Online Banking: Creating Confidence Through Security
An extremely bright future for e-banking is evident through its rising popularity and the escalating number of online services offered by banks around the globe. Maximising such potential, however, requires that financial institutions overcome one of the most troublesome obstacles ever faced in the industry: identity (ID) theft. ID theft has affected nearly 27.3 million US consumers and leads to annual losses of US$50bn in the US alone.
ID theft, particularly phishing, is rapidly spreading worldwide, and straining the mutual trust between financial institutions and their customers – a prerequisite for secure online banking. With identity theft leading to significant financial losses and decreased customer usage of online banking services, it is one issue that cannot be ignored. Thus, the industry finds itself with thousands of organisations now looking to implement proactive security measures to combat ID theft.
Strong authentication – the use of more than one factor to identify users accessing private networks and applications – is among today’s leading choices to thwart ID theft. USB strong authentication tokens with built-in smartcard technology, in particular, are taking banking security to another level. By enabling easy and secure implementation of certificate-based security applications, these tokens provide banks with not only strong authentication, but also the foundation for implementing end-to-end security and a range of secure online services to customers.
Building and maintaining a secure environment, as well as improving security controls at every point in the banking infrastructure (both internal and external), USB tokens combat identity theft and fraud, while helping banks meet regulatory compliance. And by enabling secure money transfers, loan applications, stock trading, and other services online via strong authentication and digital signing capabilities, USB tokens raise revenues, increase customer acquisition and retention, reduce operating costs, and deliver a rapid and high ROI for banks.
One of the major ID theft culprits is phishing. In phishing schemes, ‘e-thieves’ steal confidential data such as passwords, credit card numbers and user IDs from individuals, typically by setting up counterfeit websites designed to deceive them into submitting their personal credentials. Labeled the ‘hottest, and most troublesome, new scam on the Internet’ by the FBI, phishing attacks are growing at a monthly rate of 26% according to the Anti-Phishing Working Group (APWG).
According to the APWG, the financial services sector is consistently the most targeted industry for phishing attacks, with financial institutions representing 15 of the top 20 organisations targeted by such attacks in 2004. With nearly 60% of US consumers worried about identity theft, according to Financial Insights, it is clear that the phenomenon is taking its toll on the online banking industry. According to the same report, for example, 6% of US consumers went as far as switching their bank to reduce the risk of falling victim to ID theft. And a JupiterResearch study concludes that 27% of all online banking customers use less online functionality due to security concerns, and 31% of all online users will not bank online at all as a result.
Phishing represents the most significant external threat, but the most significant threat organisations face in protecting customer information comes from within. Without taking measures to control internal and external access to such data, ID theft has the potential to harm the future of e-banking. When it comes to network and Internet security, traditional password authentication, whereby a user has to provide a user name and password, remains the method of choice for most financial institutions worldwide. But despite its popularity, password authentication is not ideal for either banks or their customers.
Customers often maintain several user IDs and constantly changing passwords for a variety of online services and applications, making personal password management unwieldy, if not a logistical nightmare. If you trust your user to create their own password they will use those passwords on other places on the Internet. If they are hacked, the integrity of systems could be at stake. To mitigate this threat, organisations need to implement two-factor authentication (see section below).
Banks, meanwhile, need to allocate significant resources, particularly help desk personnel and IT administrators, to manage password usage. More importantly, however, the sharp increase in ID theft and phishing is neutralising the effectiveness of traditional password authentication: customers feel more vulnerable than ever, while banks are being exposed to unprecedented levels of fraud risk.
It is clear that passwords pose security problems for banks not only at the customer level, but also at all network infrastructure points – starting from within the institution itself. Employees required to handle multiple passwords often either choose easy-to-remember words and numbers, or write them down. They will use those same passwords other places on the Internet as well, thereby increasing the risk that their access credentials will fall into the wrong hands. Conducting business without stronger controls on internal networks, applications and data, financial organisations are more vulnerable to internal ID theft attacks and losses.
The most popular and successful solution to ID theft is strong authentication. Also known as two-factor authentication, strong authentication involves the use of more than one factor to identify users accessing private networks and applications. Whether in the form of tokens, smart cards or ATM cards, strong authentication requires users to verify their identity through something they know and with something they have.
Strong authentication – which, according to the US Federal Deposit Insurance Corp. (FDIC), “has the potential to eliminate, or significantly reduce, account hijacking” – is gaining traction as a legitimate form for safeguarding consumer accounts. A JupiterResearch study reported, for example, that 38% of all online banking customers believe strong authentication alleviates their privacy and security concerns. Among the many strong authentication solutions available, tokens are on the rise due to their portability, convenience and reliability. Banks can choose from a variety of available tokens, according to their desired level of security and breadth of capability.
The one-time password (OTP) token represents the market’s most widely used token-based solution. The portable, key-fob-sized device delivers distinct, randomly-generated OTPs for each authentication attempt. In order to log into private networks or online applications, users enter the OTP, along with their user name and password. USB tokens, meanwhile, are rapidly gaining popularity and grabbing a greater share of the authentication token market. These tokens offer a number of unique advantages that can turn financial institutions’ online banking visions into reality by providing end-to-end security, greater profitability and a high ROI.
The USB smartcard token represents a breakthrough in strong authentication. Combining the encryption capabilities of smartcards with the versatility of tokens, these portable USB smartcard devices, which are plugged into a user’s USB port for authentication, provide all the security benefits of a traditional smartcard and reader – without the reader. But that’s just the beginning. By enabling easy and secure implementation of certificate-based security solutions, USB smartcard tokens are much more than just a strong authentication solution – they represent a comprehensive security solution for banks at all IT infrastructure points.
Through the use of a public and private cryptographic key pair obtained and shared through a trusted authority, public key infrastructure (PKI) enables users to securely exchange data and financial assets across networks and over the Internet. A certificate authority (CA) verifies the identity of each user and issues a digital certificate, which binds the public key to the individual and is made publicly available. The private key, meanwhile, remains in the sole possession of the user, and is used to create a digital signature for validating documents, emails and other data.
Smartcard-based USB tokens add security and portability to PKI solutions by storing user digital certificates and keys: users only have to plug their tokens into any computer to use them. Moreover, unlike private keys normally located in a computer, and therefore susceptible to e-thieves, token-based private keys are generated on the token itself, where they are securely stored – always in the possession of the user and never exposed to the PC.
USB smartcard tokens enable banks to provide their customers, employees and partners with a wide variety of PKI-based security solutions, including:
Financial organisations can deploy a token management system that provides complete lifecycle management, enabling users to automatically enroll their tokens with their PKI credentials. By utilising such a system, banks not only eliminate IT intervention, but also minimise cost, deployment time and effort.
With USB smartcard tokens’ easy-to-deploy, easy-to-use and highly secure capabilities, financial institutions are well positioned to protect their customer data and provide a full range of secure online services, leading to increased customer usage of such offerings. And by raising online banking revenues, increasing customer acquisition and retention, and reducing operating costs through the introduction of USB tokens, banks enjoy a rapid and high ROI with low total cost of ownership (TCO).
Organisations should consider the following when adopting a strong authentication solution: