UK banks outed on security
Major holes highlighted in online banking security
Several major UK high street banks have been forced to review the security of their customer web sites following the exposure of flaws on the Internet.
Heise Security, a publisher of security information for businesses, alerted its readers to serious security vulnerabilities in the customer-facing web sites of several UK banks.
It warned of methods that criminals could easily use to send phishing emails to users via the banks' sites, without banks ever being aware of any attack.
As a result of the published warnings, both NatWest and USB have already moved to improve site security, with others expected to follow suit.
Heise says that many banks are running vulnerable sites in spite of several years' worth of warnings about identity theft and phishing. It cited HSBC, Barclays and the Halifax as banks which passed its test.
Banks are now starting to take the issue of web security more seriously, says Alistair Newton, principal banking analyst with Gartner. "Banks are, for example, taking more care to authenticate the customers that come to their sites," he says.
"They realize that to be sure of customer's identity, they need more than just a user ID name and password. They now often add in the need for a one-time password generated by a token given to the customer by the bank."
He says security is important not just for banks to be sure of who is on their sites, but also for customers to be reassured that someone who has captured their name and password will still not be able to pose as them if they fall prey to a phishing scam.
"As always with security, there's no one solution that fits all problems," says Newton. "It's something banks will need to keep on updating. But of course if you have too many layers of security, then you start to put people off."
The ultimate law enforcement agency guide to going mobile
Best practices for implementing a mobile device programFree download
The business value of Red Hat OpenShift
Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShiftFree download
Managing security and risk across the IT supply chain: A practical approach
Best practices for IT supply chain securityFree download
Digital remote monitoring and dispatch services’ impact on edge computing and data centres
Seven trends redefining remote monitoring and field service dispatch service requirementsFree download