Category: Security

Security4 Comments

A security hole every banker must read

Colin Henderson

Every banker and security expert must read this. The flow here is common knowledge to security experts already but it really drives home to users how they must be careful about how they approach their password strategies. The key here is to note how the interconnection takes place between, in this case, gmail and the secondary address, hotmail. The former can be secure yet through innovative ‘social enginering’ the second can open all sorts of doors. Worthwhile to take the time .. read through and think about your approach. The Anatomy Of The Twitter Attack | Techcrunch Unfortunately for Twitter, … Continue reading A security hole every banker must read

Security, Smart Cards5 Comments

6 years is too long for elimination of mag strip debit cards

Colin Henderson

We were just hit today with a case of fraud that affected my family personally, and it just validates my view that the security of our payments networks is a problem being swept under the carpet.  Every day, all banks contact thousands of customers to cancel their debit card because it was or may have been compromised.  This is a well kept secret, and has not made mainstream press yet. In our situation we actually were the card compromised, and I know enough about the card usage to narrow down the location of the compromise which is why this one … Continue reading 6 years is too long for elimination of mag strip debit cards

Security

Tower Group are right – US financial services firms have lost the battle to protect the personal information of customers

Colin Henderson

This is a sufficiently provocative headline that I can hardly ignore. Financial institutions have lost battle to protect customer data – TowerGroup | Finextra US financial services firms have lost the battle to protect the personal information of customers and must now assume that all their clients’ data has been, or will be, compromised, according to TowerGroup. First of all I agree with the headline.  The battle is largely lost;  I would go further, and hesitantly admit what few bankers will, that control over customers information never really existed.  Why do I say that? Consider how banks have evolved, which … Continue reading Tower Group are right – US financial services firms have lost the battle to protect the personal information of customers

Security2 Comments

Should the Fed be the 14th payment network, and how would that solve the problems?

Colin Henderson

President Kohn of the Kansas City Fed speaks at the ECB/De Nederlandsche Bank Conference conference in Frankfurt.  He argues for greater control by the Fed over the payments system.  While his outline of problems makes sense, they also describe the failure of the current system, and the lack of foresight from the existing controls, and its unclear that the proposed solution from them will have any impact other than exacerbating those problems.  The problems he describes are real and more importantly consumer facing.  They are also imho problems that large banks could address given their scale and the opportunity for … Continue reading Should the Fed be the 14th payment network, and how would that solve the problems?

Security

Tokyo Mitsubishi UFJ employee charged with stealing 1.5 million customer records

Colin Henderson

An employee at Tokyo Mitsubishi UFJ (Tokyo, Japan) has been arrested, charged with stealing 1.5 million customer records, of which about 49,000 have been sold to criminal elements.  The remainder have been safely recovered. Mitsubishi UFJ says 49,159 customer records leaked | Reuters TOKYO, April 8 (Reuters) – Mitsubishi UFJ Financial Group’s (8306.T: Quote, Profile, Research) brokerage unit said on Wednesday records on 49,159 customers, including salary details, were leaked and sold to data list agents. Data stolen included customers’ names, addresses, dates of birth, occupation and rough salary figures, the brokerage said. (Reporting by Junko Fujita) Continue reading Tokyo Mitsubishi UFJ employee charged with stealing 1.5 million customer records

Security1 Comment

IBM makes pilot security devices available for financial institutions to trial

Colin Henderson

IBM come out with an innovative security measure that actually makes sense.  It makes far more sense than the two factor authentication tokens many banks have been wasting their time with.  It also sounds like it requires no work on the FI end – so its a no brainer to trial this one! IBM unveils USB stick to fight online banking fraud | Finextra IBM has unveiled a prototype USB stick designed to secure online banking transactions against malware and man-in-the-middle attacks. The Zone Trusted Information Channel (ZTIC) plugs into the USB port of any computer to add an extra … Continue reading IBM makes pilot security devices available for financial institutions to trial

Security

Whole new appreciation for passwords

Colin Henderson

I learned a whole new appreciation for passwords tonight. A family member and 15 others included in an old (10 year old) yahoo account received an email ostensibly from me with a bunch of spam crap in it. The only way I can see that the combination of that account and those addresses can co-exist is if someone entered that account, possibly with a script banging away with potential hits. It was a low level password. Needless to say I have deleted all addresses from that account, and altered the password to an unguessable one. Also changed the passwords on … Continue reading Whole new appreciation for passwords

Security

The laws of unintended consequences | AML data mining

Colin Henderson

While the data collected by governments was intended to capture Anti Money Laundering and terrorists, it is providing many other results, including the recent debacle with Elliott Spitzer. globeandmail.com: Anti-laundering software casts wide net to catch big fish The software looks for subtle patterns that indicate odd activity, and when a transaction is  flagged, a human evaluates the findings. More often than not, the anomaly is explained and  dismissed. For example, someone whose banking consists of bi-weekly deposits may suddenly  show an influx of $15,000 that turns out to be profit from the sale of a car. But when investigators … Continue reading The laws of unintended consequences | AML data mining

Security3 Comments

Customers don’t want authentication devices | Abbey

Colin Henderson

Finally someone stated the blindingly obvious point that people do NOT want to carry separate devices. Banks need to provide the required security in other ways. I blogged about these devices last year, and have been amazed by the extent of deployment by European Banks, that could turn out to be wasted investment. See here for my thoughts last year, and how two factor authentication is not well understood. Finextra: Customers don’t want authentication devices, says Abbey Despite continuing security concerns, two thirds of customers do not want their bank to provide chip and PIN-style authentication devices, according to UK … Continue reading Customers don’t want authentication devices | Abbey

Security

Thanks for multi-factor authentication | Bankwide

Colin Henderson

Good article on security here at Bankwide.  It appears to be a new site, with coverage on compliance, security, and the impact on trust in Banks. A Letter From Hackers: Thanks for Multifactor Authentication | Security | Articles “Attackers aren’t getting in by guessing, they’re getting in by stealing the credentials or tricking the end-user into giving away the credentials.” So adding more credentials won’t make sites more secure. Continue reading Thanks for multi-factor authentication | Bankwide