Ingenico group Move/3500 User manual

Move/3500
PCI PTS Security Policy
ICO-OPE-04848-EN-V11
www.ingenico.com
28/32, boulevard de Grenelle, 75015 Paris - France / (T) [phone] / (F) [phone]
Ingenico – S.A. au capital de 53 086 309 € / 317 218 758 RCS PARIS

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
2/16
Contents
1_ Document Information .....................................................................4
1_1 Evolution follow-up ........................................................................................ 4
1_2 Acronyms ....................................................................................................... 4
1_3 References..................................................................................................... 5
2_ Introduction......................................................................................... 5
3_ General Description............................................................................ 6
3_1 Product Overview........................................................................................... 6
3_1_1 Product type ................................................................................................................... 6
3_1_2 Product functionalities .................................................................................................... 6
3_2 Product Identification...................................................................................... 7
3_2_1 Product name ................................................................................................................. 7
3_2_2 Product hardware version .............................................................................................. 7
3_2_3 Product software versions .............................................................................................. 8
4_ Guidance...........................................................................................9
4_1 Initial Security Inspection................................................................................ 9
4_2 Installation Guide ........................................................................................... 9
4_3 PIN Confidentiality.......................................................................................... 9
4_4 Periodic Inspection and Maintenance............................................................10
4_5 Product Service Removal..............................................................................10
5_ Product Hardware Security............................................................ 11
5_1 Tamper Response Event...............................................................................11
5_2 Environment Conditions and Environmental Failure Protection.....................11
6_ Product Software Security............................................................. 12
6_1 Software Development Guidance..................................................................12
6_2 Account data protection.................................................................................12
6_3 Firmware, Software and Configuration Parameters Update ..........................12
6_4 Software Authentication ................................................................................12

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
3/16
6_5 Self-Tests......................................................................................................13
7_ System Administration..................................................................... 14
7_1 Configuration Settings ...................................................................................14
7_2 Default Value Update ....................................................................................14
8_ Key Management............................................................................ 14
8_1 Key Management Techniques.......................................................................14
8_2 Cryptographic Algorithms ..............................................................................14
8_3 Key Table......................................................................................................15
8_4 Key Replacement..........................................................................................15
8_5 Key Loading Policy........................................................................................16
9_ Roles and Services ........................................................................ 16

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
4/16
1_Document Information
1_1 Evolution follow-up
Revision
Type of modification
Date
1
Document creation 2017/11/06
2Document Update 2018/03/08
3Document Update 2019/05/02
4 Document Update 2020/05/26
5 Document Update 2020/06/11
6 Document Update 2020/06/22
7 Document Update 2020/06/24
8 Document update 2020/08/14
9 Document update 2022/01/25
10 Document update 2022/02/10
11 Document update 2022/03/14
1_2 Acronyms
AES Advanced Encryption Standard
DUKPT Derived Unique Key per Transaction
N/A Not Applicable
PED PIN Entry Device
PIN Personal Identification Number
RSA Rivest Shamir Adleman Algorithm
SHA Secure Hash Algorithm
TDES Triple Data Encryption Standard
ECDSA Elliptic curve digital signature algorithm

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
5/16
1_3 References
[1] ANS X9.24 Part 2: 2016, Retail Financial Services Symmetric Key Management Part 2:
Using Asymmetric Techniques for the Distribution of Symmetric Keys
[2] ANS X9.24 - 1: 2017, Retail Financial Services Symmetric Key Management Part 1: Using
Symmetric Techniques
[3] ANS X9.24 - 3: 2017, Retail Financial Services Symmetric Key Management Part 1: Unique
Key Per Transaction
[4] X9 TR-31 2018, Interoperable Secure Key Exchange Key Block Specification for Symmetric
Algorithms
[5] ISO 9564-1, Financial services — Personal Identification Number (PIN) management and
security — Part 1: Basic principles and requirements for PINs in card-based systems
[6] ISO 9564-2, Banking — Personal Identification Number management and security Part 2:
Approved algorithms for PIN encipherment
[7] PCI PTS POI Derived Test Requirements V5.1 – March 2018
[8] Ingenico Move/3500 Installation guide
[9] Ingenico ICO-OPE-01390, Package IP: Security guidance user’s guide
[10] Ingenico ICO-OPE-01391, Package SSL: Security guidance user’s guide
[11] Ingenico ICO-OPE-01935, Secure Reading and Exchange of Data security guidance
Notes:
[8] is delivered to the end user.
[9], [10], [11] are delivered to authorized software developers:
2_Introduction
This document addresses the proper use of the POI in a secure manner including information about
key-management responsibilities, administrative responsibilities, device functionality, identification and
environmental requirements.
The use of the device in an unapproved method, as described in the security policy, will violate the
PCI PTS v5.1 approval of the device.

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
6/16
3_General Description
3_1 Product Overview
3_1_1 Product type
The Move/3500 PED is a Point of Sale (POS) payment handheld device, to process credit and PIN-
based debit card transactions in an attended environment. The device can also be used as a desk
mounted device, when following the guidance as stated in the installation guide.
3_1_2 Product functionalities
The Move/3500 PED is equipped to handle all form of payment including:
− EMV chip & PIN,
− Chip & Sign
− Magstripe including JISII Tracks
− Contactless
It provides USB host/device, Wi-Fi, Network cellular, Bluetooth and Bluetooth Low Energy1
Figure 1: Move/3500
1The use of BLE Beacon interface shall respect guidance document [9]

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
7/16
3_2 Product Identification
3_2_1 Product name
The product name is visible on the front of the device (see figure 1).
The product name shall not be modified by the merchant or covered by a sticker.
3_2_2 Product hardware version
The product hardware version is printed on a label at the back of the device.
The label at the back of the device shall not be teared off, covered or altered.
Hardware
version number
Figure 2: Move/3500 product hardware identification
The full list of approved Hardware Version Number is available on the PCI PTS
website.

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
8/16
3_2_3 Product software versions
The software versions can be retrieved using the software menu.
To get this information on the device, select the following menu:
• “Control Panel”, then “Terminal information”.
• Select “Firmware PCI PTS” from the following configuration menu:
• Select “On display” from the following configuration menu:
The following items are displayed:
• “M1” is the reference of the firmware.
• “M3” is the reference of the “Open Protocols” module.
• “M4” is the reference of the “SRED” module.
Terminal information
Firmware PCI PTS [other]
Firmware PCI PTS
On display
[other]

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
9/16
4_Guidance
4_1 Initial Security Inspection
The merchant or acquirer must visually inspect the terminal for sign of tampering when received via
shipping, as it is described in the Installation Guide [8].
It is strongly advised that these checks are also performed on a regular basis after receipt and
installation.
For example, the merchant or acquirer should inspect the terminal to ensure that:
• There is no evidence of unusual wires that have been connected to any ports of the terminal,
or associated equipment, the chip card reader or any other part of the terminal.
• There is no shim device in the slot of the ICC acceptor
• The keypad is firmly in place
• No warning flashing message is displayed
• The terminal serial number (on the rear side label) corresponds to the inventory
Such checks would provide warning of any unauthorized modifications to or substitution of the
terminal, or suspicious behavior of individuals that have access to the terminal.
4_2 Installation Guide
An installation guide [8] including the following information is provided with the device:
• Equipment check list :
− Device,
− Cable and connectors,
− Documents
• Power and cable connections information,
• The main characteristics of the device (i.e. temperature, humidity, voltage)
• Safety recommendations,
• Security recommendations,
• Troubleshooting if the device does not work.
4_3 PIN Confidentiality
The device is designed to be used in attended environment.
It’s recommended that the position of the terminal must be in such a way to make cardholder PIN
spying infeasible.
The installation guide [8] provides instructions for the installation and use of the terminal in a secure
manner depending on the device environment.
Further recommendations about the installation of the terminal variants without privacy shield are
specified in the installation guide [8].
NEVER ask the customer to divulge their PIN Code.
With guidance message or logos, indicate to the cardholder to use his hands and/or his body to cover
up the keypad.
The cardholder shall be advised to ensure that he is not being overlooked when entering his PIN code.

ICO-OPE-04848-EN-V11
Move/3500 PCI PTS Security Policy
Public
Ingenico document - Please check document validity before using
10/16
4_4 Periodic Inspection and Maintenance
Information about periodic inspection is specified in the installation guide [8].
The merchant or acquirer should daily check that the keypad is firmly in place. Such checks would
provide warning of any unauthorized modification to the terminal, or suspicious behavior of the
terminal.
In the tampered state, the device displays a warning flashing message and further use of the device is
not possible. If such a message is observed, the merchant or acquirer must contact the device
helpdesk immediately, remove it from service and keep it available for potential forensics investigation.
The merchant or acquirer should also check that the installation/maintenance operations are
performed by a trusted person and log the maintenance operations, including name of the operator.
The merchant or acquirer should check if the ICC reader slot is damaged, such as abrasion, painting
and other machining marks or if there is any suspicious object like lead wire or any unknown object
inside ICC reader.
If such suspicious circumstances are observed, the merchant or acquirer shall stop using the device
immediately and contact the customer service to confirm the device has been tampered.
Figure 3: ICC reader slot
4_5 Product Service Removal
Sensitive data must be erased before refurbishing the device or removing it permanently from service.
The device shall go to tampered status, a state in which sensitive data are erased.
For example, disassembly of the device will lead to a tampered status.