Positively ID online users by identifying behavior and gestures that are unique to each individual: “Banks Heap Suits on Target over Breach,” read a recent headline of a Wall Street Journal story. By that time, seven financial institutions had already filed class action suits against the retail giant alleging it did not sufficiently protect its customer’s data. They have a case, as a review of how the breach occurred shows that hackers accessed customer information despite the fact that the credit card security codes and debit PINs were encrypted. Numerous other retailers also have suffered cyberattacks; but at 40 million accounts, the magnitude of the Target bombshell heralds a call-to-arms for all retailers and any other businesses that allow consumers to access their accounts via the Internet. This includes diverse industries such as healthcare, education, hospitality, government, travel and the very institutions behind the recent lawsuits, banking and financial. The Risk Based Security and Open Security Foundation reported a record number of 2,644 breaches in 2012, with 70 percent due to external hacking. A total of 267 million records were exposed, and according to Javelin Research, the dollar amount stolen was $21 billion, a three-year high. Conducting “business as usual” will no longer suffice. To reassure and retain now-skittish consumers, any entity that engages in e-commerce must employ greater lock-down methods. ID authentication now requires protection that goes beyond ordinary PINs and passwords. Some early-adopting businesses and institutions have already pegged biometric-signature authentication as a more secure approach to providing greater accuracy in customer verification. Given the advantages that the latest systems require absolutely no additional hardware; entail no extra expense by users; reside in the cloud, outside of the company‘s business system and allow for the monitoring of fraudulent activity, this subset of biometric verification is emerging as a strong new strategy of defense. “We have used signature biometrics for nearly three years with more than 10,000 student users, and it has exceeded our expectations,” said Dr. Mark Sarver, CEO of eduKan, a consortium of community colleges offering online courses and degrees. “It provides an identity-proofing means that is transparent to our students while respecting their privacy. [It] is available anytime and stays cost-effective for the institution.” Toward the Next Level of Customer Authentication Identification-checking modalities currently fall into three basic categories: Presumably something only the user knows, such as a PIN or password; An item that the user has in his or her possession: devices like a flash drive or a token that provides random authentication codes, credit cards or personal IDs in various forms, including a phone; and Biometrics: something physically or behaviorally unique to an individual. The failure of relying on something the user knows has become all too apparent. Cybercriminals have repeatedly proven the ease of cracking passwords and PINs. Secondly, requiring a user to possess a verification tool, like a flash drive, entails the cost of purchasing, producing and distributing the necessary hardware. Beyond the initial expense, these items can break, get misplaced or stolen. Of even greater concern, such devices do not necessarily authenticate the individual. They only verify that a person has possession of the device. The same can be said for personal IDs, credit cards and phones; does one really know if that person is the rightful owner? This leaves biometric verification, quantifiable physical characteristics of each individual. Examples include fingerprints, iris scans, facial recognition and even vein scanning. While this offers near-absolute verification, this type of identification requires sophisticated and costly hardware to capture and interpret.
Posted on: Sun, 29 Jun 2014 03:15:33 +0000