e-Banking: a security perspective

Conventional banking has always been slow and time consuming, so much that we need to wait several hours to process a simple transaction like clearing a check. But, e-Banking has tremendously reduced the time required to process banking transactions. It makes today's banking faster and convenient. It is a fact that today's banking growth and pro?tability is linked to e-Banking.
Customers becoming more and more comfortable with online banking and in some cases they even prefer e-Banking because it is more ?exible than conventional or phone banking, and it offers banks the opportunity for growth due to virtual availability in remote areas and cost savings.
Reliable customer authentication is imperative for banks engaging in any form of electronic banking or commerce. An effective authentication system can help banks to reduce fraud and strengthen the security framework that underlies e-Banking applications. Strong customer authentication practices are also necessary to enforce anti-money laundering measures and help financial institutions to detect and reduce identity thefts. In general e-Banking depends on strong two-factor authentication, transaction security, reliability, non-repudiation, seamless mobility and user trust.
e-Banking Risks: Legal, Business & Technology In 2002, Pakistan Government passed an Electronic Transaction Ordinance 2002 (ETO) with the objective to recognise and facilitate transactions in electronic form, and to provide for the accreditation of digital certificate providers. Now, electronic information and communication, along with appropriate procedures have legal backing as any written and signed document. With ETO in place, Pakistan has joined an exclusive band of countries that provide necessary framework and an impetus for growth of electronic Banking in Pakistan.
Different online banking services are at a cross roads. Adoption rates have begun to rise. There have been a slew of high profile and sophisticated fraud attacks that may undermine customer confidence and damage the trust on which brands are built. Yet, the success of online banking, and now mobile & internet banking, is more critical than ever as banks seek to accelerate branchless banking to control the cost and increase revenue.
The best way to secure online banking in today's environment is to have a proper and strong authentication solution deployed in the bank. However effective security means more than just strong authentication. Security should be appropriate to the transaction risk. Customers must feel secure without being unduly inconvenienced. The experience should be consistent across different service channels and the approach should accommodate differences across the customer base such as comfort level with technology and travel habits. Lastly, a solution that supports multiple user populations offers opportunities for cost savings through consolidation of IT infrastructure.
Solutions for e-Banking Security With global reach and unique technology NIFT is involved in the modernisation of payment systems and secure e-banking in Pakistan. NIFT, which is an affiliate partner of VeriSign Inc & ActivIdentity Inc offers effective authentication solutions ranging from PKI to OTP on smartcard, tokens & handheld devices. We can help banks to achieve effective security mile stones for online and offline banking applications. Few of the NIFT services and solutions are as follows:
ActivIdentity 4Tress Authentication Server The ActivIdentity 4TRESS Authentication Server allows customer-facing organisations specifically banks and medium to large enterprises to use a consistent authentication model across all user channels. Deployable as a software install or an appliance [hardware box], the solution is designed to maximise authentication versatility, accommodate multiple business units, and scale from thousands to millions of users. The platform segregates data and administration control so that large organisations can leverage the same instance across business lines, and service providers can use the platform to add authentication services in a multi-tenant environment.
The ActivIdentity 4TRESS Authentication Server supports a layered approach that enables organisations to tailor the authentication method (eg, static password, knowledge-based data, OTP, or PKI) and authenticator (eg, hardware token, soft token, or smart card) to specific user groups and risk levels. By providing an open and extensible framework to add new authentication methods and credential types, the ActivIdentity 4TRESS Authentication Server lets organisations respond quickly to new online attacks, evolving business requirements, and changing user needs.
Mobility with Mobile PKI & Driverless Smartcard Dongles Mobile PKI is the only mechanism which can not only provide true mobility along with easiness, low cost, low maintenance but also legally qualified signatures as stated and backed by ETO 2002.
Mobile based strong authentication using digital signatures becoming an ultimate choice to provide enterprises and their users on the go signing and non-repudiated authentication to protected resources. NIFT has also introduced for the first time in Pakistan, driverless Smartcard USB dongles. These dongles offer portability for digital certificates which a bank can offer to its customer for strong authentication, transaction signing, email signing & encryption, and file signing & encryption.
Penetration Testing and Security Consultancy Services e-Banking applications are one of the greatest exposures to the security of banks. It is very important to ensure that e-Banking system and information assets are adequately protected with security testing delivered by deeply technical certified penetration testers. Penetration testing is a method of assessing the security of a system or network by emulating a real attack scenario.
NIFT has offered clients a way to stay ahead of data breach threats through proactive security assessment and penetration testing services. We help you to view your IT security from an attacker's viewpoint, leveraging real-world techniques to not only identify exposures but also assess their implications on the business.