Home > Ask the Security Experts > Application Security Questions & Answers > How secure is online banking today?
Ask The Security Expert: Questions & Answers
EMAIL THIS

How secure is online banking today?

Michael Cobb, featured expert EXPERT RESPONSE FROM: Michael Cobb, featured expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 11 November 2007
Do you consider online banking in its current state to be secure? In your experience, what are the biggest mistakes that financial services providers -- and their customers -- make that expose them to security risks?

>
If you ask, "Is online banking in its current state secure enough?", then the answer is a qualified "Yes." While some banking customers have been defrauded through online channels, the extent of such problems is not enough to offset the advantages offered by online banking. (Just think of the number of miles of driving that online banking saves, thereby reducing the chance of a banking-related car accident!)

The fact is that most banks take the security of their online services seriously, realizing correctly that a significant percentage of customers are not going to use such services if the banks have a reputation for being unsafe. Banks also save a lot of money by offering online services, allowing them to afford security enhancements, such as the SiteKey implemented by Bank of America. Many smaller banks now offer similar authentication systems.

One of the biggest mistake banks have made is in not ensuring that enough people are Internet-savvy. Customers must recognize that the avoidable risks of online banking reside, namely, in email scams and phishing attacks.

Some banks, however, are making an effort to educate customers. At a small regional bank I visited recently, there is an interesting notice on the subject, readable by anyone who waits at the drive-thru. The notice lists the tell-tale signs of the major Internet scams, like a phony request for a deposit, overseas payment via Western Union and so on. I commend the bank on this educational initiative. Banks need to stop being nervous about the minimal risks customers face online, even though the threat does exist. Banks should be more proactive in educating their consumer base, because such scams undermine the benefits of online commerce for everyone, regardless of whether that risk is directly related to a bank's actions or not.

The other big mistake that financial service providers make is the failure to pressure email providers into implementing universally trusted email. The technology to do this has existed for at least five years, but petty proprietary wrangling among vendors has repeatedly killed efforts to implement simple email changes that would cut out most spam and phishing. Banks and other financial service providers need to realize that many risks of online activity could be removed almost overnight by responsible cooperation between the likes of Microsoft, Comcast, AOL, AT&T, Roadrunner, Yahoo and Google.

Bill Gates relied on hopelessly optimistic estimates by his analysts when, in January 2004, he said that spam would be solved within two years. In all its forms, including phishing, spam continues to inflict costs that arguably exceed $100 billion a year in the U.S. alone. But Gates was right when he said it could be solved. All we need is less greed, more collective corporate goodwill, and maybe some good old-fashioned bullying from financial service providers.

More information:

  • Senior News Writer Bill Brenner asks Panda Security's Gary Leibowitz how its offerings have catered to the online banking sector.
  • Visit SearchFinancialSecurity.com for more news and expert advice on online banking.


  • BROWSE BY TAG
    Application Security,   Two-Factor and Multifactor Authentication Strategies,   Enterprise Identity and Access Management,   User Authentication Services,   Application and Platform Security,   Email Protection,   Email and Messaging Threats (spam, phishing, instant messaging),   VIEW ALL TAGS

    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



    RELATED CONTENT
    Application Security
    Do Facebook URL security concerns justify blocking social networks?
    Is there a way to block iPhone widgets that bypass Web filters?
    Should enterprises be concerned with Twitter in the workplace?
    Are there still Google Desktop security problems?
    Can an IP spoofing tool be used to spam SPF servers?
    Will an application usage policy best control network bandwidth?
    How can URL-shortening services be manipulated?
    Is my security program ready for Web application firewall deployment?
    How to ensure the security of a shopping cart application
    When to use the service features of the Metasploit hacking tool

    Two-Factor and Multifactor Authentication Strategies
    Two-factor authentication, vigilance foil password theft
    Security on a budget: How to make the most of authentication tools
    Best Authentication Products
    Best Identity and Access Management Products
    Are 'strong authentication' methods strong enough for compliance?
    PCI compliance requirement 7: Restrict access
    PCI compliance requirement 9: Physical access
    Best practices: How to implement and maintain enterprise user roles
    Changing times for identity management
    RSA researcher Ari Juels: RFID tags may be easily hacked

    Email and Messaging Threats (spam, phishing, instant messaging)
    Messaging security risks have upper hand on solutions
    Web-based attacks skyrocket, pirating sites surge, security firms say
    Pushdo botnet uses Facebook to spread malicious email attachment
    Scareware report highlights successful business model
    How to prevent phishing attacks with social engineering tests
    Phishing protection begins with training, antiphishing evangelist
    Phishing attacks to remain a major problem, say security experts
    Barracuda acquires Purewire expanding Web security reach
    FBI raids phishing crime ring, nearly 100 arrested
    Massive phishing scheme affects Microsoft Hotmail accounts
    Email and Messaging Threats (spam, phishing, instant messaging) Research

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    AAA server  (SearchSecurity.com)
    authentication  (SearchSecurity.com)
    authentication, authorization, and accounting  (SearchSecurity.com)
    federated identity management  (SearchSecurity.com)
    Kerberos  (SearchSecurity.com)
    password hardening  (SearchSecurity.com)
    typeprint analysis  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts