professionals view of e-banking security and risk analysis

Liderazgo, confianza y compromiso social

1Documento de uso exclusivamente interno. © ”la Caixa”.Todos los derechos reservados. En particular, se prohíbe su reproducción

y comunicación o acceso a terceros no autorizados.

9507 seguretat 12/04/2023

A Professional View on eBanking Authentication: Challenges and Recommendations

Jorge Aguilà, Jetzabel M. Serna-Olvera, Manel Medina,

Andreas Sfakianakis, Luis Ángel Fernández




9507 seguretat 12/04/2023

Outline

• Introduction• State-of-the-art• Threats• e-Banking Authentication• Results Analysis• Challenges & Recommendations• Future directions




9507 seguretat 12/04/2023

Introduction: eIDAS Project

• Identify the authentication mechanisms used in the eFinance applications

• Categorise the authentication mechanisms based on the perception of users and security professionals.

• Validate recommendations about the most suitable authentication mechanisms to be used, based on the risk of the operation, its strength, usability and other parameters.




9507 seguretat 12/04/2023

Contributors: Merchant Risk Council, Secure Retail Payments, EU Financial Services Information Sharing and Analysis Center, European Central Bank, European Payments Council, and Financial Services User Group.

Introduction: Participants




9507 seguretat 12/04/2023

State-of-the-art• Previous works have focused on identifying:

• Challenges, issues e-banking security [1],[2],[3]

• Threats, taxonomy of attacks, and security models [4], [5].

• An assessment of e-banking authentication methods has been provided by authors of [6]

• Similar to our study [7] analyzed the eIDAS used by major banks in English speaking countries <done by mere observation>




9507 seguretat 12/04/2023

Threats




9507 seguretat 12/04/2023

E-Banking Authentication: Identification andAuthentication Systems (eIDAS) Selection

Username / Password

OTP

Biometrics

eSignature

Context authenticationMobile e-banking app




9507 seguretat 12/04/2023

E-Banking Authentication: Operation types

• Operation 1 & 2: “Low Risk” Read access (personal data, account details)

• Operation 3: Medium Risk (Trusted) Transactions

• Operation 4: High Risk (Untrusted) Transactions




9507 seguretat 12/04/2023

E-Banking Authentication: User segments

1) Retail: personal banking or consumer banking, aimed at regular customers making low amount transactions.2) Private: personal banking with special needs, i.e.customers making large amount transactions.3) Corporate/Business: aimed at companies / enterprises.4) Investor: aimed at users managing investment tools.




9507 seguretat 12/04/2023

Results Analysis: Current practices




9507 seguretat 12/04/2023

Results Analysis: Perceived Strength, Usability and Cost




9507 seguretat 12/04/2023

Results Analysis: Risk Reduction Benefits




9507 seguretat 12/04/2023

Results Analysis: Adequacy of eIDAS Selection Criteria

Medium Strength High Strength




9507 seguretat 12/04/2023

• Implementation of robust transaction monitoring mechanisms:– context management– transaction limits , log-in attempts, time-out etc.– device identification and device health (dynamic) monitoring– anomaly detection (user behaviour, historical profile)

• Secure banking application development: – mobile OS security weakness & – deep analyse mobile attack vectors– data security (persistency, access control)

• Secure banking application distribution– Use only reputable sites to download apps, – Ensure that apps are tested for security

Recommendations




9507 seguretat 12/04/2023

• Customer awareness/education• Use of multifactor/multichannel authentication for

riskiest operations (see recom. Authent. Chains)– authentication mechanisms should be mutually independent, one

not-replicable and one not-reusable• Transaction signing: specific OTP for SMS & Mobile• Device/browser/mApplication registration• Implementation of context-based authentication

– Use eIDAS tailored to user profile, segment and to the operation or transaction risk

• Device security validation (static analysis)

Recommendations




9507 seguretat 12/04/2023

Looking to the future ….

• Mobile banking will increasingly be exploited by cyber-criminals

• Extension of current online fraud tools and controls to the mobile channel

• Migration from pure two-factor authentication to transaction signing.




9507 seguretat 12/04/2023

Looking to the future ….

• Development of new authentication mechanisms– Context-based OTP (Wen-Bin Hsieh, 2011)

– Biometrics –based OTP (OTP- Facial & Voice - You Joung Ham, 2012)

– QR codes (Jaideep Murkute, 2013): TAN/Image TAN

• Authentication in the Cloud (Risk-based)

• e-Signature (new EU Regulation)




9507 seguretat 12/04/2023

[1] M. R. Nami, “E-Banking: Issues and Challenges”, in 10th ACIS International Conference on Software Engineering, Artificial Intelligences, Networking and Parallel/Distributed Computing, 2009.[2] C. K. Dimitriadis, “Analyzing the Security of Internet Banking Authentication Mechanisms”, Information Systems Control Journal, 2007.[3] L. Peotta, M. D. Holtz, B. M. David, F. G. Deus and R. T. d. S. Jr, “A Formal Classification of Internet Banking Attacks and Vulnerabilities”, International Journal of Computer Science & Information Technology, pp. 186-196, 2011.[4] A. Fatima, “E-Banking Security Issues Is There A Solution in Biometrics?”, Journal of Internet Banking and Commerce, August 2011, vol. 16, no.2, vol. 16, no. 2, 2011.[5] A. Hiltgen, T. Krampand and T. Weigold, “Secure Internet Banking Authentication”, IEEE Security & Privacy, 2006.[6] R. Chouhan and V. S. Rathore, “e-Banking Security and Authentication




9507 seguretat 12/04/2023

Thank you!!

Questions?

[email protected]@bdigital.org

mailto:[email protected]

mailto:[email protected]

professionals view of e-banking security and risk analysis

Technology

uso exclusivamente interno

todos los derechos reservados

en particular

banking authentication

personal banking

cost9507 seguretatdocumento

ebanking authentication

consumer banking