Android Mobile Banking. How secure are mobile banking apps on the world's most popular smartphone

Transcription

1 Android Mobile Banking How secure are mobile banking apps on the world's most popular smartphone operating system? 1

2 The material appearing in this presentation is for informational purposes p only and is not legal or accounting advice. Communication of this information is not intended to create, and receipt does not constitute, a legal relationship, including, but not limited to, an accountant client client relationship. Although these materials may have been prepared by professionals, they should not be used as a substitute for professional services. If legal, accounting, or other professional advice is required, the services of a professional should be sought. 2

3 PRESENTERS Bob Grill IT Consulting Manager Moss Adams LLP David Dyk IT Consulting Manager Moss Adams LLP 3

4 AGENDA Mobile Banking Trends Android Platform Basics Android Mobile Banking Security Considerations Questions and Answers 4

5 AGENDA TOPIC: MOBILE BANKING TRENDS 5

6 THE GROWTH OF MOBILE COMPUTING 91% of Americans use a mobile phone As of Christmas 2011, 50% of Americans will have a smart phone. By 2013, mobile phones will overtake PCs as the most common web access device worldwide. Sources: survey 91 of americans have cell phones.ars 6

7 MOBILE BANKING TRENDS: SMARTPHONE APPS Richer features and better user interface when compared to SMS and WAP channels Two dominant platforms: ios and Android 7

8 MOBILE BANKING TRENDS: MOBILE REMOTE DEPOSIT CAPTURE Emerging market expectation for community banks and credit unions to adopt Key vendors beginning i to offer photo bill pay Focus of regulatory scrutiny on consumer compliance and security risks 8

9 MOBILE BANKING TRENDS: MOBILE REMOTE DEPOSIT CAPTURE (2) Several key requirements for RDC risk management from regulators (FIL ) Regulator concern with: Risk assessment Multi factor authentication Customer awareness education Deposit thresholds 9

10 MOBILE BANKING TRENDS: PERSON TO PERSON PAYMENTS Payments outside of the institution, seen as an opportunity to build brand recognition and leverage existing customers Competition among FI service providers (e.g., FiServ, Q2) and Internet players (e.g., Paypal, Square, American Express Serve, Google Checkout) 10

11 MOBILE BANKING TRENDS: PERSONAL FINANCIAL MANAGEMENT Mimics functionality of consumer branded solutions such as Mint.com or Yodlee Often includes customizable alerts Defensive move to retain customer interactions ti and relationship 11

12 AGENDA TOPIC: ANDROID PLATFORM BASICS 12

13 GROWTH OF ANDROID PLATFORM 13

14 ANDROID OPERATING SYSTEM Open Source Source code is available to read by anyone, based on Linux. Android iddevelopment is controlled dby a group called the Open Handset Alliance mostly run by Google, but many cell phone manufacturers are members. Unlike the iphone, the Android platform is more open to customization by device manufacturers and users, and therefore security considerations become more complex. 14

15 ANDROID SECURITY ARCHITECTURE This only works if the user does not give the application permission to override. 15

16 ANDROID SECURITY CONTROLS Applications run inside a Virtual Machine (VM) one app should not know what other apps are running on the phone Each VM is limited to communications with operating system programs provided dby Google Applications can override this control if given permission i 16

17 AGENDA TOPIC: ANDROID MOBILE BANKING SECURITY CONSIDERATIONS 17

18 ANDROID APP MARKETPLACES The Google Play marketplace is the primary app store. Other stores from carriers (Verizon) and third parties (Amazon.com) also exist. Financial institutions can distribute ib t apps through h any of these channels. Marketplaces maintain basic controls over apps distributed: o Automated source code review o Marketplaces maintain basic controls over apps distributed Each app is digitally signed by the developer. The operating system stem restricts updates to only those signed by the same developer. Therefore, Internet banking vendors must maintain strict controls over the digital keys used to sign the app, to prevent it from being used for unauthorized app updates. 18

19 APP PERMISSIONS App permissions are used to control what resources each Android app can access. Minimize the permissions an app uses, in order to minimize i i the consequences of potential security vulnerabilities in the application. 19

20 ANDROID MOBILE BANKING: AUTHENTICATION Layered Security to comply with FIL Many institutions i i balance risk by limiting money movement, using device identification and simple user authentication (e.g., 4 digit it PIN) Android can maintain an encrypted device identifier 20

21 STORING SENSITIVE DATA Sensitive data includes: o Device authentication information o Cached balance and transaction histories Sensitive data can be secured by encryption. Developers need to call specific functions to ensure that happens. 21

22 CONCLUDING RECOMMENDATIONS Promote security awareness for Internet banking users that is platform specific Perform due diligence and work with Internet banking vendors to ensure that Android apps have appropriate security engineered Ensure layered security controls are in place for authentication, ti ti transaction ti monitoring, i or other controls (required by FFIEC FIL ) 22

23 QUESTIONS? Bob Grill (916) David Dyk