For banks, offering Internet banking can be like walking a tightrope. You must offer a full range of products and services to remain competitive while implementing a fully secure framework to protect assets. If you delay in getting your products and services online, you may lose business. But if you do not secure your systems properly, you may lose the entire bank.
Browser-based solutions can expose the bank to a number of security threats:
Spoofing – legitimate users being impersonated;Information being sent or received erroneously;Information transferred between the client and the bank being intercepted or “listened to” by an unwanted third party; Denial of service/brute force attacks – a single user taking up so much of a shared resource that there is no resource left for any other users. The following are established measures that a bank can take to combat these security threats:Firewalls; A firewall is a software program that acts as a gatekeeper between the Internet and an organization’s computer network. It protects the bank by checking the IP addresses (the sources and destinations) of all packets of information going in and out of the bank’s web server. Wherever an unauthorized source is identified, the message is halted and the incident is recorded.
An application-level firewall is slightly more sophisticated as it examines the data content as well as the addresses. While this firewall is slower than a packet filter, it performs the important task of scanning the incoming data for dangerous programs intended to steal or destroy data. Rather than rejecting the message, it transfers the data to proxy programs that run safely on the network.
PC Cards
While password authentication provides sufficient security at the log-in stage, many banks implement an additional level of protection in the form of hardware authentication. This is where a user has a physical token to identify himself/herself such as a PC or smart card. A PC Card, which is about the size of a credit card, is inserted into a PCMIA slot on the user’s personal computer. Such slots are a standard feature on today’s computers, including laptops. Once inserted, users are prompted to enter a PIN (Personal Identification Number), and when the correct PIN has been entered, the user’s digital certificate is read from the card.
Encryption
Encryption is the conversion of data into a scrambled form, known as a cipher. Once encrypted, the data can be securely transmitted between two parties without being intercepted by unauthorized eavesdroppers.
Encryption can be described as being “strong” or “weak”. When an application uses strong encryption, it means that the keys used in the encryption/decryption process are made of 128 bits. The alternative is “weak encryption” which uses 40 bit keys. This is less secure for the simple reason that there are less possible combinations to break.
Public Key Cryptography
Public key cryptography is widely used to secure Internet communications. Not only does it identify the two parties, it also assures that they cannot deny their participation in the transaction. Public-key cryptography is based on the assumption that users must identify themselves to the application. This is done using ‘keys’, which are long strings of data. A user holds two keys, a private key, kept in a safe place, and a public key. When the user sends a message to the bank, it is encrypted. The bank can only decrypt the user’s message with the bank’s private key and the user’s public key.
Digital Signatures and Certificates
Digital Signatures play a critical role in identifying the two parties involved in a communications session. Digital Certificates confirm that the keys belong to valid users by linking the user’s identity with his/her private and public keys. Rather than storing keys and user information in proprietary format within an application, digital certificates provide a standard format for holding the information. They normally hold the user’s public key in addition to some other information such as the user’ telephone number, e-mail address, passport number, etc. Digital certificates are issued by Certification Authorities (CAs) -either an internal entity or trusted third party-that issues, signs, revokes, and manages digital certificates.
Software Signing
From a security point of view, the customer needs to be sure that the application programs (applets) originate from the bank. This is ensured through “software signing”. Before installing software on the web server, the bank must obtain a software or object signing certificate from one of the browser-approved CAs. The customer’s browser software uses this signature to verify the integrity of the software when it is downloaded.
SSL
SSL, also known as Secure Sockets Layer, is a security protocol that works hand in hand with encryption and digital certificates. Before the data is actually transmitted, SSL 3 provides a security “handshake” that is used to initiate the connection. This results in the client and server agreeing on the level of security encryption they will use and fulfills any authentication requirements for the connection.
A Web site secured with the SSL 3 protocol will display a key in the lower corner of a Netscape browser, or a padlock at the bottom of a Microsoft browser, ensuring that data transmitted from that page cannot be altered over the Internet.
The SSL 3 protocol provides “channel security” which has three basic properties:
Privacy – encryption is used for all messages after a simple handshake is used to define a secret key. Authentication – the server endpoint of the conversation is always authenticated, while the client endpoint is optionally authenticated. Reliability – the message transport includes a message integrity check. SSL 3 is used in association with IIOP (Internet Inter-ORB Protocol), an object-oriented protocol that makes it possible for programs written in different programming languages to communicate over the Internet. IIOP is a critical part of a strategic industry standard, the Common Object Request Broker Architecture (CORBA).
Sandboxing
Sandboxing allows a program to run on a machine while limiting its powers-the downloaded program can only perform a select set of functions. For example, when a Java code needs to do anything that requires it to step outside the sandbox that the browser has imposed on it, the user will be prompted to verify the action.
Many of these systems are used in conjunction with one another, making it difficult for thieves, hackers and other threats to penetrate Internet banking.