Citibank has taken a major step away from archaic password systems for its online banking services. Last month, the bank was granted a patent for a system allowing users to log into an online account via a trusted device.
The system essentially binds a particular device – eg. a smartphone – to the user’s account, letting the device be used as the key to unlock access. The patent indicates that the system would rely on a customer profile being created on the device, and that this needs to be done “via at least one attribute of the computing device and an encrypted token stored on the computing device,” which suggests that the system relies on some unique feature of the user’s device to link it to the customer in question.
It sounds like a clever system, but, as Avi Turgeman points out in an Infosecurity Magazine article, it’s not enough security to authenticate actual financial transactions – it only allows for the user to check account balances and so on. To get to the point where actual transactions could be authentication, Turgeman suggests the adoption of ‘cognitive biometrics’ – also called ‘behavioral biometrics’ – to analyze user activity in cloud, mobile, and web apps and authenticate that it fits the user’s standard behavioral patterns.
It’s a nascent field of authentication that is steadily gaining interest via solutions like NuData Security’s NuDetect system, which aims to prevent online fraud via just these methods; not to mention Socure and BioCatch, the latter of which was recently integrated into Early Warning’s solutions aimed at the financial services sector. Turgeman suggests that cognitive/behavioral biometrics security “complements device solutions like device fingerprinting and device binding as an additional layer of risk analysis and security”, and while most financial institutions appear to be comfortable enough with traditional biometric authentication like fingerprint scanning systems, as security threats evolve going forward, such organizations may indeed want to take up the suggestion and add this valuable extra layer to their overall security framework.
—
June 19, 2015 – by Alex Perala
Follow Us