MADISON, Wis. -
“I don’t believe in website verification that uses images, like many MFA packages offer,” said Eric Bangerter, director, Internet services at UW Credit Union here. “Using images to verify sites can create a false sense of security for members because man-in-the-middle attacks would continue to show these images.”
The $980-million UWCU added a vitamin-packed Secure Sockets Layer (SSL) Certificate product in May to give members additional assurance that they are performing transactions on a valid, “rigorously” verified UWCU page–and not a phishing site, said Bangerter.
UWCU’s Extended Validation (EV) SLL is offered by Verisign, a Mountain View, Calif.-based Internet infrastructure service provider.
“We added EV SSL because we feel strongly that one of the best ways to know a site is legitimate is to examine its SSL certificate,” Bangerter continued. “If there were a man-in-the-middle attack from our site, the EV SSL certificate would not appear as valid. And the EV certificate is better than a typical SSL certificate, as it makes the fact that the site is secure even more obvious.”
On a valid UWCU page, online members see a green address bar with two identifiers: the UWCU Web address and a Verisign certificate. Verisign and MFA logos are also displayed on the page, and the page is loaded under a strong encryption technique, no matter what software or hardware the member is using.
In addition to EV SSL and MFA, the credit union uses a code security tool to double-check the online banking programming code before it’s deployed, as well as running nightly network scans to identify security holes, said Bangerter.
Beyond SSL, Rick Rhoads, SVP-eServices at $13.5-billion State Employees’ CU in Raleigh, N.C., likes the look of Microsoft’s CardSpace offering in the new ‘identity card selector’ realm. “CardSpace is a digital certificate and so much more,” Rhoads said.
Stored on a user’s PC, the CardSpace software holds virtual “cards” that allow users to show selected portions of their digital identity to a participating, valid online service, all at the user’s discretion.
Biometric authentication offers additional promise, according to Rhoads. Indeed, members at Technology CU in San Jose, Calif., will be able to log-in from home using fingerpad readers next year, according to Barbara Cure, information technology project and vendor manager at the $1.3-billion CU.
And Internet banking provider Open Solutions announced last month that clients could offer fingerprint authentication to members.
Even with the additional security offered by digital certificates, member education is still the lowest common denominator, the CU executives suggested.
“We just hope members learn to recognize EV SSL, so if they are ever on a site that simply appears to be ours, they’d notice it is missing,” said Bangerter. “They also need to understand what ‘https’ means and what to look for if they are unsure whether to trust a site.”
FOR MORE RESOURCES
Read more about MFA at cujournal.com and search the following bolded terms in the archive:
Multi-Factor Fallout: The Plusses And Minuses Of ‘Security By The Regs’
Company Predicts Its Anti-Phishing Solution Will ‘Dominate’
How One CU Boosted Online Banking By Beefing Up Security
For info on this story:
* www.ncsecu.org
* www.techcu.com
* www.uwcu.org
* www.microsoft.com
* www.opensolutions.com
* www.verisign.com
