FFIEC Customer Authentication Guidance: Authentication in an Internet Banking Environment
About the Speaker
Discussion Topics
Overview of the FFIEC
Evolution of the Guidance
Evolving Cybercrime Landscape
Objectives of the Guidance
Layered Security Approach
Multi-Factor Authentication
Multi-Factor Authentication Examples
Effective Layered Controls
Establishing Effective Layered Controls
Risk Assessments
Recent Court Cases
New FFIEC Working Group

Establishing Effective Layered Controls

A well designed control framework does not always mean that effective controls are in place:
Effective authentication should have customer acceptance, reliable performance (with formally established policies and procedures), scalability to accommodate growth, interoperability with existing systems and future plan.
Effective Layered controls must have quality substance, not just the form of a control.
Challenge questions that are overused, or publically obtainable knowledge are not considered effective (eg. mother’s maiden name, high school the customer graduated from, year of graduation from college, etc). Utilization of sophisticated “out-of-wallet” questions along with “red herring” questions is considered effective.
Simple device identification (cookie based) and geolocation can be circumvented through the use of copying cookie files and proxies. Use of “one time” cookies and more complex digital fingerprints are considered to be effective tools.