardware. In addition to the production of PAOLA computers, which are certified according to DIN ISO 9001:2008, the IT teams also handle the finishing and individual configuration of notebooks from well-known manufacturers such as DELL and LENOVO.
SRC employee recommends alsterarbeit gGmbH
The cooperation with alsterarbeit gGmbH resulted from a private recommendation from the SRC staff. When the SRC management was made aware of the impeccable work of the people employed at alsterarbeit gGmbH, they decided without hesitation to order and receive notebooks via alsterarbeit-it in the future in order to support the charitable work of the gGmbH and of course to support the people with handicaps working there.
There is no quality deviation from classic suppliers and dealers, whether in hardware or delivery processing — quite the contrary. The hardware supplied to SRC by alsterarbeit-it is characterized by reliability and high quality. This is due to the fact that the IT teams of alsterarbeit-it not only have highly motivated and excellently supervised employees but also specialists for sales and project management and that they support their customers with know-how and flexibility in the planning and implementation of their projects. Should there be any problems with the hardware, the alsterarbeit-it tech center in Bad Oldesloe, 30 minutes by car from Hamburg, quickly provides professional help through the experienced service team.
A study by SRC Security Research & Consulting GmbH with professional support from Z_punkt The Foresight Company and Fraunhofer INT (orig. “Bezahlen 2025 — Szenarien zur Zukunft der Zahlungssysteme in Deutschland).
Instant payments, the digitisation of shopping, stricter regulation, payment releases — and account information services — it is already clear today that these issues will have a major impact on the world of payment in the future. How exactly these factors are designed and used, however, depends decisively on drivers whose influence can be predicted much less reliably:
How strong are the Fintechs? What role do the Internet giants want to play? Do customers accept new payment methods? What authentication methods are available? What about the willingness to cooperate within the banking industry?
The study “Paying in 2025 — Scenarios for the future of payment systems in Germany” therefore does not predict the “one” true future. Rather, an expert survey and several rounds of experts identified those factors that will probably have the greatest impact on the future of payment in the next decade.
Building on this, various consistent future scenarios have been developed that help to form a concrete picture of what payment could look like in ten years’ time. The aim of the study is to provide decision-makers in payment transactions with support in analysing the opportunities and challenges of the future payment transactions landscape.
Security for your Inbox
Stay up to date with the
Security Research & Consulting GmbH
Telefon: +49 (228) 2806 — 0