Comments on: Charging Your Customers To Reduce Your Security Costs Never Has and Never Will Work http://blogs.gartner.com/john_pescatore/2009/07/29/charging-your-customers-to-reduce-your-security-costs-never-has-and-never-will-work/ A member of the Gartner Blog Network Sat, 04 Feb 2012 17:10:54 +0000 hourly 1 http://wordpress.org/?v=3.0.4 By: Scott Olson http://blogs.gartner.com/john_pescatore/2009/07/29/charging-your-customers-to-reduce-your-security-costs-never-has-and-never-will-work/comment-page-1/#comment-1255 Scott Olson Fri, 31 Jul 2009 14:32:35 +0000 http://blogs.gartner.com/john_pescatore/?p=747#comment-1255 I couldn't agree with you more. I have the Verisign iPhone token for my PayPal and eBay accounts and have been trying to get my bank to offer that as an authentication mechanism for online banking with no success. It is in the bank's best interest to protect their customers and encourage them to use online banking, which saves the bank far more per year than their measly $10. I saw a report from Black Hat yesterday discussing the latest trojan Clampi, which is targeting online banking accounts, and the conclusion of the report was to use a completely separate PC solely for online banking. It's ridiculous. Multi-factor authentication should be a minimum bar of security for online banking and brokerages. I hope some of these institutions can get that through their heads. I couldn’t agree with you more. I have the Verisign iPhone token for my PayPal and eBay accounts and have been trying to get my bank to offer that as an authentication mechanism for online banking with no success. It is in the bank’s best interest to protect their customers and encourage them to use online banking, which saves the bank far more per year than their measly $10.

I saw a report from Black Hat yesterday discussing the latest trojan Clampi, which is targeting online banking accounts, and the conclusion of the report was to use a completely separate PC solely for online banking. It’s ridiculous. Multi-factor authentication should be a minimum bar of security for online banking and brokerages. I hope some of these institutions can get that through their heads.

]]> By: John Pescatore http://blogs.gartner.com/john_pescatore/2009/07/29/charging-your-customers-to-reduce-your-security-costs-never-has-and-never-will-work/comment-page-1/#comment-1248 John Pescatore Fri, 31 Jul 2009 10:52:59 +0000 http://blogs.gartner.com/john_pescatore/?p=747#comment-1248 I agree - for something as sensitive as online banking and with the risk of phishing rampant, strong authentication should be the only form offered. I think the text message to cellphone approach (plus a PIN) is good enough - tokens don't necessarily have to be required but could be offered for those who don't have mobiles or don't like to text or whatever. I agree – for something as sensitive as online banking and with the risk of phishing rampant, strong authentication should be the only form offered. I think the text message to cellphone approach (plus a PIN) is good enough – tokens don’t necessarily have to be required but could be offered for those who don’t have mobiles or don’t like to text or whatever.

]]> By: Marc Dierens http://blogs.gartner.com/john_pescatore/2009/07/29/charging-your-customers-to-reduce-your-security-costs-never-has-and-never-will-work/comment-page-1/#comment-1246 Marc Dierens Wed, 29 Jul 2009 14:33:04 +0000 http://blogs.gartner.com/john_pescatore/?p=747#comment-1246 Agree, here in Belgium most of the banks have adopted this system as a default one, so we have no choice but to use the token. So far we have not yet had to put up some money, but who knows what will happen in the future. Shouldn't this bank give the users the token as only option? It would seem that the security of the system without token does not give enough security to be confident in using the system in the first place? Agree, here in Belgium most of the banks have adopted this system as a default one, so we have no choice but to use the token. So far we have not yet had to put up some money, but who knows what will happen in the future.

Shouldn’t this bank give the users the token as only option? It would seem that the security of the system without token does not give enough security to be confident in using the system in the first place?

]]>