On The Design of Secure ATM System

Size: px
Start display at page:

Download "On The Design of Secure ATM System"

Transcription

1 213 Chapter 13 On The Design of Secure ATM System Lawan Ahmed Mohammed King Fahd University of Petroleum & Minerals, Saudi Arabia EXECUTIVE SUMMARY Over the past three decades, consumers have been largely depending on and trust the Automatic Teller Machine, better known as ATM machine to conveniently meet their banking needs. ATM is a data terminal, it has to be connected to, and communicate through, a host processor. The host processor may be owned by a bank or any financial institution, or it may be owned by an independent service provider. Moreover, an ATM can support multiple ATM cards owned by different financial institutions or banks. Most host processors can support leased-line or dial-up machines. However, despite the numerous advantages of ATM system, ATM fraud has recently become more widespread. Recent occurrences of ATM fraud range from techniques such as shoulder surfing and card skimming to highly advanced techniques involving fraudulent mobile alerts, and account takeover via stolen information and call centers, software tampering and/or hardware modifications to divert, or trap the dispensed currency. In this chapter, we provide a comprehensive overview of the possible fraudulent activities that may be perpetrated against ATMs and investigates recommended approaches to prevent or deter these types of frauds. In particular we develop a model for the utilization of biometrics equipped ATM to provide security solution against must of the well-known breaches associated with the current ATM system practice. INTRODUCTION An automated teller machine (also known as Cash Machine), is a computerized device that provides the customers of a financial institution with the DOI: / ch013 ability to perform financial transactions without the need for a human clerk or bank teller. Most modern ATMs identify the customer by the plastic card that the customer inserts into the ATM. The plastic card can contain a magnetic stripe or a chip that contains a unique card number and some security information, such as an expiration date Copyright 2011, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited.

2 and card validation code (CVC). When using an ATM, customers can access their bank accounts in order to make cash withdrawals (or credit card cash advances) and can check their account balances as well as purchasing mobile phone prepaid credit, paying bills and so on. ATM, was first introduced in 1960 by City Bank of New York on a trial basis, the concept of this machine was for customers to pay utility bills and get a receipt without a teller (NetWorld Alliance, 2003). It allows financial institutions to provide their customers with a convenient way, round the clock, to carry out varying transactions which included withdrawal of funds, made deposits, check account balance, and later on included features to allow customers pay bills, etc. There was no need for a cashier to be present or for a customer to physically visit the financial institutions premises to carry out such transactions. ATMs are not only located at banks but also increasing numbers of businesses, especially retailers for both customer convenience and a new revenue stream. Similarly this will reduce the cost of transactions as transactions that normally would require a bank employee s time and paperwork can be managed electronically by the customer with a card. A global ATM market forecast research conducted by Retail Banking Research Limited (RBR, 2010) shows that there are 1.8 million ATMs deployed around the world today and the figure is forecast to reach 2.5 million by In a similar research by European ATM Security Team (EAST), the total number of ATMs in Europe continues to show year on year growth as shown in the Figure 1. In addition, there are 84,500 ATMs in Russia, which are not shown in the figure. Authentication methods for ATM cards have little changed since their introduction in the 1960 s. Typically, the authentication design involves a trusted hardware device (ATM card or token). The card holder s Personal Identification Number (PIN) is usually the only means to verify the identity of the user. Further, many existing designs based on such devices use a delegation technique whereby the device acts on behalf of the user by deploying its strong cryptographic capability. Typical ATM authentication process is depicted in Figure 3. However, due to the limitations of such design, an intruder in possession of a user s device can discover the user s PIN with brute force attack. For instance, in a typical four digits PIN, one in every 10,000 users will have the same number. As ATM card becomes widely used, it produces new kinds of crime, mostly derived from the security pitfalls of the magnetic media. The data in the magnetic stripe is usually coded using two or three tracks. The standard covering this area is ISO The technique for writing to the tracks is known as F/2F. The reason is that it is not that Figure 1. Number of ATMs in Europe (excluding Russia) from

3 Figure 2. ATM authentication process difficult and/or expensive to have the equipment to encode magnetic stripes. In fact, any type of coded badge can be decoded and duplicated if you devote enough money and talent to the task. The major encoding techniques, from the easiest to duplicate to the hardest are: Electric circuit code, Magnetic stripe code, Magnetic code, Metallic stripe code, Capacitance code, Passive electronic code, Active electronic code. The first two are very easy to duplicate; the last five are significantly more difficult. When the code data are cryptographically encoded or contain other internal checks. Counterfeiting then would require both decoding and understanding the internal check algorithm. Some sensitive applications are using two main ways of encoding; the use of a magnetic material called high-coercivity (HiCo), and the low-coercivity (LoCo) material. The HiCo material requires stronger magnetic fields to encode in it. Any card reader can read any one of these materials, since the encoding technique (F/2F) is the same. The security resides in the fact that not many encoding machines in the market can handle the HiCo material, and are definitely more expensive than those to encode LoCo material. The manufacturers of these encoders will certainly want to know why someone may be interested in purchasing such a device. A good reason for using the HiCo material is that it is better suited to avoid local disturbances on the stripe due to magnetic fields and heat. Fortunately, magnetic stripe weakness has been partly addressed by the introduction in Europe of EMV smartcards (also known as Chip and PIN cards or Chip cards) - a standard for the interoperation of smart cards and enabled POS terminals and ATM s, for authenticating credit and debit card payments. EMV specification addresses issues such as Application Independent, ICC to terminal Interface Requirements, Security & Key Management, Application Specification, Cardholder, Attendant, and Acquirer, Interface Figure 3. Percentages of ATM EMV compliance in Europe from

4 Requirements, Cardholder Verification, ICC Authentication. Details of these specifications can be found in (Diebold, 2003). The name EMV comes from the initial letters of Europay, MasterCard and VISA, the three companies which originally cooperated to develop the standard. EMV rollout in all countries in the Single Euro Payments Area (SEPA) is expected to be completed within this year (2010). Figure 3 shows the percentages of ATM EMV compliance from 2005 to Despite security measures based on EMV specification, cases of ATM crimes continue to occur globally. Incidents have been reported in Asia-Pacific, the Americas, Africa, Russia and the Middle East. Some examples include: USD 500,000 were stolen from an Australian bank using a skimming device attached to an ATM in Melbourne (atmmarketplace, 2009(a)). Devices capable of scanning bank and credit cards details were placed on cash machine outside a supermarket in UK (BBC News, 2009). Ten ATMs were used to clone cards and steal more than USD 1 million from banking accounts in Melbourne (atmmarketplace, 2009(b)). USD 500,000 were stolen from more than 250 victims in Staten Island by placing cameras directly onto the ATM keypad and filming victims typing in their PIN codes (DailyNews, 2009). On November, 2009, a coordinated attack on 130 ATM machines in 49 cities enabled cashers - low-level operatives probably recruited by higher-level criminals - to take $9m using cloned cards. The attack happened just two days before the Royal Bank of Scotland subsidiary discovered the data breach, focusing on data from its payroll and open loop giftcard business. The stolen data enabled the criminals to clone the cards. Cashers operated in cities from the US through to Russia and Asia (inforsecurity, 2009). More recently, in January 2010, a Boston area man was arrested for using cameras and skimming devices to steal over $100,000 from the account of ban customers (snopes, 2004). Similarly, the European ATM Security Team (https://www.european-atm-security.eu/) has announced the publishing of its first European Fraud Update report for According to the report, which is based on country crime updates from 19 European countries, found that ATM skimming, despite the wide launch of EMV/chip-and-PIN technology, remains a primary security issue in the European Union, with repeat attacks at single ATMs continuing to take place. ATM ATTACK TECHNIQUES ATMs are attractive to criminals because they provide direct access to currency, bank notes, and in some cases even user s personal information which can be used for identity theft. While an ATM may contain a significant amount of currency, bank cards themselves can give thieves access to customers bank accounts which can easily exceed the value of the money contained in a single ATM. In the last few years, there have been many reports of hacking into the electronic ATM system and caused billion dollars of losses in the banking company itself. Oracle attack on authentication protocols and breaches affecting the ATM machine such as cloning of cards and hacking of PIN code have been reported increasingly. The U.S. Secret Service estimate annual losses associated with credit card fraud to be in the billions of dollars. Although it is commonly called the credit card statute, this law also applies to other crimes involving access devices including debit cards, ATM cards, computer passwords, personal identification numbers, credit card or 216

5 debit card account numbers, long-distance access codes, and the Subscriber Identity Module (SIM) contained within cellular telephones that assign billing (http://www.secretservice.gov/criminal. shtml). These are increasing the need for further research in the design of ATM security systems as our modern society depends largely on electronic banking technologies. Details of some popular frauds/attacks are explained below in the following subsection. Skimming Attack This is the most popular breach in ATM transaction. In this case, criminal are taking advantage of technology to make counterfeit ATM cards by using a skimmer. Skimmers are devices used by crooks to capture data from the magnetic stripe on the back of an ATM card. These devices resemble a hand-held credit card scanner and are often fastened in close proximity to or over top of an ATM s factory-installed card reader. When removed from the ATM, a skimmer allows the download of personal data belonging to everyone who used it to swipe an ATM card. A single skimmer can retain information from than 200 ATM cards before being re-used. Example of skimmer is shown in Figure 4. Figure 4. ATM skimmer Skimming has risen substantially, and these high-tech bandits are fast gaining in their technical finesse, including buying their own ATM machines to capture your personal banking data. A report released by European ATM Security Team shows that in 2008, fraud related ATM crimes in Europe jumped 149% when compared with the previous year. According to the report, this increase in ATM fraud is linked primarily to a dramatic increase of skimming attacks as show in Figure 5. During 2008, a total of 10,302 skimming incidents were reported in Europe (see Figure 5). According to the same report, the losses due to ATM fraud were significant and a total loss of almost EUR 500 million was reported in which over 4 million was due to skimming as indicated in Figure 6. More recently, the EAST European Fraud Update report for 2010 which is based on country Figure 5. ATM related fraud attacks by number of incidents 2008 (Source EAST & EPC) 217

6 Figure 6. Losses due to ATM fraud in 2008 (Source EAST & EPC) crime updates from 19 European countries, found that ATM skimming, despite the wide launch of EMV/chip-and-PIN technology, remains a primary security issue in the European Union, with repeat attacks at single ATMs continuing to take place. Some counter measures against skimming as suggested by Diebold Incorporation are: Jittering: Process that controls and varies the speed of movement of a card as it s swiped through a card reader, making it difficult (if not impossible) to read card data by the external device. Alert systems: These systems monitor routine patterns of withdrawals and notify operators or financial institutions in the event of suspicious activity. Chip-based cards: These cards house data on microchips instead of magnetic stripes, making data more difficult to steal and cards more difficult to reproduce. Foreign object detection: ATMs equipped with this type of technology can alert owners, operators, or law enforcement in the event that a skimming device is added on the fascia of an ATM. the ATM and the fraudster tries any method to capture the customer s PIN. When the customer leaves the ATM without their card, the card is retrieved by the thieves and used to make fraudulent cash withdrawals or to make other purchases. Typically only one card is lost in each attack. The criminals have to withdraw the whole device each time a card is trapped, although recently a card trapping device has been seen that can stay in place for a period of time and that allows removal of trapped cards without the removal of the device. The most common variant is known as the Lebanese Loop (see Figure 7). Thieves place a device fitted with a loop of tape, wire, or strong thread over an ATM card reader. This allows a card to be inserted and read by the ATM, but not returned. The criminals obtain the PIN by watching the user entering the PIN (shoulder-surfing), and retrieve the card after the victim has left the ATM under the impression Figure 7. Lebanese Loop (trapping device) Card Trapping This involves placing a device directly over or into the ATM card reader slot. In this case, a card is physically captured by the trapping device inside 218

7 that the card has been retained by the ATM for other reasons. There are multiple techniques used to capture the customer s PIN including the use of video cameras, offering advice and distracting the customer while they input their PIN. Another variant of card trap is known as the Algerian V. PIN Cracking A research paper by (Bond and Zielinski 2003) shows how a complex mathematical attack can yield a PIN in an average of 15 guesses. By design, it shouldn t be possible to guess a four-digit pin in less than an average of 5,000 attempts. The attack, documented in the paper is directed against the decimalisation tables used to translate between a card PIN and the hexadecimal value of a PIN generated when the hardware security module checks the validity of a number. The attack works by simply manipulating the contents of the decimalisation table in order to gain clues (such as which digits are or are not present in the PIN). Refining the technique, which allows a PIN to determine in an average of 24 iterations, might allow an attack to succeed in 15 guesses. In practice, the risk of attack comes from a corrupt insider, perhaps in computer operations and with access to sensitive manuals who might be able to use the attack to refine what would otherwise be a brute force attempt to guess PIN numbers. In the short term, the best way to guard against the attack is to make sure it isn t possible to change the decimalisation table without permission. As a stop gap an audit trail in ATM hardware security module will also allow the banks to spot when something suspicious occurs. In a similar research conducted by (Berkman and Ostrovsky, 2006) explains how the processing system used by banks is open to abuse. One of the attacks targets the translate function in switches - an abuse functions that are used to allow customers to select their PINs online. In either case, the flaws create a means for an attacker to discover PIN codes, for example, those entered by customers while withdrawing cash from an ATM providing they have access to the online PIN verification facility or switching processes. A bank insider could use an existing Hardware Security Module (HSM) to reveal the encrypted PIN codes and exploit them to make fraudulent transactions, or to fabricate cards whose PIN codes are different than the PIN codes of the legitimate cards, and yet all of the cards will be valid at the same time. Even worse, an insider of a third-party Switching provider could attack a bank outside of his territory or even in another continent. Phishing/Vishing Attack Fraud and scams using mail communication have existed for many years. With the advent of , cell phones and the Internet this scam has quickly spread worldwide. Phishing scams are designed to entice the user to provide the card number and PIN for their bank card. Thieves will send an representing them as a bank and claiming that your account information is incomplete, or that the user needs to update their account information to prevent the account from being closed. The user is asked to click on a link and follow the directions provided. The link however is fraudulent and directs the user to a site set up by the thieves and designed to look like the user s bank. The site directs the user to input sensitive information such as card numbers and PINs. The information is collected by the thieves and used to create fraudulent cards, withdraw funds from the user s account and make purchases. In Nigeria, more traditional phishing s encouraged the receiver to register on-line for an enhanced security plan. Commercial banks in Nigeria warned consumers of such fake phishing claiming to be from the Central Bank of Nigeria (CBN) advising that ATM cards required upgrading. Example of such phishing message is shown in Figure

8 Figure 8. Phishing message Figure 8 is an example of a phishing , disguised as an official from a fictional bank. The sender is attempting to trick the recipient into revealing confidential information about his/her ATM card. Note that although the URL of the bank s webpage appears to be legitimate, it actually links to the phisher s webpage. This can be verified by pointing the mouse at the link in which the actual website will be shown (which is usually different from what is written physically). Also one can notice that after clicking the URL will be diverted to another link. In this case, the link will divert the user to the actual URL which is Figure 9. Phisher s webpage 220

9 com/data_verify.html as shown in Figure 9. This looks like the actual real bank website (http:// In 2008, the financial services industry has seen an increase in the numbers of phishing attacks that are expected to continue into 2010, including sophisticated spear phishing and Rock Phish attacks. The Anti-Phishing Working Group (http://www.antiphishing.org/) reports that the financial services sector remains the most targeted sector being attacked, with an average of more than 90 percent of attacks being directed at financial services. Traditionally, after a successful phishing attack, the criminal would extract the needed information and go onto the online account and remove the victim s bank funds. This has changed for some of the more sophisticated criminals in recent years were instead of looting the victim s account, they don t set up fake bill pay or take money directly from the account. Instead they go to the check image page, where they take a copy of the victim s check. Many financial institutions are now offering check images as part of their online banking services to their customers. The checks contain the victim s bank account number, signature, address, phone etc. These details are treasure for most criminals. They can either take the copy or make paper counterfeit checks to distribute, or take that information and create PayPal accounts or other online payment accounts that will leave the victim on the hook for any purchases. Malicious Software ATMs often now use publically available operating systems and off the shelf hardware and as a result are susceptible to being infected with viruses and other malicious software. The malicious software is injected into the ATM through network attacks, or through other infected devices. Once installed on the ATM, the malicious software will collect card information and PINs. According to a report by (Linda, 2009), some security researchers have found malware code that lets a criminal take control over ATMs. Another report by SpiderLabs (the forensics and research arm of TrustWave), found a Trojan family of malware that infected 20 ATMs in Eastern Europe. The researchers warn that the malware may be headed toward US banks and credit unions, as well as other parts of the world. The malware lets criminals take over the ATM to steal data, PINs and cash (SpiderLabs, 2009). Trustwave s performed analysis of the malicious software and found that the malware captures magnetic stripe data and PIN codes from the private memory space of transaction-processing applications installed on a compromised ATM. The compromised ATMs ran Microsoft s Windows XP operating system. The malware is designed to allow third parties to control different aspects of the machine s operation, including the gathering of sensitive data from the magnetic stripe on the card. It is also possible to use the software to force an ATM to dispense all of the cash stored in its cassette. The malware was produced by a developer serving an organized team, according to experts from the company. It codifies roles and responsibilities with different privileges, accessed using different trigger cards, with identity data designed to specify the holder s role codified on the magnetic strip. SpiderLabs analysts do not believe the malware includes networking functionality that would allow it to send harvested data to other, remote locations via the Internet. The malware does, however, allow for the output of harvested card data via the ATM s receipt printer or by writing the data to an electronic storage device (possibly using the ATM s card reader). Analysts also discovered code indicating that the malware could eject the cash dispensing cassette. What follows is a high-level summary of the key features identified during Trustwave s in depth analysis of the malware sample. It is, however, believed that this is a relatively early version of the malware and that subsequent versions may have additions functionalities. 221

10 The malicious code, which is detected as Troj/ Skimer-A, contained references to Diebold DLLs and appeared to be sending instructions that would assist in the stealing of PINs and information from cards entered into the machine. In addition, it appears that the malicious code is designed to skim money from accounts in Russian, Ukrainian and American currency. Figure 10 depicted the malicious code. The Trojan is believed to be attacking Diebold ATM machines. In view of this Diebold had contacted customers in January warning them about the urgent security threat to their systems. Diebold issued an update to its ATM software, and recommended that it be installed on all of its Windows-based ATMs globally. According to the company, the update should prevent the Skimer- A Trojan horse from successfully stealing information from cash machine users. ATM hacking Hackers use sophisticated programming techniques to break into websites which reside on a financial institution s network. Using this access, the hackers access the bank s systems to locate the ATM database. The hackers collect card numbers, and if necessary, alter the PIN for the cards they are planning to use. The hackers then sell the cards and their data to other hackers. Those hackers create ATM cards using the stolen information, and use the cards to withdraw cash from the accounts. Though hacking should really only be used to describe attacks against the internals of the ATMs software or the ATMs systems security but is also commonly used to describe attacks against card processors and other components of the transaction processing network. Many reports have shown that US have experienced a number of high profile ATM hack attacks against well known credit card and debit card processors. Some of the systems security breaches have included compromise of the PIN in addition to the card data, with subsequent fraudulent spend using cloned credit cards and cloned debit cards at ATMs. According to ATM Market Place (http://www. atmmarketplace.com/), illegal ATM software is to blame for many recent ATM hacking attacks. In spite of reports regarding more frequent hacking of ATM software, banks and financial institutions of some countries not only do not invest in ensuring safety, but tend to install illegal and non-secured software, which increases security risk even more. Physical Attack The main objective of conducting ATM physical attacks is to gain access to the cash within the ATM safe or the ATM security enclosure. Some of the most common methods include ram raids (smash and grab), explosive attacks (gas and non-gas) Figure 10. Troj/Skimer-A Malicious Code (Source Sophos Plc) 222

11 and cutting (e.g. rotary saw, blow torch, thermal lance, diamond drill). Robbery can also occur when ATMs are being replenished or serviced. Staffs are either held up as they are carrying money to or from an ATM, or when the ATM safe is open and cash cassettes replaced. Sometimes, physical attacks are attempted on the safe inside the ATM. The goal is to penetrate the ATM to open the safe door or to make an opening in the safe sufficiently large to remove the cash. ATM explosive attacks or ram raid occurs globally but are most prevalent in the US, perhaps partly due to the large number of ATMs deployed in soft-target locations such as convenience stores. Incidents about ATM physical attacks from many countries are reported in (SecurityDigest, 2010). There are a variety of mechanical and physical factors that can inhibit attacks to the safe. The certification level of the safe (UL 291 Level 1 is recommended as a minimum for ATMs placed in unsecured, unmonitored locations) Alarms and sensors that will detect physical attacks on the safe Ink stain technologies that will ruin and make unusable any removed banknotes SECURITY MEASURES As technology advances, as ATM applications become more ubiquitous, as more confidential data is transmitted over the ATM system, as more sensitive transactions are conducted, as more threats breaches are reported, the challenge of securing the system becomes more urgent. Many security services in bank transactions are dependent on authenticating users such as generation of accurate audit trails, non-repudiation in communications, preserving confidentiality (Miller, 2003), and other input validation techniques such as batch totals, format checks, reasonableness checks, and transaction validation. These features only ensure that certain procedures are followed, and cannot tell whether the person with the card and PIN is authorized to use it, they just ensure that the data transmitted follows certain guidelines or protocols that requests such as cash withdrawals are made within reasonable limits, that money is transferred to the proper account, and so forth. Therefore, it is essential to develop stronger authentication and identification measures to stop criminals from committing fraudulent act. Security measures against some of the attacks mentioned above are discussed below. Ink-Staining The rise in ram raids has spurred greater demand for solutions that help law enforcement track ATM thieves, or at least make ATM thefts unattractive. Ink-staining technology, which is triggered within an ATM s cash cassettes when the machine is jostled or moved, renders notes unusable. It s a technology that s been around a long time and has been used for years as a way to track down bank thieves, since the ink cannot really be washed off from bank notes or from the skin. A number of players provide services in this space. Wincor Nixdorf (a corporation providing retail and retail banking hardware, software, and services) offers an ink-staining module that resides within the cash cassette. If the cassette is handled incorrectly or opened by force, then the cash is sprayed. The purpose of the ink-staining technology is to cut down on ATM thefts, as well as internal thefts committed by cash carriers and ATM-service providers. Global Positioning Systems In addition to ink-staining, global positioning systems, or GPS, also are gaining some ground in the ATM world. While the technology is sometimes limited, such as when an ATM is placed in a van, where the van s metal exterior blocks a satellite s ability to continue tracking the ATM s GPS device, it has allowed financial institutions 223

12 and law enforcement to recover stolen equipment, sometimes with the cash still intact. PIN Security The USA Department of Defense (DoD) Computer Security Center on password management guideline defines the probability of guessing a particular password as: P = L R/S Same idea can be used to determine the security of PINs. It can be used to determine the probability that a PIN can be guessed during its lifetime. The smaller that probability, the greater the security provided by the PIN. All else being equal, the longer the PIN, the greater the security it provides. The basic parameters that affect the length of the PIN needed to provide a given degree of security are: L = maximum lifetime that a PIN can be used to log into the system before it must be changed. P = probability that a PIN can be guessed within its lifetime, assuming continuous guesses for this period. R = guessing rate, i.e., number of guesses per unit of time that it is possible to make. S = PIN space, i.e., the total number of unique PINs that the PIN generation algorithm can generate. S is defined in turn as S=A M, where A is the number of characters in the alphabet (the set of characters that may used in a PIN), and M is the PIN length. To illustrate: If PINs consisting of 4 digits using an alphabet of 10 digits (e.g., 0-9) are to be generated: S = 10 4, that is, 10,000 unique 4-digit PINs could be generated. Likewise, to generate random 6-digit PINs from an alphabet of 10 digits: S = 10 6 =1,000,000 Now, let us assume that a PIN lifetime is from 1 month up to one year, and that a PIN can be tried at a rate of 1,000 per second (a reasonable value on many of today s architectures), one can easily compute the probabilities of guessing PINs of various lengths. As we lower our estimate of A or increase our estimate of R (to account for faster processors), these probabilities only gets worse. Manipulating our equation also gives us a procedure for determining the minimum acceptable PIN length for a given system: 1. Establish an acceptable PIN lifetime L (a typical value might be one month). 2. Establish an acceptable probability P (the probability might be no more than 1 in 1,000,000). Solve for the size of the PIN space S, using the equation derived from the previous one: S = L R/P Determine the length of the PIN, M, from the equation: M = Log S/Log A When other parameters (L and R) are not considered (i.e. setting their values to 1), it is very easy to calculate the probability as P = 1/S. Table 1 gives an idea about the PIN s security. As you can see, the longer your PIN is the harder it would be to guess. EMPLOYING BIOMETRICS: PROPOSED DESIGN Biometric identification is utilized to verify a person s identity by measuring digitally certain human characteristics and comparing those measurements with those that have been stored in a 224

13 Table 1. Probability of Guessing a PIN based on the number of characters Used Characters In PIN Probability of Guessing the PIN 1 1 in in in 1, in 10, in 100, in 1,000, in 10,000, in 100,000,000 template for that same person. Templates can be stored at the biometric device, the institution s database, a user s smart card, or a Trusted Third Party (TTP) Service Provider s database. Where database storage is more economic than plastic cards, the method tends to lack public acceptance. However, (Polemi, 1997) found that TTPs can provide the confidence that this method is missing by managing the templates in a trustful way. There are two major categories of biometric techniques: physiological (fingerprint verification, iris analysis, hand geometry-vein patterns, ear recognition, odor detection, DNA pattern analysis and sweat pores analysis), and behavioral (handwritten signature verification, keystroke analysis and speech analysis). (Deane et al. 1995) found that behavior based systems were perceived as less acceptable than those based on physiological characteristics. Of the physiological techniques, the most commonly utilized is that of fingerprint scanning. In developing countries such as Nigeria, ATM fraud seem to be committed by mostly individuals linked to bank officers who are able to provide pin numbers and other relevant information required to commit such crimes. With biometrics, such fraudulent incidents can be minimized, as an added layer of authentication is now introduced that ensures that even with the correct pin information and in possession of another person s ATM card, a fraudster will not be able to withdraw any money since the biometric features of every individual is unique. The advantages of this may include: all attributes of the ATM cards will be maintained, counterfeiting attempts are reduced due to enrolment process that verifies identity and captures biometrics, and it will be extremely high secure and excellent user-to-card authentication. However, memory limitation in current cards may jeopardize this approach. Table 2 gives the required bytes for various biometrics. Additional information about biometric technology and standards can be found from the following organizations: The Biometric Consortium (www.biometrics.org), International Biometric Industry Association (www.ibia.org), or BioAPI Consortium (www.bioapi.com). In general, the primary advantage of biometric authentication methods over other methods is that they use real human physiological or behavioral characteristics to authenticate users. These biometric characteristics are permanent and thus cannot easily be changed, lost, faked or forgotten. These advantages are for the benefit of users as well as system administrators because the problems and costs associated with lost, reissued or temporarily issued can be avoided, thus saving some costs of the system management. On the other hand, the major risk posed by the use of biometric systems in an authentication process is that a malicious subject may interfere with the communication and intercept 225

14 Table 2. Required Bytes for Biometrics Biometric Bytes Required Finger scan Finger geometry 14 Hand geometry 9 Iris recognition 512 Voice verification 1500 Face recognition Signature verification Retina recognition 96 the biometric template and use it later to obtain access (Luca et al, 2002). Likewise, an attack may be committed by generating a template from a fingerprint obtained from some surface. Further, performance of biometric systems is not ideal, as there is a trade-off between FAR (False Acceptance Rate) and FRR (False Rejection Rate), and 100% FAR/FRR is absolutely impossible. Two neutral reports on the test of some biometrics products are (Tony et al. (2001); Steven (2002)). As a negative sound, ACLU (American Civil Liberties Union) has also reported poor performance of face-recognition technology in practice (Jay & Barry, 2002). Although few biometric systems are fast and accurate (in terms of low false acceptance rate) enough to allow identification (automatically recognizing the user identity), most of current systems are suitable for the verification only, as the false acceptance rate is too high. Our end to end ATM system simulation program will be taking a smart card, a maximum of 8 characters, numbers or mix of the both PIN and fingerprint as verification factors of the authentication process. The smart cards we used in the simulation program are the ACOS smart card; the PIN created by the user will be stored inside cards. In the verification part, the users have to submit the correct PIN DES encrypted current session key to get access to the next level. Users have 3 successful attempts to enter the correct PIN, else the cards will be locked and render it to useless. Lastly, we use the fingerprint as the biometric identifiers as it is a unique identifier born with any human races. As we know, fingerprints are part of the DNA and no two humans in the whole world owns the same ones. We use fingerprint instead of other biometric elements, such as voice, because fingerprint is the most simple biometric identifier technique which takes shortest enrollment time and not affected by other factors such as illness. Other biometric identifier such as voice can be altered by many causes, illness, stress, background noise which made the identifying process troublesome (Christine, 2003). What worse is that users voice can be recorded and be modified easily using a computer. Our system integrate biometric identification into normal, traditional authentication technique use by electronic ATM machines nowadays to ensure a strong, unbreakable security and also non-repudiate transactions. In order to demonstrate the strength of our proposed authentication Figure 11. AET60 BioCARDKey 226

15 protocol using the combination of three authentication methods of card, PIN and fingerprint, we used AET60 BioCARDKey development kit manufactured by Advanced Card System Ltd as shown in the Figure 11. The proposed design involves two phases namely enrollment phase and verification phase. Each of the phases is briefly describe below. Enrollment - Prior to an individual being identified or verified by a biometric device, the enrollment process must be completed. The objective of this enrollment process is to create a profile of the user. The process consists of the following two steps: 1. Sample Capture: the user allows for a minimum of two or three biometric readings, for example: placing a finger in a fingerprint reader. The quality of the samples, together with the number of samples taken, will influence the level of accuracy at the time of validation. Not all samples are stored; the technology analyzes and measures various data points unique to each individual. The number of measured data points varies in accordance to the type of device. 2. Conversion and Encryption: the individual s measurements and data points are converted to a mathematical algorithm and encrypted. These algorithms are extremely complex and cannot be reversed engineered to obtain the original image. The algorithm may then be stored as a user s template in a number of places including servers and ATM card. A new and blank ATM card has to be enrolled with user details before it can be verified later. Enrollment system is usually operated by the admin to enter their customer details into the card. However, exception applies to the PIN entry where it should be entered by the user themselves and need to enter the PIN again to make sure they enter the correct ones. Identification and Verification - Once the individual has been enrolled in a system, he/she can start to use biometric technology to have access to his account via the ATM machine or related system to authorize transactions. Figure 12. Flowchart for the enrollment process 227

16 Figure 13. Implementation design for the enrollment process 1. Identification: a one-to-many match. The user provides a biometric sample and the system looks at all user templates in the database. If there is a match, the user is granted access, otherwise, it is declined. 2. Verification: a one-to-one match requiring the user provides identification such as a PIN and valid ATM card in addition to the biometric sample. In other words, the user is establishing who he/she is and the system simply verifies if this is correct. The biometric sample with the provided identification is compared to the previously stored information in the database. If there Figure 14. Flowchart for the verification process 228

17 is a match, access is provided, otherwise, it is declined. After the card has been enrolled with user data, this particular card will be the user s ID. The PIN and fingerprint sample from the user were also encrypted and save into the card. In order to get access into the ATM machine, the user has to present the card to the card reader, and then verify the PIN and lastly matched their fingerprint detail with the card. In this particular system, the ATM interface is quite a simple one just showing the simple debit and credit function, what we tried to emphasis in our project is the complex verification part which includes the MAC and PIN encryption. ADVANTAGES AND DISADVANTAGES OF THE PROPOSED SYSTEM As with any other technology, biometrics has its own advantages and disadvantages. The best reason why biometrics is getting more popular and widely implemented is a convenience of having authenticating mechanisms with a user. We can t forget parts of our body at home, and we can t lend it. We don t need to memorize fingerprints and then change it every 3 months as with passwords. Biometrics can last virtually forever, until something is amputated or damaged. More details can be found in literatures (Kim et. al., (2003); Lin and Lai (2004); Yoon and Yoo 2005)) On the opposite side, there is a factor of users accepting or not accepting a particular biometric technique. Some people are still hesitant to be authenticated using fingerprints, since it was associated for a long time with criminals and prisons. However, most people accept voice recognition. Retina and iris recognitions trouble some people due to the exposure to the light, which they consider to be harmful for the eyes etc. Further, a problem common to all biometric systems including fingerprint is that unauthorized use of biometric information is very easy (Bolle et. al. 2002). For example, a fingerprint can be acquired from objects touched by the person. Originally, fingerprint personal authentication was put to practical use on the precondition of a close range or face-to-face interface. Therefore, protecting the privacy of fingerprint information has not been given sufficient consideration. Some of the advantages and disadvantages of the all Figure 15. Implementation design for the verification process 229

18 Table 3. Comparison between ATM Card and Biometrics Technology Advantages: Disadvantages: ATM Card Biometrics Biometric ATM Two-factor authentication. Physically secure Support multiple applications and Cryptographic capabilities. Ensures user s privacy. Easy to use and wider acceptance by the public due to portability On board processing capabilities. Inexpensive and convenience Harder to impersonate. Not transferable/shareable. Easy and faster to use. Cannot be lost High security. Roaming; with its owner at all times Strongest authentication with high accuracy rate. High degree of non-repudiation. Blocks guessing, theft, cloning, lost, or forgotten, problems etc Additional layer of security: three-factor authentication. Must be with the user. Easily lost or stolen. Split-in-trust. PIN guessing and brute force attacks Fail To Enroll (FTR) rate Some methods are not applicable to some individuals. Privacy, anonymity, and users acceptance issues. Not very reliable due to FAR/FRR. Increases system s cost. Lack of standardize Lack of standardization Some methods cannot be implemented due to card memory limitations. Can inherit some of threats associated with biometrics and or card. Time consuming for the customers. three well-known authentication mechanisms are given in Table 3 CONCLUSION Automatic Teller Machines have become a mature technology which provides financial services to an increasing segment of the population in many countries. Biometrics, and in particular fingerprint scanning, continues to gain acceptance as a reliable form of securing access through identification and verification processes. This chapter identifies a high-level model for the modification of existing ATM systems to economically incorporate fingerprint scanning; and, outlines the advantages of using such system. As Biometrics technology is becoming cheaper both in its application and usage, financial institutions need to invest in this technology as a way of securing transactions and gaining customers confidence as well as satisfaction. In addition to fingerprints, other biometric ATM technologies are emerging; Fujitsu provides a highly reliable biometric authentication system based on palm vein pattern recognition technology. Already deployed at leading financial institutions in Asia, the Fujitsu palm vein device has added a new level of security for employees and customers. The results have an extremely high degree of accuracy with a false acceptance rate of less than %, while maintaining a false rejection rate of only 0.01%. Considering most of the ATM frauds discussed, biometrics will certainly be a chosen security measure. There is certainly no silver bullet method or technology advocated that will guarantee a 100% eradication of ATM fraud completely (there never is), since the emergence of new technology everywhere in the world is followed closely by a subverting technique or method but can certainly go a long way in minimizing it. By integrating the biometric identifiers into the current ATM system, the access will be strongly protected by three factor authentications as well as high ac- 230

19 curacy. Problems of cloning of the cards and the breaking of the PIN code will be tackled as well because hackers cannot easily sneak pass the most complex and final session of the authentication process, with is biometric identifiers. Besides, high degree of non-repudiation will also be guaranteed as the owners cannot deny their DNA themselves. ACKNOWLEDGMENT The author wishes to acknowledge King Fahd University of Petroleum and Minerals (KFUPM) Saudi Arabia and Hafr Al-Batin Community College for their support in providing the various facilities utilized in the process of producing this chapter and the book in general. This work was supported by the Deanship of Scientific Research (DSR) program of King Fahd University of Petroleum and Minerals (KFUPM), under Project Number: # IN REFERENCES ATM Market Place. (2009a). ATM scam nets Melbourne thieves $ 500,000. Retrieved December 2, 2009, from article.php?id=10808 ATM Market Place. (2009b). Australian police suspect Romanian gang behind $ 1 million ATM scam. Retrieved November 13, 2009, from /article.php?id=10883 Berkman, O., & Ostrovsky, O. M. (2006). The unbearable lightness of PIN cracking. Retrieved May 3, 2009, from Documents/ The_Unbearable_Lightness_ of_ PIN_Cracking.pdf Bolle, R., Connell, J., & Ratha, N. (2002). Biometric Perils and Patches. Pattern Recognition, 35, doi: /s (01) Bond, M., & Zielinski, P. (2003). Decimalisation table attacks for PIN Cracking. Retrieved December 9, 2006, from techreports/ucam-cl-tr-560.pdf DailyNews. (2009). ATMs on Staten Island rigged for identity theft; bandits steal $500G. Retrieved September 9, 2009, from com/news /ny_crime/2009/05/11/ _ automated_theft_bandits_steal_ 500g_by_ rigging_atms_with_pinreading_gizmos. html#ixzz0j8qbvdar&d Deane, F., Barrelle, K., Henderson, R., & Mahar, D. (1995). Perceived acceptability of biometric security systems. Computers & Security, 14(3), doi: / (95)00005-s Diebold. (2003). EMV White Paper. Retrieved April 11, 2010, from solutions/a tms/opteva/emv.pdf EMV. (2004). Integrated circuit card specifications for payment systems. Retrieved January 14, 2010, from https://partnernetwork.visa.com/ vpn/global /category.do?userregion=1&catego ryid=61&documentid=94 Gershon, C. (2003). Biometrics Authentication & Smart Cards. GSA/FTS Network Service Conference, Managing the Future: Mastering the Maze. Retrieved December 9, 2009, from fts.gsa.gov/2003_ network_conference/ 5-1_biometric_smartcards/ Inforsecurity. (2009). $9m lifted in RBS Worldpay ATM heist. Retrieved April 16, 2010, from view/524/9m-lifted-i n-rbs-worldpay-atm-heist Jay, S., & Barry, S. (2002). Drawing a blank: The failure of facial recognition technology in Tampa, Florida. An ACLU Special Report, Jan Retrieved October, 9, 2009, from org/issues/ privacy/d rawing_blank.pdf 231

20 Kim, H. S., Lee, J. K., & Yoo, K. Y. (2003). ID-based password authentication scheme using smart cards and fingerprints. ACM SIGOPS Operating Syst. Rev., 37(4), doi: / Lin, C. H., & Lai, Y. Y. (2004). A flexible biometrics remote user authentication scheme. Computer Standards & Interfaces, 27(1), doi: /j.csi Luca, B., Bistarelli, S., & Vaccarelli, A. (2002). Biometrics authentication with smartcard, IIT TR-08/2002, Retrieved October, 9, 2009, from parametri biomedici.html McGlasson, L. (2009). ATM Fraud: 7 Growing Threats to Financial Institutions. Retrieved April 2, 2010, from articles. php?art_id=1523&opg=1 NetWorld Alliance. (2003). Timeline: The ATM s history. Retrieved June, , from News/Timeline%20-%20The%20ATM%20History.aspx News, B. B. C. (2009). Shoppers are targeted in ATM scam. Retrieved July 11, 2009, from _news/england/ tees/ stm Polemi, D. (1997). Biometric Techniques: Review and evaluation of biometric techniques for identification and authentication, INFOSEC. Institute of Communications and Computer Systems, National Technical University of Athens. RBR. (2010). Global ATM Market and Forecasts to Retrieved May 7, 2010, from www. rbrlondon.com SecurityDigest. (2010). ATM Fraud and Security Digest News. Retrieved April 7, 2010, from www. atmsecurity.com/monthly-digest March 2010 Snopes. (2004). Thieves Equip ATMs with Duplicate Card Reader and Wireless Camera. Retrieved April 20, 2010, from fraud/ atm/atmcamera.asp SpiderLabs. (2009). ATM Malware Analysis Briefing. Retrieved May 15, 2010, from https://www. trustwave.com/ spiderlabs-papers.php Steven, K. (2002). Testing iris and face recognition in a personnel identification application. In The Biometric Consortium Conference, February Retrieved October, 21, 2009, from s/bc/bc2001/fi- NAL_BCFEB02/FINAL_1 _Final%20Steve%20 King.pdf Tony, M., Gavin, K., David, C., & Jan, K. (2001). Biometric product testing final report. Issue 1.0, CESG/BWG Biometric Test Programme. Retrieved August , from gov.uk/technology/ biometrics/media/biometric% 20Test%20Report%20pt1.pdf VISA. (2004). Guidelines for PIN Security Requirement: Version 2.0. Retrieved March 6, 2010, from PCI PIN Security Requirements.pdf Yoon, E. J., & Yoo, K. Y. (2005). A new efficient fingerprint-based remote user authentication scheme for multimedia systems, in 9th Int. Conf. Knowledge-Based & Intelligent Information & Engineering Systems (KES 2005), 2005, (pp ), Paper LNAI KEY TERMS AND DEFINITIONS ATM: A computerized device that provides the customers of a financial institution with the ability to perform financial transactions. Biometrics: Techniques for identifying or verifying people based on their physiological or behavioral characteristics. 232

Use of biometrics to tackle ATM fraud

Use of biometrics to tackle ATM fraud 2010 International Conference on Business and Economics Research vol.1 (2011) (2011) IACSIT Press, Kuala Lumpur, Malaysia Use of biometrics to tackle ATM fraud Lawan Ahmed Mohammed King Fahd University

More information

ATM FRAUD AND COUNTER MEASURES

ATM FRAUD AND COUNTER MEASURES ATM FRAUD AND COUNTER MEASURES GENESIS OF ATMs An automated teller machine was first introduced in 1960 by City Bank of New York on a trial basis. The concept of this machine was for customers to pay utility

More information

The Merchant. Skimming is No Laughing Matter. A hand held skimming device. These devices can easily be purchased online.

The Merchant. Skimming is No Laughing Matter. A hand held skimming device. These devices can easily be purchased online. 1 February 2010 Volume 2, Issue 1 The Merchant Serving Florida State University s Payment Card Community Individual Highlights: Skimming Scam 1 Skimming at Work 2 Safe at Home 3 Read your Statement 4 Useful

More information

FRAUD ALERT THESE SCAMS CAN COST YOU MONEY

FRAUD ALERT THESE SCAMS CAN COST YOU MONEY FRAUD ALERT THESE SCAMS CAN COST YOU MONEY Phishing spear phishing vishing smishing debit card skimming fake check scams THE COMMON SENSE PRECAUTIONS INSIDE CAN KEEP YOU SAFE! SCHEMES SCAMS FRAUDS Criminals

More information

Digital Identity & Authentication Directions Biometric Applications Who is doing what? Academia, Industry, Government

Digital Identity & Authentication Directions Biometric Applications Who is doing what? Academia, Industry, Government Digital Identity & Authentication Directions Biometric Applications Who is doing what? Academia, Industry, Government Briefing W. Frisch 1 Outline Digital Identity Management Identity Theft Management

More information

W.A.R.N. Passive Biometric ID Card Solution

W.A.R.N. Passive Biometric ID Card Solution W.A.R.N. Passive Biometric ID Card Solution Updated November, 2007 Biometric technology has advanced so quickly in the last decade that questions and facts about its cost, use, and accuracy are often confused

More information

Visa CREDIT Card General Guidelines

Visa CREDIT Card General Guidelines Visa CREDIT Card General Guidelines General Account Information Phone Numbers and Addresses It is very important to keep us up-to-date with your correct address and phone number. Card reissues/replacements

More information

Towards Enhancing the Security Features of Automated Teller Machines (ATMs): A Ghanaian Perspective

Towards Enhancing the Security Features of Automated Teller Machines (ATMs): A Ghanaian Perspective Towards Enhancing the Security Features of Automated Teller Machines (ATMs): A Ghanaian Perspective Nana Kwame Gyamfi Department of Computer Science Faculty of Science, Kumasi Polytechnic, Kumasi, Ghana

More information

Guide to credit card security

Guide to credit card security Contents Click on a title below to jump straight to that section. What is credit card fraud? Types of credit card fraud Current scams Keeping your card and card details safe Banking and shopping securely

More information

Why Data Security is Critical to Your Brand

Why Data Security is Critical to Your Brand Why Data Security is Critical to Your Brand Why security is critical to your brand Cybercriminals do not discriminate based on industry or business size. Security is expensive. At least, it is if you wait

More information

ENHANCING ATM SECURITY USING FINGERPRINT AND GSM TECHNOLOGY

ENHANCING ATM SECURITY USING FINGERPRINT AND GSM TECHNOLOGY Available Online at www.ijcsmc.com International Journal of Computer Science and Mobile Computing A Monthly Journal of Computer Science and Information Technology IJCSMC, Vol. 3, Issue. 4, April 2014,

More information

May 2010. For other information please contact:

May 2010. For other information please contact: access control biometrics user guide May 2010 For other information please contact: British Security Industry Association t: 0845 389 3889 f: 0845 389 0761 e: info@bsia.co.uk www.bsia.co.uk Form No. 181.

More information

Target Security Breach

Target Security Breach Target Security Breach Lessons Learned for Retailers and Consumers 2014 Pointe Solutions, Inc. PO Box 41, Exton, PA 19341 USA +1 610 524 1230 Background In the aftermath of the Target breach that affected

More information

CONNECTICUT IDENTITY THEFT RANKING BY STATE: Rank 19, 68.8 Complaints Per 100,000 Population, 2409 Complaints (2007) Updated November 28, 2008

CONNECTICUT IDENTITY THEFT RANKING BY STATE: Rank 19, 68.8 Complaints Per 100,000 Population, 2409 Complaints (2007) Updated November 28, 2008 CONNECTICUT IDENTITY THEFT RANKING BY STATE: Rank 19, 68.8 Complaints Per 100,000 Population, 2409 Complaints (2007) Updated November 28, 2008 Current Laws: A person commits identity theft when he intentionally

More information

Identity Theft: An Introduction to the Scope of the Crime, and Its Prevention, Detection and Remediation

Identity Theft: An Introduction to the Scope of the Crime, and Its Prevention, Detection and Remediation Identity Theft: An Introduction to the Scope of the Crime, and Its Prevention, Detection and Remediation June 2009 Cairo, Egypt Joanna P. Crane Identity Theft Program Manager Senior Attorney The views

More information

Policy for Protecting Customer Data

Policy for Protecting Customer Data Policy for Protecting Customer Data Store Name Store Owner/Manager Protecting our customer and employee information is very important to our store image and on-going business. We believe all of our employees

More information

ATM Fraud and Security

ATM Fraud and Security WHITE PAPER ATM Fraud and Security Minimizing loss, mitigating risk and maintaining consumer confidence in the ATM channel Since the introduction of the first automated teller machine (ATM) in 1967, perpetrators

More information

PCI and EMV Compliance Checkup

PCI and EMV Compliance Checkup PCI and EMV Compliance Checkup ATM Security Jim Pettitt Director, ATM Security Diebold Incorporated Agenda ATM threats today Top of mind risk PCI Impact on Security U.S. EMV Migration Conclusions / recommendations

More information

Smart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi

Smart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi Smart Card- An Alternative to Password Authentication By Ahmad Ismadi Yazid B. Sukaimi Purpose This paper is intended to describe the benefits of smart card implementation and it combination with Public

More information

EMV and Small Merchants:

EMV and Small Merchants: September 2014 EMV and Small Merchants: What you need to know Mike English Executive Director, Product Development Heartland Payment Systems 2014 Heartland Payment Systems, Inc. All trademarks, service

More information

THE FIVE Ws OF EMV BY DAVE EWALD GLOBAL EMV CONSULTANT AND MANAGER DATACARD GROUP

THE FIVE Ws OF EMV BY DAVE EWALD GLOBAL EMV CONSULTANT AND MANAGER DATACARD GROUP THE FIVE Ws OF EMV BY DAVE EWALD GLOBAL EMV CONSULTANT AND MANAGER DATACARD GROUP WHERE IS THE U.S. PAYMENT CARD INDUSTRY NOW? WHERE IS IT GOING? Today, payment and identification cards of all types (credit

More information

Remote Deposit Quick Start Guide

Remote Deposit Quick Start Guide Treasury Management Fraud Prevention How to Protect Your Business Remote Deposit Quick Start Guide What s Inside We re committed to the safety of your company s financial information. We want to make you

More information

IDRBT Working Paper No. 11 Authentication factors for Internet banking

IDRBT Working Paper No. 11 Authentication factors for Internet banking IDRBT Working Paper No. 11 Authentication factors for Internet banking M V N K Prasad and S Ganesh Kumar ABSTRACT The all pervasive and continued growth being provided by technology coupled with the increased

More information

A Study of an On-Line Credit Card Payment Processing and Fraud Prevention for e-business

A Study of an On-Line Credit Card Payment Processing and Fraud Prevention for e-business A Study of an On-Line Credit Card Payment Processing and Fraud Prevention for e-business Nucharee Premchaiswadi*, James G. Williams** and Wichian Premchaiswadi*** *Faculty of Information Technology Dhurakij

More information

10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)

10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft) 1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction

More information

Biometrics in Physical Access Control Issues, Status and Trends White Paper

Biometrics in Physical Access Control Issues, Status and Trends White Paper Biometrics in Physical Access Control Issues, Status and Trends White Paper Authored and Presented by: Bill Spence, Recognition Systems, Inc. SIA Biometrics Industry Group Vice-Chair & SIA Biometrics Industry

More information

Payment Fraud and Risk Management

Payment Fraud and Risk Management Payment Fraud and Risk Management Act Today! 1. Help protect your computer against viruses and spyware by using anti-virus and anti-spyware software and automatic updates. Scan your computer regularly

More information

WISCONSIN IDENTITY THEFT RANKING BY STATE: Rank 15, 175.9 Complaints Per 100,000 Population, 9852 Complaints (2007) Updated January 16, 2009

WISCONSIN IDENTITY THEFT RANKING BY STATE: Rank 15, 175.9 Complaints Per 100,000 Population, 9852 Complaints (2007) Updated January 16, 2009 WISCONSIN IDENTITY THEFT RANKING BY STATE: Rank 15, 175.9 Complaints Per 100,000 Population, 9852 Complaints (2007) Updated January 16, 2009 Current Laws: It is unlawful to intentionally use or attempt

More information

AUSTRALIAN PAYMENTS FRAUD DETAILS AND DATA

AUSTRALIAN PAYMENTS FRAUD DETAILS AND DATA Australian Payments Clearing Association AUSTRALIAN PAYMENTS FRAUD DETAILS AND DATA 214 Australian Payments Clearing Association Limited ABN 12 55 136 519 CONTENTS OVERVIEW 1 SECTION 1 Fraud rates 4 SECTION

More information

OpenEdge Research & Development Group April 2015

OpenEdge Research & Development Group April 2015 2015: Security, Merchant Readiness & the Coming Liability Shift OpenEdge Research & Development Group April 2015 solutions@openedgepay.com openedgepay.com 2015: Security, Merchant Table of Contents The

More information

Application-Specific Biometric Templates

Application-Specific Biometric Templates Application-Specific Biometric s Michael Braithwaite, Ulf Cahn von Seelen, James Cambier, John Daugman, Randy Glass, Russ Moore, Ian Scott, Iridian Technologies Inc. Introduction Biometric technologies

More information

Deception scams drive increase in financial fraud

Deception scams drive increase in financial fraud ADDRESS 2 Thomas More Square London E1W 1YN WEBSITE www.financialfraudaction.org.uk DIRECT LINE 020 3217 8436 NEWS RELEASE EMAIL press@ukcards-ffauk.org.uk Deception scams drive increase in financial fraud

More information

Enhancing Payment Card Security New Measures to be Phased in from 2 nd Quarter 2010 to 1 st Quarter 2011

Enhancing Payment Card Security New Measures to be Phased in from 2 nd Quarter 2010 to 1 st Quarter 2011 Enhancing Payment Card Security New Measures to be Phased in from 2 nd Quarter 2010 to 1 st Quarter 2011 On 5 th March 2010, The Association of Banks in Singapore announced key measures to adopt a holistic

More information

Framework for Biometric Enabled Unified Core Banking

Framework for Biometric Enabled Unified Core Banking Proc. of Int. Conf. on Advances in Computer Science and Application Framework for Biometric Enabled Unified Core Banking Manohar M, R Dinesh and Prabhanjan S Research Candidate, Research Supervisor, Faculty

More information

Card Acceptance Best Practices Playing it Safe at the Point of Sale

Card Acceptance Best Practices Playing it Safe at the Point of Sale White Paper Card Acceptance Best Practices Playing it Safe at the Point of Sale Fraudulent activity costs U.S. businesses billions. And that is just lost revenue. When you consider the associated damage

More information

Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008

Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication

More information

Protecting the POS Answers to Your Frequently Asked Questions

Protecting the POS Answers to Your Frequently Asked Questions Protecting the POS Answers to Your Frequently Asked Questions PROTECTING THE POS What is skimming? Skimming is the transfer of electronic data from one magnetic stripe to another for fraudulent purposes.

More information

Payment Card Industry (PCI) Policy Manual. Network and Computer Services

Payment Card Industry (PCI) Policy Manual. Network and Computer Services Payment Card Industry (PCI) Policy Manual Network and Computer Services Forward This policy manual outlines acceptable use Black Hills State University (BHSU) or University herein, Information Technology

More information

Don t Fall Victim to Cybercrime:

Don t Fall Victim to Cybercrime: Don t Fall Victim to Cybercrime: Best Practices to Safeguard Your Business Agenda Cybercrime Overview Corporate Account Takeover Computer Hacking, Phishing, Malware Breach Statistics Internet Security

More information

EMV and Restaurants: What you need to know. Mike English. October 2014. Executive Director, Product Development Heartland Payment Systems

EMV and Restaurants: What you need to know. Mike English. October 2014. Executive Director, Product Development Heartland Payment Systems October 2014 EMV and Restaurants: What you need to know Mike English Executive Director, Product Development Heartland Payment Systems 2014 Heartland Payment Systems, Inc. All trademarks, service marks

More information

Opinion and recommendations on challenges raised by biometric developments

Opinion and recommendations on challenges raised by biometric developments Opinion and recommendations on challenges raised by biometric developments Position paper for the Science and Technology Committee (House of Commons) Participation to the inquiry on Current and future

More information

OVERVIEW. 1. Cyber Crime Unit organization. 2. Legal framework. 3. Identity theft modus operandi. 4. How to avoid online identity theft

OVERVIEW. 1. Cyber Crime Unit organization. 2. Legal framework. 3. Identity theft modus operandi. 4. How to avoid online identity theft OVERVIEW 2 1. Cyber Crime Unit organization 2. Legal framework 3. Identity theft modus operandi 4. How to avoid online identity theft 5. Main challenges for investigation 6. Conclusions ORGANIZATION 3

More information

PCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00

PCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00 PCI PA - DSS Point XSA Implementation Guide Atos Worldline Banksys XENTA SA Version 1.00 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page number 2 (16)

More information

Credit card: permits consumers to purchase items while deferring payment

Credit card: permits consumers to purchase items while deferring payment General Payment Systems Cash: portable, no authentication, instant purchasing power, allows for micropayments, no transaction fee for using it, anonymous But Easily stolen, no float time, can t easily

More information

With the Target breach on everyone s mind, you may find these Customer Service Q & A s helpful.

With the Target breach on everyone s mind, you may find these Customer Service Q & A s helpful. With the Target breach on everyone s mind, you may find these Customer Service Q & A s helpful. Breach Overview Q: Media reports are stating that Target experienced a data breach. Can you provide more

More information

Application of Biometric Technology Solutions to Enhance Security

Application of Biometric Technology Solutions to Enhance Security Application of Biometric Technology Solutions to Enhance Security Purpose: The purpose of this white paper is to summarize the various applications of fingerprint biometric technology to provide a higher

More information

PCI Data Security. Information Services & Cash Management. Contents

PCI Data Security. Information Services & Cash Management. Contents PCI Data Security Information Services & Cash Management This self-directed learning module contains information you are expected to know to protect yourself, our patients, and our guests. Target Audience:

More information

March 2014. Skimming Prevention Kit. For Business Owners 1

March 2014. Skimming Prevention Kit. For Business Owners 1 Skimming Prevention Kit For Business Owners 1 Contents Introduction:... 3 Debit Card Fraud:... 3 What is Debit Card Skimming?... 3 Who is Affected?... 3 Impact on Consumers... 3 Impact on Financial Institutions...

More information

MARYLAND IDENTITY THEFT RANKING BY STATE: Rank 10, 85.8 Complaints Per 100,000 Population, 4821 Complaints (2007) Updated January 29, 2009

MARYLAND IDENTITY THEFT RANKING BY STATE: Rank 10, 85.8 Complaints Per 100,000 Population, 4821 Complaints (2007) Updated January 29, 2009 MARYLAND IDENTITY THEFT RANKING BY STATE: Rank 10, 85.8 Complaints Per 100,000 Population, 4821 Complaints (2007) Updated January 29, 2009 Current Laws: A person may not knowingly, willfully, and with

More information

White Paper: Are there Payment Threats Lurking in Your Hospital?

White Paper: Are there Payment Threats Lurking in Your Hospital? White Paper: Are there Payment Threats Lurking in Your Hospital? With all the recent high profile stories about data breaches, payment security is a hot topic in healthcare today. There s been a steep

More information

Avoid completing forms in email messages that ask for personal financial information.

Avoid completing forms in email messages that ask for personal financial information. INTERNET FRAUD Online scams and viruses are constantly evolving and they threaten the security of computers worldwide. As criminals evolve their tactics, you need to keep your PC's security software (virus

More information

Smart Cards and Biometrics in Privacy-Sensitive Secure Personal Identification Systems

Smart Cards and Biometrics in Privacy-Sensitive Secure Personal Identification Systems Smart Cards and Biometrics in Privacy-Sensitive Secure Personal Identification Systems A Smart Card Alliance White Paper May 2002 Smart Card Alliance 191 Clarksville Road Princeton Junction, NJ 08550 www.smartcardalliance.org

More information

When visiting online banking's sign-on page, your browser establishes a secure session with our server.

When visiting online banking's sign-on page, your browser establishes a secure session with our server. The privacy of communications between you (your browser) and our servers is ensured via encryption. Encryption scrambles messages exchanged between your browser and our online banking server. How Encryption

More information

2. From a control perspective, the PRIMARY objective of classifying information assets is to:

2. From a control perspective, the PRIMARY objective of classifying information assets is to: MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected

More information

EMV EMV TABLE OF CONTENTS

EMV EMV TABLE OF CONTENTS 2 TABLE OF CONTENTS Intro... 2 Are You Ready?... 3 What Is?... 4 Why?... 5 What Does Mean To Your Business?... 6 Checklist... 8 3 U.S. Merchants 60% are expected to convert to -enabled devices by 2015.

More information

WHITE PAPER Usher Mobile Identity Platform

WHITE PAPER Usher Mobile Identity Platform WHITE PAPER Usher Mobile Identity Platform Security Architecture For more information, visit Usher.com info@usher.com Toll Free (US ONLY): 1 888.656.4464 Direct Dial: 703.848.8710 Table of contents Introduction

More information

ADVANCE AUTHENTICATION TECHNIQUES

ADVANCE AUTHENTICATION TECHNIQUES ADVANCE AUTHENTICATION TECHNIQUES Introduction 1. Computer systems and the information they store and process are valuable resources which need to be protected. With the current trend toward networking,

More information

Securing the Payments System. The facts about fraud prevention

Securing the Payments System. The facts about fraud prevention Securing the Payments System The facts about fraud prevention Contents Introduction 3 Visa s Security Programme 4 Fraud Types and Threats 6 Fraud Statistics and Research 7 Visa s Security Agenda for New

More information

RF-Enabled Applications and Technology: Comparing and Contrasting RFID and RF-Enabled Smart Cards

RF-Enabled Applications and Technology: Comparing and Contrasting RFID and RF-Enabled Smart Cards RF-Enabled Applications and Technology: Comparing and Contrasting RFID and RF-Enabled Smart Cards January 2007 Developed by: Smart Card Alliance Identity Council RF-Enabled Applications and Technology:

More information

SECTION: SUBJECT: PCI-DSS General Guidelines and Procedures

SECTION: SUBJECT: PCI-DSS General Guidelines and Procedures 1. Introduction 1.1. Purpose and Background 1.2. Central Coordinator Contact 1.3. Payment Card Industry Data Security Standards (PCI-DSS) High Level Overview 2. PCI-DSS Guidelines - Division of Responsibilities

More information

Frequently Asked Questions

Frequently Asked Questions PCI Compliance Frequently Asked Questions Table of Content GENERAL INFORMATION... 2 PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)...2 Are all merchants and service providers required to comply

More information

Guidance on Multi-factor Authentication

Guidance on Multi-factor Authentication Guidance on Multi-factor Authentication June 2006 Guidance on Multi-factor Authentication Guidance on Multi-factor Authentication State Services Commission June 2006 Version 1.0 ISBN 0-478-24466-5 Crown

More information

Retail/Consumer Client. Internet Banking Awareness and Education Program

Retail/Consumer Client. Internet Banking Awareness and Education Program Retail/Consumer Client Internet Banking Awareness and Education Program Table of Contents Securing Your Environment... 3 Unsolicited Client Contact... 3 Protecting Your Identity... 3 E-mail Risk... 3 Internet

More information

STRONGER ONLINE SECURITY

STRONGER ONLINE SECURITY STRONGER ONLINE SECURITY Enhanced online banking without compromise Manage your business banking efficiently and securely Internet banking has given business leaders and treasurers greater control of financial

More information

Key Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking

Key Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking Key Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking SUMMARY The Payment Card Industry Data Security Standard (PCI DSS) defines 12 high-level security requirements directed

More information

CSC 474 -- Network Security. User Authentication Basics. Authentication and Identity. What is identity? Authentication: verify a user s identity

CSC 474 -- Network Security. User Authentication Basics. Authentication and Identity. What is identity? Authentication: verify a user s identity CSC 474 -- Network Security Topic 6.2 User Authentication CSC 474 Dr. Peng Ning 1 User Authentication Basics CSC 474 Dr. Peng Ning 2 Authentication and Identity What is identity? which characteristics

More information

Preparing for EMV chip card acceptance

Preparing for EMV chip card acceptance Preparing for EMV chip card acceptance Ben Brown Vice President, Regional Sales Manager, Wells Fargo Merchant Services Lily Page Vice President, Wholesale ereceivables, Wells Fargo Merchant Services June

More information

EMERGING TRENDS IN FRAUD: CRIMINALS HAVE FOUND THE WEAKEST LINK

EMERGING TRENDS IN FRAUD: CRIMINALS HAVE FOUND THE WEAKEST LINK EMERGING TRENDS IN FRAUD: CRIMINALS HAVE FOUND THE WEAKEST LINK Fraud Investigations Division: Global Security & Investigations Ed Cook Executive Director Regional Investigations Objectives: Provide a

More information

FFIEC CONSUMER GUIDANCE

FFIEC CONSUMER GUIDANCE FFIEC CONSUMER GUIDANCE Important Facts About Your Account Authentication Online Banking & Multi-factor authentication and layered security are helping assure safe Internet transactions for banks and their

More information

Cyber - Security and Investigations. Ingrid Beierly August 18, 2008

Cyber - Security and Investigations. Ingrid Beierly August 18, 2008 Cyber - Security and Investigations Ingrid Beierly August 18, 2008 Agenda Visa Cyber - Security and Investigations Today s Targets Recent Attack Patterns Hacking Statistics (removed) Top Merchant Vulnerabilities

More information

WHITE PAPER. Let s do BI (Biometric Identification)

WHITE PAPER. Let s do BI (Biometric Identification) WHITE PAPER Let s do BI (Biometric Identification) Fingerprint authentication makes life easier by doing away with PINs, passwords and hint questions and answers. Since each fingerprint is unique to an

More information

Phishing Countermeasures

Phishing Countermeasures Fraud Investigation and Education FIS www.fisglobal.com Phishing What is it? Phishing is a technique used to gain personal information for purposes of identity theft, using fraudulent e mail messages that

More information

Voice Authentication for ATM Security

Voice Authentication for ATM Security Voice Authentication for ATM Security Rahul R. Sharma Department of Computer Engineering Fr. CRIT, Vashi Navi Mumbai, India rahulrsharma999@gmail.com Abstract: Voice authentication system captures the

More information

Here are two informational brochures that disclose ways that we protect your accounts and tips you can use to be safer online.

Here are two informational brochures that disclose ways that we protect your accounts and tips you can use to be safer online. Here are two informational brochures that disclose ways that we protect your accounts and tips you can use to be safer online. FFIEC BUSINESS ACCOUNT GUIDANCE New financial standards will assist credit

More information

Failure to follow the following procedures may subject the state to significant losses, including:

Failure to follow the following procedures may subject the state to significant losses, including: SUBJECT: Policy and Procedures PAGE: 1 of 5 INTRODUCTION During fiscal year 2014, State of Wisconsin agencies accepted approximately 6 million credit/debit card payments through the following payment channels:

More information

Online security. Defeating cybercriminals. Protecting online banking clients in a rapidly evolving online environment. The threat.

Online security. Defeating cybercriminals. Protecting online banking clients in a rapidly evolving online environment. The threat. Defeating cybercriminals Protecting online banking clients in a rapidly evolving online environment The threat As the pace of technological change accelerates, so does the resourcefulness and ingenuity

More information

NACS/PCATS WeCare Data Security Program Overview

NACS/PCATS WeCare Data Security Program Overview NACS/PCATS WeCare Data Security Program Overview March 27, 2012 Abstract This document describes the WeCare Program, discusses common data security threats, outlines an 8-point plan to improve data security,

More information

RHODE ISLAND IDENTITY THEFT RANKING BY STATE: Rank 34, 56.0 Complaints Per 100,000 Population, 592 Complaints (2007) Updated January 5, 2009

RHODE ISLAND IDENTITY THEFT RANKING BY STATE: Rank 34, 56.0 Complaints Per 100,000 Population, 592 Complaints (2007) Updated January 5, 2009 RHODE ISLAND IDENTITY THEFT RANKING BY STATE: Rank 34, 56.0 Complaints Per 100,000 Population, 592 Complaints (2007) Updated January 5, 2009 Current Laws: A person commits the crime of identity fraud if

More information

Learn to protect yourself from Identity Theft. First National Bank can help.

Learn to protect yourself from Identity Theft. First National Bank can help. Learn to protect yourself from Identity Theft. First National Bank can help. Your identity is one of the most valuable things you own. It s important to keep your identity from being stolen by someone

More information

Biometrics for payments. The use of biometrics in banking

Biometrics for payments. The use of biometrics in banking Biometrics for payments The use of biometrics in banking Biometrics for payments Biometrics for payments The use of biometrics in banking The use of biometrics for authentication is nothing new. But historically,

More information

Fraud and Identity Theft. Megan Stearns, Credit Counselor

Fraud and Identity Theft. Megan Stearns, Credit Counselor Fraud and Identity Theft Megan Stearns, Credit Counselor Agenda Fraud and identity theft statistics Fraud Identity theft Identity theft prevention Protecting your Social Security Number Online prevention

More information

National Cyber Security Month 2015: Daily Security Awareness Tips

National Cyber Security Month 2015: Daily Security Awareness Tips National Cyber Security Month 2015: Daily Security Awareness Tips October 1 New Threats Are Constantly Being Developed. Protect Your Home Computer and Personal Devices by Automatically Installing OS Updates.

More information

PCI PA - DSS. Point ipos Implementation Guide. Version 1.01. VeriFone Vx820 using the Point ipos Payment Core

PCI PA - DSS. Point ipos Implementation Guide. Version 1.01. VeriFone Vx820 using the Point ipos Payment Core PCI PA - DSS Point ipos Implementation Guide VeriFone Vx820 using the Point ipos Payment Core Version 1.01 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page

More information

Tahoe Tech Group serves as your technology partner with a focus on providing cost effective and long term solutions.

Tahoe Tech Group serves as your technology partner with a focus on providing cost effective and long term solutions. Tahoe Tech Group LLC Cyber Security Briefing Truckee Donner Chamber of Commerce March 6, 2015 Tahoe Tech Group serves as your technology partner with a focus on providing cost effective and long term solutions.

More information

Driving License. National Insurance Number

Driving License. National Insurance Number STAR has teamed up with Prevention of Fraud in Travel (PROFiT) and the Fraud Intelligence Network (FIN) to offer our members the best advice about fraud prevention. We recognise the increasing threat of

More information

SAFE SYSTEM: SECURE APPLICATIONS FOR FINANCIAL ENVIRONMENTS USING MOBILE PHONES

SAFE SYSTEM: SECURE APPLICATIONS FOR FINANCIAL ENVIRONMENTS USING MOBILE PHONES SAFE SYSTEM: SECURE APPLICATIONS FOR FINANCIAL ENVIRONMENTS USING MOBILE PHONES Sead Muftic 1, Feng Zhang 1 1Department of Computer and System Sciences, Royal Institute of Technology, Stockholm, Sweden

More information

FLIP IDENTITY THEFT. (Financial Literacy in Practice) February 2015 OVERVIEW TEACHER NOTES TEACHER NOTES

FLIP IDENTITY THEFT. (Financial Literacy in Practice) February 2015 OVERVIEW TEACHER NOTES TEACHER NOTES FLIP (Financial Literacy in Practice) February 2015 IDENTITY THEFT OVERVIEW This resource complements the material in Operation Financial Literacy. It has been written to address current issues which specifically

More information

Physical Security: A Biometric Approach Preeti, Rajni M.Tech (Network Security),BPSMV preetytushir@gmail.com, ratri451@gmail.com

Physical Security: A Biometric Approach Preeti, Rajni M.Tech (Network Security),BPSMV preetytushir@gmail.com, ratri451@gmail.com www.ijecs.in International Journal Of Engineering And Computer Science ISSN:2319-7242 Volume 3 Issue 2 February, 2014 Page No. 3864-3868 Abstract: Physical Security: A Approach Preeti, Rajni M.Tech (Network

More information

toast EMV in 2015: How Restaurants Can Prepare for the New Chip-and-Pin Standard

toast EMV in 2015: How Restaurants Can Prepare for the New Chip-and-Pin Standard toast EMV in 2015: How Restaurants Can Prepare for the New Chip-and-Pin Standard Table of Contents For more than 40 years, merchants and consumers have used magnetic stripe credit cards and compatible

More information

OCT Training & Technology Solutions Training@qc.cuny.edu (718) 997-4875

OCT Training & Technology Solutions Training@qc.cuny.edu (718) 997-4875 OCT Training & Technology Solutions Training@qc.cuny.edu (718) 997-4875 Understanding Information Security Information Security Information security refers to safeguarding information from misuse and theft,

More information

SCHEMES SCAMS FRAUDS

SCHEMES SCAMS FRAUDS FRAUD ALERT! FRAUD ALERT! GUARDING AGAINST INTERNET & MOBILE FRAUD SCHEMES SCAMS FRAUDS & THESE SCAMS CAN COST YOU MONEY: Phishing spear phishing vishing smishing debit card skimming fake check scams THE

More information

OIG Fraud Alert Phishing

OIG Fraud Alert Phishing U.S. EQUAL EMPLOYMENT OPPORTUNITY COMMISSION Washington, D.C. 20507 Office of Inspector General Aletha L. Brown Inspector General July 22, 2005 OIG Fraud Alert Phishing What is Phishing? Phishing is a

More information

The 4 forces that generate authentication revenue for the channel

The 4 forces that generate authentication revenue for the channel The 4 forces that generate authentication revenue for the channel Web access and the increasing availability of high speed broadband has expanded the potential market and reach for many organisations and

More information

Spotting ID Theft Red Flags A Guide for FACTA Compliance. An IDology, Inc. Whitepaper

Spotting ID Theft Red Flags A Guide for FACTA Compliance. An IDology, Inc. Whitepaper Spotting ID Theft Red Flags A Guide for FACTA Compliance An IDology, Inc. Whitepaper With a November 1 st deadline looming for financial companies and creditors to comply with Sections 114 and 315 of the

More information

Chapter 11 Manage Computing Securely, Safely and Ethically. Discovering Computers 2012. Your Interactive Guide to the Digital World

Chapter 11 Manage Computing Securely, Safely and Ethically. Discovering Computers 2012. Your Interactive Guide to the Digital World Chapter 11 Manage Computing Securely, Safely and Ethically Discovering Computers 2012 Your Interactive Guide to the Digital World Objectives Overview Define the term, computer security risks, and briefly

More information

CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013

CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013 CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists

More information

INDUSTRY OVERVIEW: RETAIL

INDUSTRY OVERVIEW: RETAIL ii IBM MSS INDUSTRY OVERVIEW: RETAIL RESEARCH AND INTELLIGENCE REPORT RELEASE DATE: JANUARY 5, 215 BY: DAVID MCMILLEN, SENIOR THREAT RESEARCHER Copyright IBM Corporation 214. All rights reserved. IBM and

More information

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 10 Authentication and Account Management

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 10 Authentication and Account Management Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 10 Authentication and Account Management Objectives Describe the three types of authentication credentials Explain what single sign-on

More information

This method looks at the patterns found on a fingertip. Patterns are made by the lines on the tip of the finger.

This method looks at the patterns found on a fingertip. Patterns are made by the lines on the tip of the finger. According to the SysAdmin, Audit, Network, Security Institute (SANS), authentication problems are among the top twenty critical Internet security vulnerabilities. These problems arise from the use of basic

More information

Best Practices: Reducing the Risks of Corporate Account Takeovers

Best Practices: Reducing the Risks of Corporate Account Takeovers Best Practices: Reducing the Risks of Corporate Account Takeovers California Department of Financial Institutions September 2012 INTRODUCTION A state led cooperative effort, including the United States

More information