Biometrics testing services
A one-stop shop from consulting to testing.
Fime provides security consultancy, evaluation, and test services to ensure that an application or product achieves the highest security standards throughout its lifecycle.
Overview.
Fime’s expertise covers smart cards, Secure Elements (SE), SoftPOS, Trusted Execution Environments (TEE), standard and Host Card Emulation (HCE) mobile applications, payment terminals, EMV®* 3-D Secure, Token Service Providers (TSP) and Trusted Service Managers (TSM). Fime is also able to address payment-related systems dealing with account data through PCI DSS compliance and penetration testing as well as compliance assessment to other PCI standards (like PCI PIN, PCI P2E, PCI SSF, PCI Card Production & Provisioning, PCI 3DS, PCI 3DS SDK, PCI TSP, PCI TSM,...).
Beyond this standard testing portfolio, Fime experts can develop dedicated tests or security expertise to futureproof your implementations.
Consulting
Fime works in partnership with its clients to address product and application security requirements from initial set-up and throughout the development and integration stages. Helping make the right decision based on their individual security needs. Our services include:
-
Risk analysis.
Security requirements writing.
- Product design review / Source code review.
- Technical guidance.
PCI certification documentation writing.
- Vulnerability analysis / Pre-assessment.
- Security assessment & pentesting.
Training
Fime can offer training in its areas of expertise which cover:
Chip card / Secure Element (SE).
Payment terminal.
SoftPOS / PCI MPoC.
Trusted Execution Environment (TEE).
- Standard & Host Card Emulation (HCE)mobile applications.
- Token Service Provider (TSP).
- Trusted Service Manager (TSM).
Key benefits
Security compliance evaluation is mandated by payment schemes to avoid fraud and for the following reasons
User experience is key to global solution acceptance.
A bad user experience can spread through word of mouth or even social networks and have a profound impact on user acceptance.
Security issues in the field are negatively impacting user experience.
As a solution provider, you cannot afford security issues in the field.
The later security issues are discovered, the more expensive they are to correct.
Achieving security expertise will ensure that your solution has reached a recognized security level, and it will:
Help you identify security vulnerabilities in your solution, policies, and processes.
Reduce the risk of fraud and incidents, client data theft, and potential damages to your business.
Make sure user experience keeps being great without being negatively impacted.
Show your clients, providers, and business partners a positive image and reputation about the level of security that applies to your solution.
Enable you to qualify as a responsible solution provider.
Allow your solution to be authorized for deployment by payment schemes.
With Fime, you can work with a single partner, accredited by most of the international and domestic payment schemes.
How it works.
- Define test scope based on your product features and target certifications in a scoping questionnaire that we provide.
- Request a quote based on the scope.
In some cases, we may need to review together the provided scope to clarify and ascertain.
Book a timeslot with lab for pre-assessment and security evaluation.
- Prepare the test samples, source code, and required documentation.
- Accredited lab performs security evaluation.
Provide test results/reports for your review and to each scheme for approval.
Standards
- American Express
- BAROC
CCC-Digital Key Applet security
Common Criteria (ISO/IEC 15408)
Discover
EMVCo
- FeliCa Networks
- First Data
Interac
JCB
Mastercard CAST
Mifare for NXP
Visa VCSP
FIPS 140-3 up to level 4
EMVCo SBMP and Visa Ready for Host Card Emulation (SDK/Mobile Wallet)
GlobalPlatform and EMVCo for TEE security
- State-of-the-art mobile application pentesting
- State-of-the-art penetration testing on IT and network systems
*EMV® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC.
Security audit (such as ISO/IEC 27001) for sites and processes
Logical, organizational and physical security audit)
PCI CPoC (Contactless Payments on COTS) and PCI SPoC (Software-based PIN entry on COTS) for SoftPOS
PCI MPoC (Mobile Payments on COTS) for SoftPOS
PCI 3DS
PCI 3DS SDK
PCI Card Production & Provisioning
PCI DSS
PCI P2E
PCI PIN
PCI SSF
PCI TSM
PCI TSP
Téléchargement
Download our technical specifications sheets for more information.