NASDAQ Web Security Entitlement Installation Guide November 13, 2007

(1)

NASDAQ Web Security Entitlement Installation Guide

November 13, 2007

(2)

During the process of establishing entitlement you will download two certificates. The first, a NASDAQ Certificate Authority Certificate, will allow the browser to accept and verify information from NASDAQ Web sites. The second certificate is the User Certificate, allows you to send encrypted data from your PC to NASDAQ. Receiving the certificates is a two- fold process.

1.

Upon receipt of the completed agreement, NASDAQ will email you a user ID, password, and Web address (or URL) from which a NASDAQ Certificate Authority Certificate and a User Authentication Certificate Enrollment Form can be accessed. When you receive the user Name and password, please refer to Section 1 of this guide to review the procedures for downloading and activating a NASDAQ Certificate Authority Certificate and enrolling for a User Authentication Certificate.

2.

Once the NASDAQ Certificate Authority Certificate has been downloaded and the Client Authentication Certificate Enrollment Form has been submitted, you and your firm's Security Administrator will receive, via e-mail, a Personal Identification Number (PIN) and Web address (or URL) from which the User Authentication Certificate can be downloaded and activated. Please refer to Chapter 2 of this guide to review the procedures for downloading and activating a User Authentication Certificate.

(5)

Chapter 2 - Downloading your Certificate - Microsoft Internet Explorer

Step 1 – Logging In to the Enrollment Page

To access the Certificate Enrollment Page, type https://security.nasdaq.com into your browser’s address bar (at the top of your page). The browser will return the following login page which prompts you to type in your User Name and temporary Password provided by NASDAQ:

Enter the User name and Temporary Password provided by NASDAQ

Click OK

Updated: 11/13/2007

5

(6)

Upon clicking OK after entering your user name and temporary password in the Web security login screen, your browser will return the following page. You will be required to change your password at this time.

Note – Your new password must be at least 8 characters long and can not be one of your three previous passwords.

You will also be required to enter a password hint.

Note – The password hint can not be the same as your password. Must be at least 8 characters long.

Upon clicking OK after entering your old and new password and, password hint in the change password screen your browser will return the following page.

(7)

After five minutes, Click on the “Back to https://security.nasdaq.com:443/” link on the screen

The browser will return the following login page which prompts you to type in your User Name and new Password

Click OK

Updated: 11/13/2007

7

(8)

After clicking OK the browser will return you to the “Setting the 2^nd Level Password”

page. You must set your second level password at this time.

NOTE- the 2^nd level password will remain the same for the lifetime of the account.

You will need it to download your certificate, or request a reset of the primary password.

Choose 1 of the 4 questions from the drop down.

Answer the question in the field labeled “2^nd Level Password”.

Confirm the 2^nd level password by re-entering it in the field “Confirm 2^nd Level Password”.

Click on the button “Set Second Level Password.”

The browser will return the following page.

Click on the link “Return to the NASDAQ Enrollment Home Page”.

Proceed to Step 2 to begin the certificate download process.

(9)

Step 2 - Downloading a NASDAQ Certificate Authority Certificate and Requesting a Client Certificate

2A – Requesting CA Certificate

**When going through the certificate download process, please be sure to read each screen carefully before proceeding. *

You will now be at the NASDAQ Web Security Enrollment Home Page.

Click on the link Get My Digital Certificates.

Updated: 11/13/2007

9

(10)

The browser will return the following page:

Click on the button Install The NASDAQ Certificate Authority (CA) Certificate

Please refer to these NOTES while downloading your CA certificate:

After clicking on "Install The NASDAQ Certificate Authority (CA) Certificate"

button, the “File Download – Security Warning” window will be displayed.

Select the "Open" button.

(11)

The “Certificate” window below will be displayed. Select "Install Certificate".

Updated: 11/13/2007

11

(12)

The “Certificate Import Wizard” window below will be displayed. Select

"Next".

(13)

The “Certificate Store” window below will be displayed. Do not change the default option. Select "Next".

Updated: 11/13/2007

13

(14)

The “Complete Certificate Import” window below will be displayed. Select

"Finish".

Click OK on the “Import Was Successful” dialog box displayed below.

(15)

The browser will return you to the “Certificate” window below. Select "OK".

Proceed to Step 2B to begin the User Certificate download process.

Updated: 11/13/2007

15

(16)

2B – Requesting User Certificate

You will be returned to the following page.

Each field should be reviewed for accuracy. NOTE - If any incorrect data is found, DO NOT ATTEMPT to complete this section. Instead please contact NASDAQ

Subscriber Services 212-231-5180 option 1 or send emails to tradingservices@nasdaq.com or subscriber@nasdaq.com.

If the data is accurate, enter the same password hint and the 2^nd level password that you set in Step 1.

Click the button “Submit Request” to request your User Certificate.

(17)

• Click OK.

The browser will return the following message:

• Click Yes.

If you receive the following error screen, the submission was not successful. Please contact NASDAQ Subscriber Services at 212-231-5180 option 1 or send emails to

tradingservices@nasdaq.com or subscriber@nasdaq.com

Updated: 11/13/2007

17

(18)

The website will automatically direct you to the page to download your User Certificate.

Simultaneously, NASDAQ will then approve your request and email a Personal Identification Number (PIN) to you and your security administrator. NOTE - YOU MUST WAIT UNTIL YOU RECEIVE THE E-MAIL FROM NASDAQ WITH YOUR PIN BEFORE PROCEEDING.

If you have not received your PIN after a reasonable amount of time then please contact NASDAQ at 212-231-5180 option 1 or send emails to

tradingservices@nasdaq.com Once you receive this information, please proceed to Step 3 - Retrieving Your User Certificate.

(19)

Step 3 - Retrieving Your User Certificate

The browser will automatically display the following window below:

NOTE - if your browser did not take you there automatically. You can navigate to the above screen by clicking on the link https://security.NASDAQ.com/retrieve.aspx

1.

Type in the 2^nd Level Password you set in Step 1.

2.

Type in the PIN provided by NASDAQ (to you and your Security Administrator via email).

Updated: 11/13/2007

19

(20)

3.

The website will return this screen if invalid 2^nd level password is entered:

(21)

The website will return this screen if invalid pin is entered:

4.

Click “Submit PIN”.

The browser will return the following dialog box:

• Select “Yes”

Updated: 11/13/2007

21

(22)

The browser will return the following dialog box:

• Click “OK”.

The browser will return the following screen which will indicate that your certificate has been successfully installed.

To access any of the NASDAQ services that you have been authorized to utilize move on to

“Chapter 3 – Logging On”.

(23)

Chapter 3 - Logging On

Each time you access a secure NASDAQ Web site, you will need to verify your certificate and enter your user ID and password.

To access a secured site:

Navigate to the appropriate Web site

The browser will return the dialog box which will ask you to present your Client Certificate:

Figure 3-1: Client Certificate Presentation Dialog Box

Click “OK”

The browser will return the following Web Security login Screen

Figure 3-2: Web Security Login Screen

Enter your user ID in the user name field

Enter your password in the password field

Click “OK”

Updated: 11/13/2007

23

(24)

Make sure you delete previous certificates otherwise if you click on the wrong certificate will get the error:

If you have problems accessing a secured NASDAQ site, please contact NASDAQ Help Desk at 212-231-5180 option 1 or 800.243.4284, option #2

(25)

Chapter 4 - Security Maintenance

Changing Your Password

Due to the confidential nature of data being transmitted to and from NASDAQ via secured applications, NASDAQ would like to ensure that the data continues to be delivered through a secure environment. Therefore, each user will be asked to change their password every 90 days. Web Security Release 2.0 includes a new functionality that gives users a warning screen indicating that their password is going to expire in 10 calendar days. You will have two options:

1. Changing your password instantly, or

2. Changing your password at anytime within the 10 days.

The following are the procedures for both options using Internet Explorer or Netscape.

Changing Your Password Instantly

Five days prior to your password expiring, you will receive the following warning screen which asks you if you would like to change your password now:

Figure 4-1: Password Notification Screen

Click “OK.”

Updated: 11/13/2007

25

(26)

The browser will bring you the following password screen page:

Figure 4-2: Password Change Screen

In the Login field, enter your user ID.

In the Old password field, enter your existing password.

In the New password field, enter the password of your choice.

In the Confirm new password field, re-enter your new password.

Update your password hint.

Click “OK.”

The browser will return the following password confirmation screen:

Figure 4-3: Password Confirmation Screen

Once you receive the above confirmation screen, you can enter into the secured browser application and use your new password.

(27)

Changing Your Password within the Ten Days

If you choose not to change your password instantly and would like to do it at a later time, please follow the instructions below. Five days prior to your password expiring, you will receive the following warning screen which asks you if you would like to change your password now:

Figure 4-4: Password Notification Screen

Click “Cancel.”

When you are ready to change your password, enter the following URL (or Web address) into your browser’s address bar: https://security.nasdaq.com. The browser will return the following authorization screen:

Figure 4-5: Authorization Screen

Enter your user ID in the User name field.

Enter your password in the Password field.

Click OK.

Updated: 11/13/2007

27

(28)

The browser will return the following screen:

Figure 4-6: Certificate Enrollment Page

Click the “Change or Reset my Existing Password” link.

(29)

The browser will return the following password change screen:

Figure 4-7: Password Change Screen

In the Login field, enter your user ID.

In the Old password field, enter your existing password.

In the New password field, enter the password of your choice.

In the Confirm new password field, re-enter your new password.

Update the Password Hint.

Click “OK.”

The browser will return the following password confirmation screen:

Figure 4-8 - Password Confirmation Screen

Once you receive the above confirmation screen, you can enter into the secured browser application and use your new password.

Resetting Your Password

If you no longer remember your primary password, you can reset your password. A new one will be emailed to you upon request. Please note that, in order to reset your password, you will need to know the 2^nd level password on the account. Also, upon login with the new password, you will be forced to change it.

Updated: 11/13/2007

29

(30)

You should be at the following web page.

Figure 4-9- Password Change Page

Click on the link “Reset Password”.

(31)

The browser will return the following screen.

Figure 4-10- Password Reset Page

At the bottom, enter your User ID and your Second Level Password.

Click “Reset Password”.

A new password will be generated and emailed to both you and your Security Administrator.

Use the new password to login. You will be immediately required to change the primary password on the account.

Note: If you have forgotten your second level password, you may request that a hint (the question that you chose to answer) be emailed to you and your Security Administrator. If you are still unable to remember the second level password, you will need to contact NASDAQ Subscriber Services at 212.231.5180.

Contacts

Questions regarding the password change procedures can be directed to the NASDAQ Technical Help Desk at 212-231-5180 option 1 or send emails to

tradingservices@nasdaq.com

Updated: 11/13/2007

31

(32)

Chapter 5 – General Information

Establishing Entitlement for New Users

If an authorized manager of the firm has already registered with NASDAQ to enter trades or quote, but needs to request additional logons and certificates for new users, please follow the procedures listed below:

1. The authorized supervisor (security administrator) at your firm must sign up via the web to request a User ID, password, and certificate for a new user. Sign-up procedures and forms can be found in the Forms Directory of this document.

2. Upon receipt of the appropriate subscription information and forms, NASDAQ will email, to each user, a new user package including: a complete entitlement installation guide and a User ID/password accompanied by a Web address (URL) from which a certificate can be downloaded. If you need assistance with downloading your certificate, please contact NASDAQ Technical Help Desk at 212-231-5180 option 1 or send emails to

tradingservices@nasdaq.com or subscriber@nasdaq.com

Firm’s Request to Terminate Entitlement

When a user leaves your firm, their access to the secured site must be terminated. A new employee may not assume a prior employee’s certificate or user ID and password. To terminate a user’s access:

1. The authorized supervisor at the firm must submit a termination request. Termination procedures and forms can be found in the Forms Directory of this document.

2. NASDAQ will disable the user entitlements and revoke the certificate from the firm, notifying them that the specific user’s access has been revoked.

(33)

Updated: 11/13/2007

33 When signing the contract to receive secure web access, your firm agreed to the following legal conditions:

(a) Security Devices are personal to user. They may not be shared, lent, sold, transferred, or used by others.

(b) User will change passwords and perform other actions that are necessary to prevent compromise of the Security Device and to keep it operating correctly.

(c) User is liable, under regulation, contract, tort or otherwise, for all actions taken or omitted and all information submitted by user or on user’s behalf from or to the Service or submitted by authorized or unauthorized persons who obtain access to the Service through user including any actions performed, or information submitted or retrieved, using your designated Security Device.

(d) User will not access the Service or any portion of the Service that utilizes Security Devices after user is no longer eligible for access because of a 1) change in user’s role or responsibility; 2) change in user’s employer; or 3) lack of adherence to the then current requirements of the Service, or any portion of the Service.

(e) Security Administrator will give all Notices to NASDAQ by telephoning NASDAQ

Subscriber Services, at 212.231.5180; or by sending e-mail to User can either call 212-231- 5180 option 1 or send emails to tradingservices@nasdaq.com or subscriber@nasdaq.com (f) Security Administrator will notify NASDAQ within one business day when a user is assigned a Security Device, has their Security Device revoked, or is no longer eligible to receive the Service.

(g) Security Administrator will assign only one unique Security Device per eligible user.

(h) Security Administrator will receive and secure all PIN numbers needed for each certificate download.

Security Tips

To maintain secure NASDAQ sites and protect the information submitted to NASDAQ, it is crucial that the following security guidelines be followed:

Do not let others use your workstation to do their work.

Protect yourself by keeping your logon credentials and certificate only for personal use.

Close your browser after ending a secure session and at the end of the day.

Use password-enabled screen savers.

Open connection only while performing business activity.

Do not leave your browser unattended for any period of time.

(34)

Chapter 6 - NASDAQ Web Security Contacts

Application Support

NASDAQ Subscriber Services: 212.231.5180

Web Access Agreements/Addendums

New subscribers

How to gain access/Entitlement into the various secured sites

Listing/De-listing an employee entitlement certificate

Requesting Marketing Material

Requesting Additional User guides

Technical Support:

Assistance with downloading certificates

Troubleshooting certificate download problems

User can either call 212-231-5180 option 1 or send emails to tradingservices@nasdaq.com or subscriber@nasdaq.com

(35)

Updated: 11/13/2007

35

Chapter 7 – Form Directory

TRACE Subscriber Form:

http://www.nasd.com/RegulatorySystems/TRACE/LegalAgreements/index.htm

*If there are any questions on the TRACE form please contact Trace Help Desk 866-776- 0800

NASDAQ Workstation, Weblink ACT 2.0 or Weblink ACES:

http://www.nasdaqtrader.com/trader/tradingservices/tshome.stm NASDAQTrader.com Monthly Subscription Data:

http://www.nasdaqtrader.com/trader/ptd/allwebagree.pdf NASDAQTrader.com Web-based Data:

http://www.nasdaqtrader.com/trader/mds/nasdaqagreements/postdataamendment.pdf Mutual Fund Quotation Service Subscription Forms:

http://www.nasdaqtrader.com/trader/tradingservices/productservices/agreements/MFQSOr derForm.pdf

BookViewer/NOII Website Forms:

https://noii.nasdaq.com/enroll/

NASDAQ Web Security Entitlement Installation Guide November 13, 2007