UK banks outed on security

Major holes highlighted in online banking security

Several major UK high street banks have been forced to review the security of their customer web sites following the exposure of flaws on the Internet.

Heise Security, a publisher of security information for businesses, alerted its readers to serious security vulnerabilities in the customer-facing web sites of several UK banks.

It warned of methods that criminals could easily use to send phishing emails to users via the banks' sites, without banks ever being aware of any attack.

Heise claims it was able to prove that the web site security of NatWest, USB, Cahoot, Bank of Scotland, Bank of Ireland, First Direct and Link could be bypassed.

As a result of the published warnings, both NatWest and USB have already moved to improve site security, with others expected to follow suit.

Heise says that many banks are running vulnerable sites in spite of several years' worth of warnings about identity theft and phishing. It cited HSBC, Barclays and the Halifax as banks which passed its test.

Banks are now starting to take the issue of web security more seriously, says Alistair Newton, principal banking analyst with Gartner. "Banks are, for example, taking more care to authenticate the customers that come to their sites," he says.

"They realize that to be sure of customer's identity, they need more than just a user ID name and password. They now often add in the need for a one-time password generated by a token given to the customer by the bank."

He says security is important not just for banks to be sure of who is on their sites, but also for customers to be reassured that someone who has captured their name and password will still not be able to pose as them if they fall prey to a phishing scam.

"As always with security, there's no one solution that fits all problems," says Newton. "It's something banks will need to keep on updating. But of course if you have too many layers of security, then you start to put people off."

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Most Popular

Alibaba unveils custom Arm-based server chip
components

Alibaba unveils custom Arm-based server chip

19 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021