What the Online Banking Industry is Missing

by: Greg Boop July 30, 2008    

Greg Boop

About this author:
Become a Contributor Submit an Article
  • Font Size:
  • Print

A recent report by researchers at the University of Michigan demonstrates that bank and brokerage websites are plagued by security flaws. These widespread design flaws make it easier for accounts to be compromised. According to Finextra, an examination of 214 bank websites revealed that more than 75% have cracks in security that hackers could exploit to access customer information and accounts.

Says Atul Prakash, professor in the department of electrical engineering and computer science: "To our surprise, design flaws that could compromise security were widespread and included some of the largest banks in the country. Our focus was on users who try to be careful, but unfortunately some bank sites make it hard for customers to make the right security decisions when doing online banking."

This should be a cause for concern for all banking customers, the prospect of going online and finding your account cleared out is a nightmare. Security remains the top concern for banking institutions, and regular steps have been taken to improve the situation. The state of affairs is not as dire as outlined by researchers because many of the security flaws are difficult to exploit.

The real issue with the banking industry is the lack of a systematic defined approach to security testing their websites. There needs to be a single standard that all online financial institutions are tested against.

Cisco (CSCO) has some excellent initiatives such as SAFE that improve the security of customer deployments by defining configurations and testing steps that reduce vulnerabilities. The company also has service-focused teams of specialists that aid customers in securing their networks.

During my time at Cisco, I drove an initiative called SITE (Security Integration, Test and Evaluation) which defined a structured process for evaluating potential vulnerabilities, performing boundary and penetration testing, and evaluating the results in a logical matter. This approach was incorporated as part of the quality system and utilized across the company in testing multiple product lines. The process could be scaled from “light” to “heavy” based on the needs of the team performing the evaluation. The use of automation tools for “fuzzing” (sending in deliberately mal-formed packets) and other security testing was crucial for meeting tight deliverable schedules within the framework of SITE. Over the years, the original SITE initiative has evolved and now is included within the scope of other security enhancement programs (run by some real sharp engineers) that raise the standards to even a higher level.

What does the banking industry lack? Basically the online financial industry needs to define a SITE type of initiative and a set of common standards for securing their websites. The problem is not the inclusion of vulnerabilities (which will always pop-up), but the lack of screening for vulnerabilities in a structured manner. Banks do not have a methodical approach to find the vulnerabilities, nor a structured system for ranking and resolving the issues. Most banks are flying blind to what potential vulnerabilities currently exist on their websites because testing has only been performed piecemeal over time.

Banks and brokerages have a lot at stake; losses from compromised accounts continue to mount. It is time to raise the bar in the financial industry and reduce the exposure faced by customers. This requires a change in direction for security practices, and includes a need for information services cooperation between competing institutions. The best approach would be to create a focused team with IT representatives from multiple banks to define a central testing standard utilizing a structured approach for evaluating the security of online banking websites. After adoption, the methodology would need to be driven as a requirement across the industry.

Related Articles

This article has 12 comments:

  •  
    Jul 30 08:36 AM
    This seems pretty alarmist. Security people always have the agenda of making themselves look important. Any legitimate on-line bank or broker sends an E-mail to you when you make a transaction; thus to SERIOUSLY compromise an account, a Chinese spy or Russian capitalist would need to break BOTH your bank account AND your E-mail.
    Reply | Link to Comment
  •  
    Jul 30 09:17 AM
    For the author's information, Etrade actually has a toggle system which gives you random code on something like a keychain for certain account levels. Pretty high tech stuff.

    FYI.
    Reply | Link to Comment
  •  
    Jul 30 10:13 AM
    prescient
    it seems like you're talking about a "token," which big banks will give to corporate clients. you can even get one with a paypal account, if you really need to feel secure.
    Reply | Link to Comment
  •  
    Jul 30 10:14 AM
    E*Trade does have one of the best approaches to secure "authentication&q... which is let the user choose between user name/password or using an RSA SecurID token. Much better than sites like BofA that use SiteKey or many Credit Union which use a list of security questions in addition to user name/password.

    Securing a web site is a much more involved process than just the authentication technology in use. That's what this article addresses. The concern is valid.
    Reply | Link to Comment
  •  
    Jul 30 12:42 PM
    CheckFree, the online billpay company listed here as a relevant stock, sold out last year to the bank-tech vendor Fiserv [FISV]
    Reply | Link to Comment
  •  
    Jul 30 02:52 PM
    Stephjen, you are correct, I was referring to what Gwinner references.
    Reply | Link to Comment
  •  
    Jul 31 11:09 AM
    i have an etrade account that has been compromised recently and it took them forever to send me the RSA token so i was locked out of my account for 1 week in which the financials made a huge comeback where i was heavily invested in some reverse index funds betting against financials and got screwed to a tune of a 20% decrease in my porfolio in a matter of days due to not being able to access my account....no wonder e-trade trades @ 3 bucks...where's cindy reed now?
    Reply | Link to Comment
  •  
    Jul 31 03:03 PM
    waf76 what a bunch of Hoey BS and if this happend It's your own fault for not securing your assets prior to setting up your account.... 20% is not that big of deal. Oh yea shorting Financials real smart idea. I Like ETrade and what they have to offer, you will not find a better platform or security out in the market so wht don't you short ETrade it seems this is what you are up to... That's right they all tried to short ETrade and it keeps fighting back. Nothing personal, waf76 but you got it all wrong dude!
    Reply | Link to Comment
  •  
    Jul 31 04:20 PM
    Waf76

    You are stupid or else. When an account is compromissed they will block it. You will have to call them and they will do a security check with questions and stuff. They will rest the account, and they will give you a free token. Meanwhile you wait for the token you still are able to access your account with the regular log in.

    After you receive the token you have to activate it and the log in with the code.
    This happened to me once because I logged to my account from a computer in a Apple store.
    Reply | Link to Comment
  •  
    Aug 01 08:27 AM
    by the way, my ebroker, tradeking, has a login procedure that features clicking your password on a virtual keyboard. so annoying.
    Reply | Link to Comment
  •  
    Aug 01 07:10 PM
    @GO US and SongOsOrNoGo. I've secured my information correctly. While i was able to log onto etrade my account was hidden. I wasnt able to view my account detail or conduct transactions. I did have to call and they restrict access until the security issue is resolved. While you are able to make a trade over the phone it has to be through your case manager, and in my case was she was hard to get a hold of and i was also in Switzerland so not logging onto my laptop really made it difficult for my speculative activities. Phoning in everytime I wanted to make a trade defeated the whole purpose of having an online account. You may disagree with my trading activities but that wasnt the point of my post. You can continually buy up shares of etfc and hope it comes back. I'm sure at some point it will but usually stocks that fall under $5 never come back. So Song, not quite sure why you're calling me stupid, you're the one who logged onto you're etrade account at an Apple Store. At least the reason my account was compromised was due to me logging in from another country.
    Reply | Link to Comment
  •  
    Aug 05 02:24 PM
    Talk about loging from another country I constantly trade from Colombia and US. Your statement does not sound nothing like what happens in real life. I have been there that is why I know.
    Reply | Link to Comment
Top Rated Comment Streams:

Numbers are net rating-

See all Top 100 »
More by Greg Boop

Investment Resources
Money Management
Research
Seeking Alpha provides these ads as a service to its leading contributors
Articles on related themes
Online Financial Services
Consumer Credit
Insurance
Investment Banks