September 2024 Summaries

Evervault has introduced a series of enhancements and new features aimed at improving payment security and data protection, building on its core encryption products. Key additions include the Evervault 3D-Secure, a universal API for 3DS authentication, Network Tokens for streamlined token creation without direct card network integration, and Card Account Updater to automatically refresh card details, enhancing authorization rates and customer retention. The company has also launched PCI Restricted Apps to help minimize PCI DSS compliance overhead while ensuring secure cardholder data processing. Improvements to core primitives such as Relay, Functions, Enclaves, and UI Components have been made, with Relay becoming 20% faster and UI Components now supporting UATP cards. Developers can now utilize Sandbox apps for testing enterprise features, offering a cost-effective way to prototype applications. Additionally, Evervault has enhanced its logging capabilities with a new activity log interface and introduced integrations with Datadog and SAML support to further bolster its product offerings.

The Digital Operational Resilience Act (DORA) is a comprehensive set of European Union regulations designed to enhance the security of financial institutions' information and communication technology (ICT) systems, aiming to prevent breaches and safeguard them from cyber threats. Implemented in stages from 2022 to 2024, DORA encompasses various aspects such as testing, information sharing, third-party risk management, and incident response, with a strong emphasis on data encryption. The legislation mandates encryption for data at rest and in transit, and while it recommends encryption for data in use, it acknowledges its current impracticality, allowing for alternative protective measures like trusted execution environments. DORA's broad applicability includes banks, investment firms, crypto companies, and third-party service providers, though some exemptions apply to smaller firms. While some criticize its vagueness, this flexibility allows the legislation to adapt to evolving security practices and technological advancements. The final compliance deadline is set for January 17, 2025, and organizations are encouraged to collaborate with DORA-compliant vendors to meet these standards, thereby avoiding fines and enhancing their cybersecurity posture.

3D-Secure (3DS) is a security protocol designed to enhance the legitimacy of online card transactions by requiring cardholders to verify their identity, typically through methods like one-time passwords or biometric authentication. It involves collaboration between the merchant’s bank, the card issuer, and the protocol infrastructure, adding an additional security layer to online purchases. While it reduces fraud and offers chargeback protection by shifting liability to the card issuer, it also presents challenges such as complexity in implementation, fragmented user experiences, and potential impacts on conversion rates due to the authentication process. Businesses can implement 3DS through payment gateways like Stripe or PayPal, which may lead to vendor lock-in and limited customization, or opt for third-party solutions like Evervault, which offer more flexibility, independence from specific payment processors, and a customizable API for smoother transaction authentication. Despite the challenges, 3D-Secure is crucial for meeting regulatory compliance and ensuring secure online transactions, with a focus on balancing robust security measures and user experience.

Evervault has introduced its 3D-Secure API, designed to enhance data security by offering a flexible and universal solution for 3DS authentication independent of payment processors. This API aims to address the limitations of existing 3D-Secure options, which often entail complex integration and high costs, by providing a developer-friendly, reliable, and easy-to-integrate solution that simplifies the 3DS authentication process into two main steps. The API, built on Evervault's security and design principles, helps businesses comply with regulations, shift chargeback liability, and reduce fraud risk while maintaining high conversion rates through a smooth user experience. The new offering has already been successfully adopted by companies like Duffel, which benefits from the API's ability to meet regulatory requirements and scale globally without complexity.