Hey FFIEC, Is This Really Guidance?

Create a vendor selection project & run comparison reports
Click to express your interest in this report
Indication of coverage against your requirements
A subscription is required to activate this feature. Contact us for more info.
Celent have reviewed this profile and believe it to be accurate.
5 July 2011
Jacob Jegher
Last week the FFIEC issued the long awaited Supplement to Authentication in an Internet Banking Environment. I read through the 12 page report (it's actually 8 pages with a 4 page appendix), and kept reminding myself that I should try to look at this in a cup half full manner. Yes, I can be a cup half empty kind of a guy, however I must say that this document doesn't say much that most banks don't already know. The wording is vague, open to interpretation, and unclear. It's a great read for someone who is new to the space that wants to get a high level overview of some of the challenges banks are facing. I know that banks are going to be placing a lot of energy into analyzing this document, and making sure they can follow the so-called guidance. The first problem is the title - Supplement to AUTHENTICATION. Authentication is was definitely a big deal back in 2005 when the first iteration of this document was released. At this stage of the game, it really doesn't mean much. Sure, all banks should have it, and yes they should pay attention to new solutions that can enhance authentication. Today, with current threats and attacks, authentication is about as useful as a security guard that is placed in front of a bank building. The guard can scare people off, and provide the appearance of security. If criminals or terrorists want in, we all know that the guard is nothing more than a useless sentry. So sure, let's keep on forcing customers to use the familiar image/phrase/challenge question routine for online banking. But let's accept the fact that multifactor authentication, even using hard tokens, is pretty useless. The document keeps referring to layered security - that's a good thing. But how long have we been hearing that for? Great that its down on paper given that it's so critical. It's the most important step a financial institution can take but a lot more detail and guidance is required here. There was quite a buzz regarding the fact that the document doesn't discuss mobile banking security. That ties back to the vagueness of the document. Personally, that doesn't bother me as much. The info in this doc has to be consumed with the understanding that consumers and businesses are using a range of electronic devices - PCs, mobile phones, tablets, etc. Yes, there are going to be security issues that are device category specific. It would have been nice to see things laid out a little more clearly, or at least recognition of this trend. On page 3, the document goes over high risk transactions. The overly structured section misses a key point - as features migrate out of the branch for cheaper self service alternatives (think consumer wire transfers online) the risks increase. Financial institutions need to plan for these changes now and understand that the online channel is already handling higher risk consumer transactions. In my opinion, the most important section of this document should have been customer awareness and education. It takes up approximately half a page. Banks do a very poor job of educating customers, and there are tons of examples to prove it. Since the consumer is the weakest link in the equation, this clearly requires a lot more attention. Can I be a curmudgeon? Absolutely. Is it warranted in this case (objectively speaking of course)? Without a doubt.


  • So beyond multi-factor authentication at login, what type of solutions do you think should have been proposed in the Supplement?

    Challenge-response questions, tokens, certificates, etc. are all old news in the online security world. I'm curious how you think banks can go beyond the security-guard-at-the-door mentality and bring some real innovation to combat these increasingly sophisticated and savvy hackers.


  • Definitely nothing to do with authentication. There is no silver bullet right now. It's either the security guard at the door or a real hassle for consumers.

    My recommendation for one of the layers is a forensics solution, one that tracks behaviour and looks for patterns. It's a must have for banks of all sizes and is transparent to the end-user. Couple this with improved and mandatory customer training and education and you have a win-win piece of the solution.

    The devil is in the details.

Insight details

Insight Format
Geographic Focus
Asia-Pacific, EMEA, LATAM, North America