Australian banks start replacing RSA tokens
Singing from the same song-sheet
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
The ongoing fallout in Australia from the RSA security hack continues, with both Westpac and ANZ Bank announcing they will replace customers’ tokens. Another of Australia’s “big four”, the Commonwealth Bank, is yet to decide its course of action, while there’s been no word yet from the National Australia Bank.
Westpac has not revealed how many tokens will have to be replaced, but ANZ’s user base is reported to be around 50,000.
Australia’s banks haven’t rushed to discuss the issue in public. It would appear that their hands have been forced by attacks on defense contractors that have become public in recent weeks, which are eroding confidence in the system.
Nearly every public statement from Australia’s banks has included a bromide about “multi-layered security”, suggesting either a startling lack of originality, or a boilerplate written by RSA. Here are some samples:
“One part of a multi-layered security process” – the Commonwealth Bank.
“The bank … protects customers through a multi-layered security approach” – Westpac.
“One layer of multi-layered security measures” – ANZ Bank.
Given RSA’s original reluctance to discuss the risks involved in the original security breach in March, followed by security breaches at Lockheed Martin and others, culminating in RSA’s belated offer to replace the tokens, the bankers had better hope their reassuring statements don’t fall apart in the face of events. ®
COMMENTS
Multi-layered security
So the banks are finally all with the programme - hooray!
"Multi-layered security" is not regarbled RSA speak, it's good practice. Anyone that cares to read a few technical manuals about VPN and remote access will know that this means tokens, certificates, firewalls, IPS, access control lists etc., so no need to make this out to be a mystery when it isn't...
But of course there is multilayered security
Layer 1: whatever login security the bank has used
Layer 2: denying a problem exists
Layer 3: the ability to blame whoever they bought their systems off
Layer 4: the ability to offload risk and/or costs to the bank customer
How many more layers do you need? I'm sure they feel pretty safe under that lot.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
