1. 0

2. 1

3. WHAT KEEPS USERS AWAY? 2 47% 46% 43% 39% 40% 50% 45% 34% 21% 15% 20% 19% 13% 26% 20% 12% I fear that my account information will be viewed by an unauthorized party I prefer dealing with people I do not want to pay a fee I do not find online banking valuable 2008 2007 2006 2005 0%10%20%30%40%50%60% ©Javelin Strategy and Research, August 2008

4. Identity Fraud – Evolution and Solutions

5. Agenda  Attack vectors –Phishing –Man-in-the-middle (MITM) attacks –Malware  Solutions –One-time passwords –Transaction signatures –Endpoint assessment  Summary 4

6. Phishing 5

7. Pharming 6 http://www User Website www.nicebank.com Fake Website www.n1cebank.com Attacker DNS Server (Local or ISP)

8. Smishing 7

9. Vishing 8

10. Smishing Phishing Vishing Pharming http://www User Website www.nicebank.com Fake Website www.n1cebank.com Attacker DNS Server (Local or ISP) PHISHING

11. 10 Two factor authentication  Something the user has  Strengths –Compromised user credentials less valuable for attacker –Break down the traditional economic model of phishing attacks

12. 11 Types of one-time-passwords  Counter-based one-time passwords  Time-based one-time passwords  Challenge-based one-time passwords  Mutual authentication one-time passwords  Out-of-Band one-time passwords

13. OATH (Open Authentication)  A group of technology and industry leaders –60+ members –Open and royalty-free specifications –Promote interoperability  Benefits –Standardization drives down cost –Prevents “vendor lock-in”

14. MITM / MITB attacks 13 Man-in-the-middle attack End-User “John” 1. “John”, “psd” Browser NetBanking Server Banking Trojan 2. OTP 3. $500 to Bob 1. “John”, “pswd” 2. OTP 3. $500 to Bob 1. “John”, “pswd” 2. OTP 3. $5000 to Bill End-User’s Computer Man-in-the-browser attack Web Server End-User MITM

15. Transaction Signing Soft Tokens  Signature = cryptographic Message Authentication Code 14 On Internet Banking On the software token Enter Account no 0243758 Enter Amount 0243758 500.00 Generate Signature 0243758 500.00 afcbff100 Seal Transaction with Signature 0243758 500.00 afcbff100 Transaction signature stored in Audit Log for verification

16. Risk levels (NIST SP 800-63-1) 15 Minimal High Medium Low KBA OTP PKI OOB

17. 16 Security Industry in 2001 Security Industry in 2011

18. 17 Trojans / Malware

19. Endpoint Assessment  Endpoint Security Assessment  Session Clean-Up 18 POLICY Personal Firewall Anti-Virus Spyware Patches Inventory Device using File Scan Process Scan Registry Scan OS Scan Compare device scan with access policy SCANCOMPARE Allow Partial Pass Decline

20. 19 Summary  Sophistication of identity fraud schemes is increasing  Authentication deployments are converging to: –Hybrid solutions: >1 authentication method per end-user –Risk-based authentication –Endpoint security assessment  Choose a technology that –Does not lock you in –Provides entire solution – from authentication to endpoint assessment to abolishment

21. Questions and Answers E-mail: tejas.lagad@nexussafe.com Mobile: +91 99229 39931 Twitter: @Ltejas