
BEKO 300TR Security Policy V1.5
All information contained in this document is property of Arçelik A.Ş..
This document can't be used, copied, disclosed or divulged in whole or in part for any purpose by any person without the
written approval of Arçelik A.Ş..
7 Software Security Guidance
7.1 Software Development Guidance
The document [10] is a guidance which provided for the authorized client to ensure
the device is used securely, including,
The requirement for acquirer and software developer.
The procedural controls to ensure that the applications are properly reviewed,
tested and authorized.
The functions certified by PCI PTS.
The certified functions are outlined as below,
Key Management System, the secure key loading method, and crypto functions
for application.
Open Protocol, the physical interfaces and communication protocol.
SRED, the secure method for data exchange.
For more details, please refer to document [10].
7.2 Signing Mechanisms
All the firmware and application are necessary to be signed.
The cryptographic algorithms utilized for signing are listed as below,
RSA 2048, used for signature verification.
SHA256, used for calculating hash for data integrity.
For more details, please refer to document [5] [6] [7].
7.3 Patch Procedures
The authenticated user can login to our patch information server to check if any new
firmware is released. Once any mandatory patch is released, we will take the initiative
in informing the clients. For the updating procedures, please refer to document [8].
Kommentare zu diesen Handbüchern