Polling Question
Briefly describe the #1 problem you have
encountered with implementing Multi-Factor
Authentication.
f
Please type in your response.
Getting the Facts on Multi-Factor Webinar
Donna Dodson
National Institute of Standards and Technology (NIST)
Kimberly Cahill, NBE, CISA
Bank Information Technology Analyst Comptroller of the Currency
Gary Greenwald
Managing Director, Cash Management Capabilities and Information Products
Getting the Facts on Multi-Factor Webinar
Donna Dodson
E-Authentication Guidance
f OMB 04-04, E-Authentication Guidance for Federal Agencies
Defines four levels of assurance in term of the consequences of
authentication errors and misuse of credentials
Risk assessment reviewing privacy, inconvenience, damage to
reputation, harm to agencies and programs, financial liability, crime, safety
f NIST Special Publication 800-63, Electronic Authentication Guideline
Establishes technical requirements to meet four levels of assurance
Authentication Model
f
Local or Remote
f
Players
Claimants Subscribers Registration Authorities Credential Service Provider Verifiers
Authentication Elements
f
Token – something that the claimant possesses
and controls (typically a key or password) used
to authenticate the claimant’s identity
f
Credential – An object that authoritatively
binds an identity to a token possessed and
controlled by a person
f
Assertion - a statement from a verifier to a
Authentication Factors
f Something you know Typically some kind of password
f Something you have
For local authentication typically an ID card
For remote authentication typically a cryptographic key “hard” & “soft” tokens
f Something you are
A biometric
Problematic without supervision
Capture can deter fraud even if not checked in authentication process
Tokens
Single-factor token – a token that utilizes one of the
three factors to achieve authentication. For
example, a password is something you know, and can be used to authenticate the holder to a remote system.
Multi-factor token – a token that utilizes two or more
Common Types of Tokens
f
Memorized secret token
f
Pre-registered knowledge token
f
Look-Up secret token
f
Out of band token
f
One time password device
Token Selection Considerations
f
Security considerations
Single factor vs multifactor vs multitoken Hardware vs software
Protocol Associations
f
Costs
Polling Question
Have you fully implemented
a Multi-Factor Authentication program
per the FFIEC guideline?
Getting the Facts on Multi-Factor Webinar
Kimberly Cahill, NBE, CISA
Bank Information Technology Analyst Comptroller of the Currency
Disclaimer
The views and opinions expressed are not
official positions of the FFIEC or the
Agenda
What Prompted Guidance
Guidance
What Prompted the Guidance?
f “Cybercrime yielding more cash than drugs”
f TJX data breach info used to make fraudulent purchases. f In 2006, there were in excess of 315 publicized breaches
affecting nearly 20 million individuals.
Common Threats
f
Losing
Data
f
Hacking
f
Phishing
f
Pharming
f
Spying
DisgruntledConsumer Concern
f
67% are very concerned about identity theft.
f
73% worried about fraudulent use
f
25% say stopped buying online
Guidance
“The level of authentication used by the FI should be
appropriate to the risks associated with those products and services. FIs should conduct a risk assessment to identify the types and levels of risk associated with their Internet banking applications. Where risk assessments indicate that the use of single-factor authentication is inadequate, FIs should implement multifactor authentication, layered security, or other controls
reasonably calculated to mitigate those risks. The agencies consider single-factor authentication, as the only control
Key Steps for Conformance
f Risk Assessmentf Implement Risk Mitigation
Strategy
Risk Assessment
f Identify and rank “high risk” Internet transactions
f Describe specific customer information viewable during Internet sessions
f Evaluate current
authentication procedures
Acceptable Risk
Mitigation Techniques
f
Where risk assessments indicate that the use of
single-factor authentication is inadequate,
financial institutions should implement:
multifactor authentication, layered security, or
other controls reasonably calculated to mitigate those
Other Risk Controls
f
Content
Minimize (mask) confidential information
f
Segregate access
Separate basic info, bill payment, funds transfer
f
Accessibility
Monitoring and Reporting
f Audit Features - Behavior Patterns
f Service Provider’s Reports f Independent Audit Review
Customer Awareness
f Key defense, butnot a control
f Continue efforts
f Track your efforts (Call center, clicks on alert and disclosure links, type of marketing, trends in losses)
New FTC Education Website
Acct Origination &
Verification
Reliable identity verification at origination is critical for:
Negative confirmation Positive confirmation Out-of-wallet questions X Compliance w/ USA Patriot Act
Bottom-Line
X An acceptable solution today might not be acceptable tomorrow….the bad guys are just as smart as the
good guys developing the solution
Bank Supervision Policy
f
FFIEC Information Security Booklet
f
12 CFR 30, Appendix B
f
OCC 2005-35: Online Authentication
f
OCC 2005-24: Website Spoofing
f
OCC 2005-13: Customer Notification
Polling Question
Implementing Multi-Factor Authentication
has met my expectations.
f
Strongly Agree
f
Agree
f
Agree Somewhat
f
Disagree
Getting the Facts on Multi-Factor Webinar
Gary Greenwald
Managing Director, Cash Management Capabilities and Information Products
The Opportunity
f Look beyond website access control
f Paperless workflows
f Legally binding electronic signatures
Case Study: Pharmaceutical
f Electronic submissions to the FDA
Costs are rising
Time to market is long Paper intensive
f What are we providing?
Identity issuance
Case Study:
Managing Corporate Bank Accounts
f Need for better process Visibility Control Efficiency
f What are we providing?
Standard for account opening
and managing corporate bank accounts, working with
industry groups
A single digital identity across
banks
Case Study: Corporate Payment Files
f Improved process for straight throughprocessing (STP) of payment files
f Driven by Industry move to STP and even corporate SWIFT connectivity
f Issue: What individual has released the payment file? Is he/she entitled?
f Use of digital signatures to confirm
Role of Banks
f Sit above technology layer
f Focus on high assurance
Using multi factor tools for strong
authentication
Positions banks as leaders f Focus on what banks do well
KYC
Trusted parties
Subject to regulatory oversight
Know and understand the importance of
strong policies and legal structures
Integral part of the global payment and trade
infrastructure
Extensions into public sector, consumers and
