POS upgrades critical for SA tourism and games bids

If SA is to fulfil its potential as an international tourism destination - and boost its chances of hosting major events such as the 2010 Soccer World Cup - it has to accelerate the roll-out of point-of-sale (POS) systems which meet global standards.

So says Gerhard Claassen, MD of the Crypto Business Unit at JSE-listed secure electronic payments company, Prism Holdings, who maintains that international tourists must know that when they present their EMV (Europay, MasterCard, Visa)-based smart cards at a retail outlet anywhere in SA, it will be accepted.

"At present, SA banks and retailers are stepping up their efforts to meet the mandated Visa and MasterCard deadline for their PIN-handling systems to comply with the global Triple DES (T-DES) algorithm and EMV standard. For example, Prism has supplied over R5 million worth of secure application modules (SAMs) to the financial and retail industries over the past eight months. But we still have a long way to go," he says.

Interestingly, the country leading the way in T-DES and EMV compliance is not the US, France or even Malaysia where smart cards are widely used as payment tokens; instead, one of the most EMV advanced countries is Greece which is to host the 2004 Summer Olympics.

"SA will significantly boost its chances of hosting similar events if it can give the assurance that its retail and banking industries comply fully with global payments and security requirements," Claassen adds.

According to Claassen, Visa and MasterCard have issued a mandate that all banks upgrade their PIN-handling systems to use the T-DES algorithm. A fixed time frame was provided in order to allow banks sufficient time to upgrade their systems: 2004 for all new hardware and 2010 for all existing POS devices.

"But if we want to win the bid for the 2010 Soccer World Cup - or just increase our status as a tourism destination of choice - we can`t afford to wait that long. The last thing we need is a tourist`s credit card being rejected, or damaged, at a shop in, for example, Sandton City because the POS equipment couldn`t deal with EMV requirements," he says.

With huge investments in existing POS equipment, many banks and retailers wanting to satisfy T-DES requirements - including becoming EMV (Europay, MasterCard and Visa) smart card ready - are looking for ways to upgrade rather than replace their POS terminal fleets.

The SAMs supplied by Prism to the financial and retail industries are chip-cards that can be programmed with a security application. They are being used to upgrade the security levels of older POS devices, saving banks and retailers the expense of having to replace them.

Claassen says some terminal vendors are offering EMV software libraries to support upgrade initiatives. The problem is that in many cases, the older terminals and PINpads simply don`t have enough horsepower or memory to handle these upgrades.

"However, many of these terminals provide internal support for one or more SAMs. The SAM can be used as a secure co-processor for off-loading CPU-intensive cryptographic operations - making them an ideal solution for older, underpowered terminals.

"For example, Prism`s Incognito TSM110 SAM can be supplied with a secure co-processor application that includes T-DES and EMV cryptographic functions and additional terminal memory saving features. This means the TSM110 can be used as a co-processor in older terminals and PINpads to extend their capability.

"In addition, Prism has packed a rich set of cryptographic support functions into the TSM110 SAM as well as memory-saving features such as storage for EMV CA public keys," he says.

Claassen points out that few security vendors can provide a complete solution to the T-DES and EMV challenge.

"But having to use multiple vendors can be very costing and time consuming. It also leaves the bank or retailer with different key management systems and security procedures.

"Upgrading multiple-vendor systems can also lead to additional costly integration exercises to provide key management compatibility between different vendor systems.

"Prism`s security systems have often been integrated with other vendors` systems in the past, but Prism can also provide a total solution, thus simplifying key management and providing an overall cost-effective upgrade," Claassen concludes.