The usual suspects were at work last week in the security arena: Microsoft issued massive patches; Snort has a problem that can be triggered by a single UDP packet; and the like.
But the Big Story was about banking, and it didnt seem to be picked up by many people. It boils down to this: username and password arent going to be good enough for online banking. The online banks are going to need at least two factor (if not more) authentication to satisfy the government watchdogs.
/zimages/5/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis InternetsSecurity IT Hub.
What started things off was the Federal Financial Institutions Examination Council (which is made up of five member agencies: the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corp., the National Credit Union Administration, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision) updating its document Authentication in an Electronic Banking Environment (which was issued in 2001) to Authentication in an Internet Banking Environment. The previous document did not endorse any particular authentication method.
/zimages/5/28571.gifClick hereto read about Ciscos showdown with the “Evil Scientists.”
The new “guidance”—which is bank-speak for “This is what upcoming regulations will look like”—is needed, says the FFIEC, to “specifically addresses the need for risk-based assessment, customer awareness, and financial institutions implementation of appropriate risk mitigation strategies including security measures to reliably authenticate customers accessing their financial institutions Internet-based services.”
/zimages/5/28571.gifRead the full story on Ziff Davis Internets Security IT Hub: Feds Look to Tighten Online Banking Rules