Credit unions can get rid of those widely publicized website authentication tools, as they will no longer have to shoulder the responsibility of proving to visitors that their websites are valid, according to one authentication provider here.
Instead, websites will be instantly verified by consumers themselves, said Digital Resolve, a risk-based authentication firm.
Users need only common web browsers or anti-virus software loaded with Trusted Server Technology, a new website authentication and whitelist solution that has been developed by Digital Resolve.
Trusted Server Technology
Trusted Server Technology could protect up to 98% of all Internet surfers within the next 18 months as a result of forthcoming partnerships with desktop software providers, predicted Dennis Maicon, executive vice president of Financial Services Solutions at Digital Resolve.
Website authentication is designed to help prevent phishing attacks, a form of e-mail fraud in which computer hackers trick consumers into visiting bogus websites to enter personal financial information.
Consequent man-in-the-middle attacks, whereby hackers sit online and collect login information as the user enters it, may also be prevented by the authentication technologies.
As phishing attacks escalate, credit unions have felt pressure to authenticate their websites on the host side using image-based products, such as RSA Security's widely deployed Site-to-User Authentication Module.
This product was formerly known as PassMark Security's Two-Factor Two-Way Authentication (see related story 12).
'Two-Way' Authentication
With "Two-Way" authentication, members go online to choose a secret image and a caption. Before login, the image and caption are displayed on-screen in efforts to assure a member that he or she is at the valid credit union website.
But Atlanta-based Delta Community Credit Union (DCCU) avoids using website authentication in its layered approach to Internet security, which includes member authentication, said Bill Mesplay, chief information officer.
"The website authentication approach may be intrusive to members, and it may be easily duplicated," he explained.
Whereas website authentication may be less effective on the credit union side, Mesplay said that credit unions stand to gain from a website authentication solution that originates on the consumer side.
Building Member Confidence
"The Trusted Server Technology will help build member confidence in completing transactions via the online channel," he said. "If the technology is integrated with Microsoft Internet Explorer, it could protect somewhere in the neighborhood of 90% of our membership."
Trusted Server Technology is designed to protect a computer desktop by indicating which websites are on Digital Resolve's website white list, which is updated in real-time.
Users will get a "green light" from desktop software as they surf, letting them know that it is safe to continue with their visit to the site.
For example, last month's attack on CitiBank business customers, in which phishers collected personal financial information, could have been prevented "without question" if Digital Resolve's whitelist technology had been integrated with CitiBank customers' Internet Explorer software, according to Maicon.
"That man-in-the-middle server was not on the Trusted Server list," he explained. "The consumer would have seen that there was something suspect."
But Trusted Server Technology alone isn't enough to safeguard the Internet for members, Mesplay observed.
That's one reason the $2.5-billion Delta Community Credit Union will continue to take a back-end, risk-based approach to secure its own website.
The credit union runs Fraud-Analyst, Digital Resolve's risk-based, member authentication solution for log-ins, transactions, and new account enrollment processes.
The solution reports suspicious user behavior and provides additional authentication for high-risk transactions.
Intrusion prevention, firewalls, and secure internal architecture round off Delta Community Credit Union's security perimeter, Mesplay said.
Bottom line: authentication continues to be a major issue for financial institutions.
CUJ Resources
For info on this story:
* Delta Community CU www.deltacommunitycu.com
* Digital Resolve www.digital-resolve.net
