October 20, 2005 (Computerworld) --
With the clock ticking for banks to implement new federal guidelines that call for stronger user authentication during online transactions, the industry's attention is shifting to the technology options available to meet the requirements. The Federal Financial Institutions Examination Council (FFIEC) last week released new guidelines aimed at overhauling security in Internet-based banking and financial services. The guidance, titled "Authentication in an Internet Banking Environment," calls on banks to upgrade current single-factor authentication processes -- typically based on user name and passwords -- with a stronger, second form of authentication by the end of 2006. The FFIEC guidance leaves it up to the banks to choose which kind of authentication to implement, but lists several that are now available, including biometric systems, tokens, and one-time passwords. The FFIEC is an interagency council set up to develop standards for the federal auditing of financial institutions by bodies such as the Federal Reserve System and the Federal Deposit Insurance Corp. (FDIC). The new guidelines are not a law, but are more like best practices that banks will be audited against by the end of 2006, a spokesman from the Federal Reserve said. At that time, federal examiners will begin documenting situations where financial institutions are not yet in compliance, he said. "I'm not a big fan of regulations in general, but this one has the right intent," said Kevin Doyle, information security officer at Pennsylvania State Employees Credit Union (PSECU) in Harrisburg. "Online threats are going more and more toward the end users, and the FFIEC is simply reacting to that trend." The key for banks is to make sure they choose the right authentication approach to comply with the requirements, said Robert Garigue, chief information security officer at the Bank of Montreal in Toronto. "There is no one single technology that is appropriate for all your authentication and authorization needs," he said. "You have to look at it in the context of the business value at risk," as well as consumer friendliness of the authentication technology.
Token-based authentication, for instance, is relatively expensive to implement, said Naftali Bennet, CEO of Cyota Inc. a vendor of antifraud services to the banking industry based in New York. That's one of the reasons why San Francisco-based Bank of the West is looking at other options. "It's a cost-benefit issue, and trying to make sure you don't put any additional inconveniences on your customers," said Donald Duggan, the chief technology officer at the bank, which manages $41 billion in assets. "My own personal viewpoint is that as a consumer, I wouldn't want to carry a token around everywhere I went," said Duggan. Instead, the bank
One positive development stemming from the collapse of Wall Street may be a boost in interest in computer science and IT careers among students who were previously interested in financial services jobs.
From Laggard to Leader: Transforming the Data Center
From Laggard to Leader: Transforming the Data Center Register for this complimentary webcast today! Go to the webcast
Computerworld Executive Bulletin: Building a Robust Antivirus Defense
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing
Intercept Spam & Viruses
Download this whitepaper to learn how to outsmart spam & viruses, compliments of MessageLabs. (Source: MessageLabs) Register for a complimentary 30 day trial of MessageLabs' new managed Anti-virus and Anti-spam security solutions. MessageLabs guarantees complete protection against all known and unknown email threats. By providing 24 hour support, your business can increase productivity and decrease risk.Register now for a complimentary trial and receive a free datasheet. Download this white paper
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Go Green with Webroot® Perimeter Security SaaS! Webroot Perimeter Security SaaS is a powerful alternative to obsolete on-premise hardware based security solutions. SaaS allows businesses to obtain flexible protection through an expert security provider, solving the problems caused by software, hardware and appliance solutions. Benefits include easier manageability, better protection and guaranteed performance –all at a lower cost. Register for your free copy of the "Why Security SaaS Makes Sense" whitepaper and Go Green with Webroot! Download this white paper now!
Fired up about IT?Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.
Companies today are realizing that competitive advantage is harder to sustain when based solely on gains in productivity and cost efficiency. The focus is shifting to invest more in business optimization initiatives which rely on trusted information to develop new insights that deliver better business results. But how can this be done efficiently in a business environment across multiple applications and processes. The answer is an Information Agenda - an innovative approach to transforming business information into a strategic asset for competitive advantage.
See your link here
Subscribe to
Computerworld 
or
Other Security Stories
From Laggard to Leader: Transforming the Data Center
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. 
Download this whitepaper to learn how to outsmart spam & viruses, compliments of MessageLabs.
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
Webroot Perimeter Security SaaS is a powerful alternative to obsolete on-premise hardware based security solutions. SaaS allows businesses to obtain flexible protection through an expert security provider, solving the problems caused by software, hardware and appliance solutions. Benefits include easier manageability, better protection and guaranteed performance –all at a lower cost. Register for your free copy of the "Why Security SaaS Makes Sense" whitepaper and Go Green with Webroot! 
Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.
John Brandon: Google Chrome = Dead, Google Search = Hot
Computerworld