Ingenico

Key figures

• Founded in 1980
• Present in 125 countries
• Traders, banks, service providers, mass retail.

The context

Ingenico, a major player in payment solutions

With more than 15 million terminals deployed in 125 countries, Ingenico has earned the trust of merchants, banks and service providers looking to optimise and secure their electronic payment solution, develop their service offering and increase their revenue at the point of sale. And in an increasingly complex payment world, Ingenico helps them to anticipate changing consumer habits. Ingenico’s payment solutions and services represent a complete management of
transactions. In particular, they provide control and monitoring of the entire payment chain and, more generally, security for all those involved in the transaction: the merchant, the consumer, Ingenico and the banks. Therefore, Ingenico must ensure an impeccable level of security.

The need

The PCI-DSS standard: mandatory compliance in the banking sector

The aim of the PCI DSS standard is to reinforce best practice in bank payment account data security, in order to protect cardholders’ confidential information, reduce fraud and identify security problems that could be exploited by malicious users. Ingenico has always placed security at the heart of its processes and is committed to PCI DSS certification, obtained in 2009. This certification applies to its Axis V4 transaction platform.

<One of the requirements of the PCI DSS standard concerns the protection of web applications. Implementing a Web Application Firewall (WAF) was therefore a must for Ingenico." says Eric Detoisien, IT Security Manager at Ingenico.

The solution

WAAP Gateway, UBIKA’s Web Application Firewall chosen by Ingenico

Although Ingenico already had in-house secure development standards, the complexity and ingenuity of cyber
attacks have led Eric Detoisien to equip Ingenico’s Web applications with an Application Firewall for optimum security. Eric Detoisien states:

“The reverse-proxy technology of UBIKA’s WAAP Gateway solution enjoys an excellent reputation in the IT security market. WAAP Gateway was a natural choice for us when it came to securing our Web applications.”

Purchasers’ bank details, recorded on the terminals, pass through a platform before being processed by the banks concerned. It was at this platform that UBIKA’s WAAP Gateway was installed to initially secure two applications: the terminal management application and the reporting application.

“The implementation of UBIKA WAAP Gateway was done extremely quickly and given our time constraints, the UBIKA team was extremely responsive.”

Compliance began in the first quarter of 2009, followed by an audit in July. Certification is therefore very recent, having just been obtained in September.
<This collaboration has been more than fruitful, because in just a few months, Ingenico has been equipped with our flagship WAAP Gateway solution. This project perfectly demonstrates not only our responsiveness but also the adaptability of WAAP Gateway" says the Technical Director at UBIKA.

Finally, UBIKA WAAP Gateway’s “out of the box” security level is already sufficiently high, which
Ingenico’s requirements:
“The initial configuration of UBIKA WAAP Gateway is satisfactory overall, which means we don’t have to configure the solution specifically. This is yet another added value to the UBIKA offering,” adds Eric Detoisien. The collaboration between Ingenico and UBIKA is set to last and evolve over time: all Web applications in production and to come will be protected by UBIKA’s WAAP Gateway solution.

The expert’s opinion

“The UBIKA teams were very responsive. We had a time requirement which was met from start to finish. The deployment went very smoothly, with no constraints and no delays”.

Eric DETOISIEN
IT Security Manager
Ingenico