QOTD on Banking Security

There is no single, easy, solution for the banks to ensure the security of their online banking systems. A combination of techniques, working to complement each other, is required rather than relying solely on two-factor authentication regardless of how sophisticated this technique seems. Any approach to combating attacks against online banking must include updating and implementing rigorous anti-fraud control design processes, monitoring for any out of the ordinary customer transactions and tracking browsing patterns all of which could indicate an attack.

-- Hugh Callaghan, security expert at Ernst & Young

Note: emphasis is mine.

Src: Hackers may be able to 'outwit' online banking security devices • The Register

QOTD - Litan on Online Bank Fraud

The law hasn't kept up, the regulators haven't kept up, and you're going to get a different opinion from every judge.
[...]
In the end, businesses are guilty until proven innocent.

-- Avivah Litan, VP & Distinguished Analyst at Gartner Research

Src: Who Bears Online Fraud Burden: Bank or Business? -- InformationWeek

QOTD - Avivah Litan on Cognitive Passwords

Banks and other companies who rely on knowledge based authentication – the process that asks users ’secret’ questions that only the legitimate can presumably answer – are in a quandry because fraudsters are answering those questions successfully all too many times.
[...]
It’s a very serious problem that deserves a serious solution. It will be solved but it will take time. In the meantime, service providers cannot count on the veracity and reliability of the process to indeed authenticate the ‘right’ and legitimate individual. -- Avivah Litan, VP Gartner Research

As Avivah explains, it turns out that the crooks are getting the information straight from the data aggregators by spear-phishing their employees.

Src: Avivah Litan — A Member of the Gartner Blog Network

QOTD on Safe Online Banking

If you are using online banking you should be using a hardened system that is not used for anything else but online banking.

-- Jay McLaughlin, CIO CNL Bank

Src: Can Ubuntu save online banking? - Computerworld Blogs

Gartner Analyst: "Are These Banks Asleep at the Wheel?"

Avivah Litan, Vice President of Research at Gartner Inc and distinguished analyst, was recently interviewed by Linda McGlasson of the Information Security Media Group to discuss fraud trends in banking. What follows are excerpts from the transcript available on BankInfoSecurity.com's web site.

criminals are now focused on cross-channel fraud [...] they are getting better at figuring out how to call call-center operators and get their way through accounts using information that they gather on the internet to commit different kinds of fraud
[...]
they've been studying these bank websites, and they probably know more about how particular bank security works than many people at the bank themselves [...] They know how many seconds it takes for them to prompt users for authentication credential. So they've just gotten really good, some of them, at knowing how to penetrate bank security by studying them, copying them and figuring out how to socially engineer their customers to get through any of the security controls that are there.
[...]
The bottom line is all these factors [single factor, two-factor authentication] are going through the user's browser, and nothing is safe going through the user's browser because the new malware is now sitting inside that browser and is acting on behalf of the user. So you can put a biometric on your PC, you can put smart card, it doesn't matter. As long as it is going through the browser, the crooks have figured out how to beat it.
[...]
most banks are relying on cookies on customers' PC's to know it's a good customer. That reliance needs to end ...

As smaller local and regional banks are currently lagging behind in terms of fraud detection capability, Litan warns that failure to act now will likely result in government introducing new legislation or regulation.

Note: emphasis is mine.

Src: Analyst: "Are These Banks Asleep at the Wheel?" | BankInfoSecurity.com

QOTD - Litan on Defeating 2-Factor Auth

Criminals are successfully launching man-in-the-browser attacks that circumvent strong two-factor and other authentication that communicate through the user's browser. The fraudsters are also successfully having telecommunication carriers forward phone calls used to authenticate users and/or transactions to the fraudster's phone instead of the legitimate user's phone. These attacks were successfully and repeatedly executed against many banks and their customers across the globe in 2009. While bank accounts are the main immediate targets, these attack methods will migrate to other sectors and applications that contain sensitive valuable information and data within the next three years. -- Avivah Litan, Vice President and Distinguished Analyst in Gartner Research

Src: Where Strong Authentication Fails and What You Can Do About It | Gartner

QOTD - SMBs & online banking

It's time for small business to wake up and understand the true risk of online banking. If the bank thinks you were negligent, they do not have any obligation to pay you back. -- Avivah Litan, banking security analyst at Gartner, Inc.

Src: Cybercrooks stalk small businesses that bank online | USATODAY.com

QOTD on Authentication

Authentication will not be able to solve the untrusted platform problem. If you use a compromised system, authentication doesn't matter. Out of band communication will only work if the out-of band channel and associated hardware is secure, which may be questionable if devices like smartphones are used. -- Dr. Johannes Ullrich, CTO of the Internet Storm Center & Dean of the Faculty of the graduate school at the SANS Technology Institute.

Src: SANS NewsBites Vol 11 Num 98

QOTD on Fraud & Denial

Nobody really likes to know that a fraud is occurring under their noses. I have had fraud victims in complete denial when you show them all of the evidence of what has been transpiring and what has been transpiring for some time; where I have actually said 'We want to do a full investigation, can we pursue this?,' and they are so in denial in the 'it can't happen here' that it's hard to understand. People should look within their own organizations. They see fraud on the outside and they wipe their brow and say 'Whew, it hasn't happened to me!' But as I said, fraud is hidden so they are not going to know it; it is not going to rear its ugly head as obviously as one might think. -- Allan Bachman, Education Manager for the Association of Certified Fraud Examiners (ACFE)

Src: Fighting Fraud - Allan Bachman, Association of Certified Fraud Examiners

QOTD on Banking Fraud

We don't need to know who's doing it, just what it looks like at an earlier phase, so we can alert our institutions and prepare them on what to look for. -- Doug Johnson, Senior Policy Analyst at the American Bankers Association.

Src: Online Fraud: New Victims, New Approaches | BankInfoSecurity.com

ENISA Warns of Alarming Increase in ATM Crime

As the annual cost of ATM-related fraud in Europe approaches half a billion Euros, the European Network and Information Security Agency (ENISA), has issued Golden Rules to protect consumers against ATM fraud/crime:

Choosing an ATM Machine
1) Don't use ATMs with extra signage or warnings
2) Try to use ATMs inside banks
3) Don't use freestanding ATMs
Physical surroundings
4) Use an ATM which is in clear view and well lit
5) Be cautious of strangers and check they are at a reasonable distance away
Making Operations
6) Pay careful attention to the front of the machine for Tampering
7) Pay attention to the card reader for signs of additional devices
8) Look carefully for differences or unusual characteristics of the ATM's PIN pad
9) Look out for extra cameras
10) Protect your PIN by standing close to the ATM and shielding the key pad
11) Report confiscated cards immediately
12) Beware of ATMs that don't dispense cash and non-bank ATMs that don't charge fees
Statement Reviews
13) Frequently review your account statements
14) Report any suspicious activity immediately

Src: ENISA Warns of Alarming Increase in ATM Crime

Tighter Security Urged for Businesses Banking Online

How can businesses secure their financial accounts from hackers? Information security professionals have been advocating the use of more advanced measures such as the one recently recommended by the Financial Services Information Sharing and Analysis Center:

carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible.

Src: Tighter Security Urged for Businesses Banking Online | WashingtonPost.com

QOTD on Hackers vs Authentication Tokens

They don’t break the encryption; they just log in at the same time you do. -- Joe Stewart, director of malware research for SecureWorks

The article discusses the recent increase in real-time fraud in which hackers can negate the security advantages of token-based authentication devices by stealing the access credentials and using them in real time.

Src: Hackers Exploit an Evolving Web | NYTimes.com

QOTD on Heartland Hacker Getting Caught

The more sophisticated thieves are ingenious, and no company or government agency should rest easy with a false sense of security that our bad-guy days of worry are over. A few very skilled hackers slipped up and got caught [e.g. recent indictment of Albert Gonzales], but one can only imagine that even smarter ones are still out there and hard at work. -- Brenda Eaden, CEO of ID Theft eLearning Intelligence

Src: Experts: More Heartland-Style Breaches Expected | BankInfoSecurity.com

QOTD Litan on the US Credit Card System

It's time for the U.S. card industry 'to get on the bandwagon and upgrade payment card system security, and stop pretending that PCI is working. -- Avivah Litan, Distinguished Analyst at Gartner Group

Src: Experts: More Heartland-Style Breaches Expected | BankInfoSecurity.com

Dr.InfoSec assists with Fayetteville Public Schools ID Theft case

As an information security professional, I always look for ways to be of assistance to others about the security and privacy of the data entrusted to them. This post is about exercising such an opportunity and in a small way, helping make a difference.

On July 29th, as I was following up on a story that flashed across my Twitter stream about 30 certified employees of a school district finding themselves victims of ID theft, I found something that should not have been there.

While looking for more information about the school district, I used a targeted Google search; it was a simple one, looking for pages containing the word 'certified.' While there were many search results, one in particular caught my eye: an Excel spreadsheet that appeared to contain Personally Identifiable Information (PII) including names, addresses, phone numbers, and social security numbers . Worse, it had been indexed by a major search engine, which meant that its contents had been cached for easier viewing, even after the file would be removed.

I placed a called to the school district right away and left a voicemail for the CIO. Within 20 minutes someone from the office had called me back. I shared with them what I had found and advised on short-term steps they should take to mitigate the problem.

While it may be tempting to lay blame for failing to properly safeguard sensitive data, this is not the purpose of this blog post. Instead, I wanted to share with the information security community and students that we can make a difference, even outside of business hours. In this case, I helped the school district identify one data leak. Was that spreadsheet the one used by fraudsters? It is simply too early to tell; the investigation is ongoing.

If you see something that is out of place, or poses a potential security/privacy risk, tell someone. It could help prevent 30 more people from becoming victims of ID theft.

Link: School District's Teachers Targeted In Identity Theft Scam | 4029tv.com
Link: Fayetteville Public Schools :: Administration

So you want to be a Chief Risk Officer?

John Ericksen, Chief Operating Risk Officer at PNC, described his responsibilities as having oversight of risks stemming from: operational risk governance, data analysis, external events, strategic risk elements, information security, privacy, business resilience, and financial intelligence.

For the banking sector, John considers the CRO's responsibility to be "to forge a view of these risks that transcends the bank's individual departments to enable quick decisions based on an enterprise-wide view of exposures" and being able "to add the right nuances to the information so you can have a thoughtful conversation about it with other staff."

Ultimately, the CRO must be able to understand data:

how it's collected, its integrity, what it's being used for, its accuracy and making sure the right data management systems and technology are in place to make informed decisions based on portfolio, geographic and customer views.

Src: The New Generals - 08..2009 | Bank Technology News

Warner Touts E-Medical Data Despite Hacker Attack

One of the keys is how we ensure security and privacy. Just as we see that in financial records you can never get 100 percent protection, we have a very efficiently functioning system around financial records (and) around other critical information. -- US Senator Mark Warner

The recent news about a hacker gaining access to the State of Virginia's Prescription Monitoring Program highlights the differences, not the similarities, between the financial system and the health care system. In the financial system, money has no intrinsic value as all dollar bills are dollar bills; if your account is compromised and you are not the culprit, your account's balance will be restored in time.

In the case of electronic medical records, the records contain a detailed report of your health history, your prescription history, and possibly your mental health history. Health care data has intrinsic value; once stolen, that information can not only be used to commit prescription fraud and medical procedure reimbursement fraud, but long-term, it can be used to take advantage of you and those around you.

The article goes on to say that "frustrated lawmakers wanted to know why a firewall put in place by the Virginia Information Technologies Agency and its contractors didn't foil the attack." This statement illustrates how little the average lawmaker knows about the current level of threats to electronic data. Unfortunately, while your credit card can be closed and a new number re-issued, your health care records cannot.

Src: Warner Touts E-Medical Data Despite Hacker Attack | NYTimes.com

Phishing, vishing and unscrupulous tax preparers pose a threat

Tax documents are a treasure-trove of information, containing name, date-of-birth, social security number, current address. I find the lack of concern for one's most sensitive information most disappointing (note: small sample size, only 1,091 participants surveyed in Feb 2009):

The survey also showed that 1/3 of the respondents who rely on the services of a tax preparer were not at all concerned about the possibility of becoming victims of identity theft when choosing their preparer. An additional 23 percent were somewhat concerned and only 18 percent were very concerned.

Src: Phishing, vishing and unscrupulous tax preparers pose a threat
Src2: Affinion Security Center Survey Finds Taxpayers are Vulnerable to Tax- and Employment-Related Identity Theft | PRNewsWire.com

21 million German bank accounts for sale

Germans have reason to be cautious of what 2009 will mean for them after a German magazine, WirtschaftsWoche (meaning Economic Week), was able to buy details for 1.2 million bank accounts from underground criminals who claim to have data for up to 21 million bank accounts.

Src: 21 million German bank accounts for sale | ITworld