GSM: A Double-edged Sword Tom Kellermann, CISM Sr. Data Risk Management Specialist, The World Bank

Global System Mobile GSM has over 787 Million users worldwide Most PDAs and cell phones will be VOIP enabled by 2005 More robust security than a,b and g however….

Comparison of Wireless & Fixed Telecom Penetration

The Achilles Heal of Security Wireless is growing at 3X the rate of landlines globally. The wireless boom is compounding the security quagmire.

GSM Vulnerabilities  SIM-CARD Vulnerability  SMS Bombs  Gateway Vulnerability  WAP Vulnerability  Man in the Middle Attack

The Man in the Middle Attack

Security Recommendations Enable a power-on password Install anti-virus software Install personal firewall Use robust encryption e.g. S/MIME Ensure that devices are stored securely Ensure that the desktop application mirroring software is password protected Install VPN software

Over reliance on VPNs

Mobile User Business Risk Policies Authentication-Banks should directly authenticate their customers. 3 rd parties should neither obtain nor store customers banking PINs. Stored Value Accounts (SVAs)-Bank accounts should not be accessed when making a payment. Bank accounts should only be used for replenishing SVAs in the customers direction. Interactive Voice Response (IVR)-mobile IVR sessions should be recorded and not be utilized for value services. PINs--Banks should educate their customers to use different robust pins for different online services and to change their PINS periodically.

Conclusion Wireless connections are the weakest link in the security chain. CISOs and CIOs must ensure that no rogue access points exist and that all wireless usage is security in a layered fashion.

World Bank Integrator Unit Website For more information on these and other issues related to e-finance and e-security please refer to our website at: www1.worldbank.org/finance (Click on E-security)