UK banks 'not doing enough' on internet fraud
Which? lists security saints and sinners
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Security offered by UK banks to online customers varies widely, according to a survey by Which? Computing.
Abbey and Halifax have less secure log-in procedures than their competitors, while Barclays scored top marks in the study. First Direct, Lloyds TSB, Nationwide, NatWest and RBS were also rated as "good", while Alliance & Leicester and HSBC returned average results.
The consumer magazine singled out Halifax for particular criticism. Halifax customers need to enter three pieces of information to log in, and since "each entry is typed in full, this makes the information vulnerable to a simple keylogger".
By contrast, Barclays and Lloyds TSB ask clients to use drop-down menus. Barclays was also praised by Which? Computing for using a PIN entry device to further bolster security.
Halifax criticised the methodology of the study. "The vast majority of our fraud defence is not visible to customers and we deliberately seek to provide security which does not adversely impact our customers' ability to bank with us online," a spokesman told Sky News.
Official figures from the UK Payments Administration (formerly APACS) reports that online banking fraud reached £52.5m in 2008, more than doubling from the £22.6m recorded in 2007. The prevalence of keylogging Trojans is blamed for a large part of this rise.
Instead of tricking users into entering their login credentials at fraudulent sites that pose as the real thing, as in conventional phishing attacks, keystroke loggers are designed to record what consumers type when surfers visit online banking sites before uploading this information to cybercrime servers.
The Which? Computing study also criticises some banks - including Abbey, Alliance & Leicester, HSBC and Halifax - for not logging out clients when surfers move on to browse at other sites, an approach that leaves accounts potentially vulnerable if accessed on a shared computer.
The study also looked at security measures applied to money transfers. "Abbey, First Direct, Halifax and HSBC have no visible security controls for money transfers, so if a banking session is hijacked, a criminal can enter the amount they want to," the magazine concludes.
Sarah Kidner, Which? Computing editor, commented: "There are surprisingly big differences between big banks' visible online security systems. Some simple measures, like the use of drop-down menus, could improve safety considerably.
"The banks may say it’s the hidden security measures that count, but to have real confidence in an online account, customers need to see security in place." ®
COMMENTS
Egg online banking
This article reminds me of an incident a year or so ago. I notice that Egg are not mentioned in the article as being either good or bad, but my experience is probably one worth sharing.
After some late-night searching for some urgently-needed software, I noticed my home PC behaving strangely and determined that it was infected by some nasties. Not a problem, I thought, simply restore an image backup from a few days ago and carry on. The thing was that I had used Egg online banking that evening, and I wasn't sure if the infection occurred before or after this.
So, as a common-sense precaution, I changed my banking passwords. However, my security-researcher side was curious as to whether in fact there had been, or would be any attempted logins by someone who was not me. Disappointingly, the Egg website does not offer any useful 'you last logged in on' or any access log function, as I am used to seeing on other banking web sites that I use. So I composed a message telling them about this and asking politely if they could give me some sort of log-in history.
I was most surprised to receive a curt response, quote:
"Dear Ed I'm sorry but we don't keep records of when you log into the Egg website. Thanks for your message. Regards Siobhan ***** Internet Customer Services"
Cue loud alarm bells. A 'secure' banking web site that does not have any logs? Doesn't sound right to me. So a reply went back to Egg, again polite, explaining that I work in the IT field and I thought this was a most unusual state of affairs, could they please clarify the situation for me?
A week later, on a Saturday afternoon whilst I was walking in the Lake District, I got a phone call from a lady at Egg. She seemed to want to be helpful and reassure me that my accounts and funds were not in any danger. However, she completely failed to undestand the principle that logs are a pretty essential thing in any web site, especially a security-sensitive one. As I was trying to enjoy some relaxing weekend time, I didn't want to labour the point so after 20 minutes I gave up and left it at that. I never found out whether the malware compromised the password and a malicious individual might have attempted to gain access to my accounts.
I would be most interested if anybody has anything further to say about this experience, or their own...
Alliance Trust
My husband and I use an investment bank called Alliance Trust Savings. Their online thing is possibly the most insecure I've ever seen. Userid and passcode, all numeric. Type both in. No choosing from a list, no secureid solution.
My broker has suggested to my husband and i that we use a more secure system.
just thought id recommend you all do too!
Coutts Media Banking
Admittedly, business banking where you're throwing hundreds of thousands around the whole time isn't the same client base as some granny at home, but I have to say they're bloody good. 2 lots of random character picks from a pin and a password with forced monthly changes, challenge/response for authorising transfers with the calculator thingy, configurable. Last log-on, proper auditing, least permissions granted to suit the needs of the account holder, etc. You can even have a paper/fax system of signal card unique random numbers to strike off in sequence to authorise a phone or paper/fax transaction, should it be useful to you.
Seriously, if you're looking for a good service for business banking, Coutts are very good and not *that* expensive. Makes my lloydstsb look wimpy by comparison, security-wise.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
