0

1

WHAT KEEPS USERS AWAY? 2 47% 46% 43% 39% 40% 50% 45% 34% 21% 15% 20% 19% 13% 26% 20% 12% I fear that my account information will be viewed by an unauthorized party I prefer dealing with people I do not want to pay a fee I do not find online banking valuable %10%20%30%40%50%60% ©Javelin Strategy and Research, August 2008

Identity Fraud – Evolution and Solutions

Agenda  Attack vectors –Phishing –Man-in-the-middle (MITM) attacks –Malware  Solutions –One-time passwords –Transaction signatures –Endpoint assessment  Summary 4

Phishing 5

Pharming 6 User Website Fake Website Attacker DNS Server (Local or ISP)

Smishing 7

Vishing 8

Smishing Phishing Vishing Pharming User Website Fake Website Attacker DNS Server (Local or ISP) PHISHING

10 Two factor authentication  Something the user has  Strengths –Compromised user credentials less valuable for attacker –Break down the traditional economic model of phishing attacks

11 Types of one-time-passwords  Counter-based one-time passwords  Time-based one-time passwords  Challenge-based one-time passwords  Mutual authentication one-time passwords  Out-of-Band one-time passwords

OATH (Open Authentication)  A group of technology and industry leaders –60+ members –Open and royalty-free specifications –Promote interoperability  Benefits –Standardization drives down cost –Prevents “vendor lock-in”

MITM / MITB attacks 13 Man-in-the-middle attack End-User “John” 1. “John”, “psd” Browser NetBanking Server Banking Trojan 2. OTP 3. $500 to Bob 1. “John”, “pswd” 2. OTP 3. $500 to Bob 1. “John”, “pswd” 2. OTP 3. $5000 to Bill End-User’s Computer Man-in-the-browser attack Web Server End-User MITM

Transaction Signing Soft Tokens  Signature = cryptographic Message Authentication Code 14 On Internet Banking On the software token Enter Account no Enter Amount Generate Signature afcbff100 Seal Transaction with Signature afcbff100 Transaction signature stored in Audit Log for verification

Risk levels (NIST SP ) 15 Minimal High Medium Low KBA OTP PKI OOB

16 Security Industry in 2001 Security Industry in 2011

17 Trojans / Malware

Endpoint Assessment  Endpoint Security Assessment  Session Clean-Up 18 POLICY Personal Firewall Anti-Virus Spyware Patches Inventory Device using File Scan Process Scan Registry Scan OS Scan Compare device scan with access policy SCANCOMPARE Allow Partial Pass Decline

19 Summary  Sophistication of identity fraud schemes is increasing  Authentication deployments are converging to: –Hybrid solutions: >1 authentication method per end-user –Risk-based authentication –Endpoint security assessment  Choose a technology that –Does not lock you in –Provides entire solution – from authentication to endpoint assessment to abolishment

Questions and Answers Mobile: