Driving Innovation in Security Technology Through ... - FST Media

Driving Innovation in Security Technology Through Emerging Channels“Like most thingsthat are developed,you hope securityis considered atthe beginning butsecurity professionalsare use to that notbeing the case.”– Ken Brandt, ANZ“I think traditionally themove to mobile wasseen as a retail move.That’s no longer thecase. Now corporatecustomers are tellingus very, very loudly thatthey are mobile.”– Diane Shehata, NAB2and approve trade transactions through a mobiledevice. We have a huge diversity of cultures in ourmarket that makes we need to understand andcater to, for example supporting Islamic banking inseveral of key markets, such as Malaysia and UAE.Vic Mankotia, CA Technologies: When I talkto banks and institutions and people getting intomobile banking, there’s a lot of discussion aboutapplications. Ken Brandt, where is ANZ BankingGroup (ANZ) going, or where is the industry going,in your opinion? Are you thinking of security whenyou build these applications or do you think aboutit afterwards?Ken Brandt, ANZ: The last question is a broaderquestion and it’s fair to say, like most things thatare developed, you hope security is considered atthe beginning but security professionals are usedto that not being the case. Depending on who isthe developer and how it’s being developed andhow the product is being planned, you might bein there at the beginning – and that’s changing forthe good – but I think we’re still in catch-up mode.ANZ is much more security conscious now, in partbecause of all the news in the media about differentattacks on the bank. It has certainly captured theattention of the ANZ board of directors. It’s notthe best reason for increasing awareness but it hasincreased awareness.Diane Shehata, NAB: I am very concerned aboutthe business side. I think traditionally the move tomobile was seen as a retail move. That’s no longerthe case. Now corporate customers are telling usvery, very loudly that they are mobile. I’m hearing itfrom those of our customers that are internationalor are generally on the road. They want to bemobile. So in the business-type channels we expectpayments to be securely authorised.There’s a whole range of security that we buildinto the channels on top of all the other type ofsecurity that we have at the back-end to detectwhether or not this particular transaction is inline with this customer’s normal behaviour. Butwhat the customer sees is the security that’s builtinto the channel, which is around segregation ofduties, and how that is captured in a mobile device.Certainly we see this as the growing market for us.Vic Mankotia, CA Technologies: Thedifference is that branches are operational 9 to 5 –maybe weekends for certain banks. Mobile bankingis 24/7. That’s a different challenge. What I don’t seein the Australian market is a lot of authentication.How do you see regulation playing in this space?Chris Smith, NAB: Australia was among the firstever to experience hacking. In 2003, there was aphishing attack on the Commonwealth Bank ofAustralia (CBA). So the notoriety of being the firstto be impacted by this underground activity meanswe’ve had more experience than everybody else.Initially putting in SMS security to authenticatewas a market-leading move to secure transactions– or at least to drive awareness. We’re probablynot going to be No 1 on the hit list anymore but Ithink there are signs of innovation here: ANZ’s GoMoney, CBA’s movement in Commbank Kaching,and some of the work we’re doing is really movingthe power of choice to consumers. With that we’llhave no choice but to look at the next phase ofauthentication. Actually I am quite optimistic wedo lead in many parts of the world in terms ofauthentication.Vic Mankotia, CA Technologies: Risk-basedor transaction-based?Chris Smith, NAB: We hope it’s risk-based, butit’s probably transaction-focused. A lot of thirdparty applications are probably being built withoutthe awareness or rigour of some kind of securityframework.Vic Mankotia, CA Technologies: That’s a verycontentious issue. Let’s take Square, for example.I was at a conference last week in San Francisco.I jumped into a cab and the driver took my creditcard and swiped it on his iPhone and I got an email15 minutes later saying, “Here is your receipt.”He’s charged my credit card, there is a Googlemap connect link which tells you where I travelledfrom and I can file that under expenses. There areapplications being built around mobile platformsby third parties, consolidators or people who wantto capitalise on the opportunity. The risk doesnot lie with the bank or the carrier or the devicemanufacturer, or the software company helping itout. It’s the third party that I’m worried about. It’sthe authentication, the identity, the access control,the content aware either in access management. Allfour of these have to work together.I’m going to board a flight today. My passport,my identity, is not going to be enough. I have to goand get an access or boarding pass, I’ve got to goto immigration and get it authenticated. I’ve gotextra in my bags, scan my contents and then I go tothe gate, so all four have to work together and veryfew companies offer that. Dave, from a BankWestperspective, what do you see?Dave Williams, Bankwest: Everything goesthrough the same security gateway, but I think ifyou look at [Google’s] Android and [Apple’s] iOS,they are completely different in terms of security.In the Apple sphere, the authentication you need togo through to be able to publish gives you a certainlevel of protection and a level of traceability. Youcan go back to where the app came from and who