Untitled Document
It may already be a cliché, but the credit crunch is forcing all types
of businesses to review their costs and look at how they can reduce overheads.
For financial institutions with millions of customers, one of the most obvious
solutions is to encourage those customers toward using low-cost channels such
as the Internet to manage their accounts, rather than going to branches or through
call centers that have to be staffed.
But the Internet brings significant security risks. In the face of increasingly
sophisticated fraud attempts by cyber-criminals who have developed new ways
of accessing sensitive information with alarming speed, banks must be able to
guarantee that a customer is who they say they are. Clearly, banks must deploy
much more than password-based systems in order to encourage more customers to
use online facilities and to protect existing Internet customers from fraud.
Both Barclays and Natwest have recently announced that they are issuing card
readers to customers, indicating the start of a trend toward using strong authentication
for all customers, not just businesses or high net worth individuals.
The problem comes with integrating these new technologies into an existing
infrastructure. Most banks are already managing a legacy that is comprised of
various point solutions that are used to help customers access their accounts
via different channels using different technologies. One customer might require
a password to use the telephone banking service, and a memorable question for
resets or emergency access; another might use a token based on proprietary or
OATH technology to access online banking. Similarly, the same institution may
in the future want to introduce PKI or biometric data to further improve the
security of transactions.
Traditionally, banks and other financial services firms have built up a collection
of point security solutions that are difficult to manage and incredibly costly
to maintain. Firms are beginning to realize that there is a need to consolidate
varying authentication systems into one single infrastructure that can support
different types of credentials, from cards and tokens to interactive voice response
technology. Gartner has coined the term "versatile authentication"
to describe a platform used to manage all credentials.
-1-