Ask the Expert

Should users have a removable boot drive for online banking?

Some suggest that individual users should have a removable boot drive for online banking. But doesn't that mean that, in addition to another drive and a removable rack, one needs another copy of the OS, as well as another set of the usual arsenal of antivirus and spyware programs (with the accompanying purchase and subscription costs)? Do you recommend this online banking approach, and if so, would it require the additional copy of the operating system and antimalware?

    Requires Free Membership to View

This question raises several issues so let me begin by clarifying the basic idea: Accessing your bank account through a browser -- one that has been loaded from a non-writable source and is known to be free of malicious code -- is safer than accessing your account from a computer booted from the same hard drive that you use for everything else, one that could potentially be contaminated with malicious code like a keystroke logger.

"Clean boot" approaches to online banking sessions have been discussed in the blogosphere for several years. However, while one can easily find individuals describing how they themselves instituted such a project, typically using Linux, I could find no mention, by name, of any bank providing customers with bootable CD-ROMs for banking online (this despite several extended Google sessions and numerous reports that some banks were thinking of taking this approach).

Here's why banks have not rushed to this method: rebooting to do your online banking is inconvenient, whether the removable drive you boot from is a CD, a USB key or a removable hard drive. Suppose I am traveling on business, working in a hotel room in the evening, and I get an email from my wife asking me to transfer some money from my bank account to hers. Under current conditions, that takes just a few clicks. My browser and email program are already open. I can check my balance, confirm which transactions have cleared, complete the transfer, save the confirmation and email my wife to let her know.

Now consider the steps if the bank were to require me to access my account from a removable drive. I wouldhave to save all my work (which could be a dozen or more open documents). Then I would wait for the reboot to happen, the computer to connect to the Internet, and the browser to load. I'd complete the transfer, but where would I save the confirmation? Then I'd have to reboot, reconnect, load my email program to notify my wife, and then open up all the documents I was working on earlier.

If that weren't bad enough, consider how hard it would be for a bank to design a bootable CD that worked on all of its online customers' computers. Considering the technology involved, and the skill level required of the user, I think you'd be lucky if you had less than 1,000 support calls for every 100,000 customers. Banks are likely to find something cheaper and easier to improve the security of their online banking, like the one-time pad used by some European banks.

As for individuals taking this approach into their own hands, there could be, as the question suggests, licensing issues. However, if I felt compelled to make a bootable drive for my personal computer, which usually runs Windows XP, I would probably use something open source, like a live version of Linux running Firefox and OpenOffice (Ubuntu is good for this). I would not need to worry about my Windows antivirus software license. I would not be running it since the boot disc is read-only and thus immune.

For my money, your efforts are best directed at defending your computer through the usual measures, like antivirus and vigilance. After all, whether you bank via reboot or not, the rest of your data and applications still need protecting.

More information:

  • A SearchSecurity.com reader asks Michael Cobb, "How secure is online banking today?"
  • Visit SearchFinancialSecurity.com for more news and expert advice on secure banking.
  • This was first published in July 2008

    There are Comments. Add yours.

     
    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: