Driving Innovation in Security Technology Through ... - FST Media

Driving Innovation in Security Technology Through Emerging Channelspublished it and what’s behind it. In Android,it’s almost a free-for-all. We really need to seesomething happening in the Android space tomake security much better because it’s already thepredominant operating system. That’s a real riskfor us. It means that in the Android space we’remore likely to move back into browser technologydeployed on the Android platform so the app doesnothing more than lodge the browser. The securityis in the browser itself.Vic Mankotia, CA Technologies: That’s a verydifferent approach. What I’m frequently hearing inthe industry relates to wrapping that applicationaround identity. That is, put any out there, wrapit around identity or compliance, access control,authentication, and then most applications will getthe right information from the right person to addaccess.Dave Williams, Bankwest: Which in Apple isgreat, but with Android we are much more scepticalthat it can’t be apped in any kind of way.Vic Mankotia, CA Technologies: Tim, whatabout wealth management: are you really lookingat this platform or is it a ‘good to have’?Tim Richardson, MLC: All consumers wouldwant it if it was readily available but you need toask, what are the priorities in terms of our slate ofwork? What can you expose without affecting theclients or leaving them vulnerable? In terms ofbanks, there’s a huge appetite for iPads out thereand most of the executives want them, but we needto do it in a manner that meets the requirementsof the security road map. It’s about having aco-ordinated strategy that approaches this in acontrolled manner. I think it is top of everybody’smind but when it comes to funding it still has tobe weighed up against other initiatives, which isalways the challenge every business faces.Vic Mankotia, CA Technologies: When Ilook at frequent flyer miles with Qantas, I’m notconcerned so much about security. It’s a number.If someone knows my miles, I don’t really care. Butif I’m moving $1000 or $10,000 to someone else’saccount, I’m concerned about the transaction.Naresh, can you talk about Standard Chartered’sBreeze and how it got to where it is?Naresh Vyas, Standard Chartered: For us,security was important in terms of building themobile apps and mobile capabilities. We ensuredsecurity is on par with what we offer on an onlinechannel. For example, we let customers decidewhat limits they want to have on various channels– $100 might be the maximum, $10,000, $50,000.The other thing we’ve done on the mobile is allowcustomers to transfer money to people they alreadyhave as a beneficiary or as a payee. If you need to setup a new beneficiary you need a lot of information,such as bank routing codes, so we do not supportthis via mobile.Vic Mankotia, CA Technologies: Richard,what do you see as the biggest security risk onthe mobile platform and what are you looking atin an ideal world to protect that experience on themobile platform?Richard Farrell, ANZ: You want to make surethat transactions are secured end-to-end; that yourcustomer information is secured. You also wantto ensure that your personal and authenticationdetails are protected. In an ideal world you wouldhave a controlled sandbox around it and say forexample you are using jail-broken iPhone, you stillwant a high level of control and security around it.The goMoney mobile application has been hugelysuccessfully for ANZ accounting for 36 per cent ofall online logins by ANZ customers and doubledigit growth month-on-month. But this level ofgrowth can be a double-edged sword. On one sideit is growing your business but on the other side,you potentially have half a million users using anapplication that will most likely be the target ofmalware and attacks in the future. On top of that,if you are looking at putting it on multiple devices –such as Android, iPhone devices and tablet devices,your attacks surface has just significantly grown.Due to the fast pace of mobile development, someapproaches are moving from a waterfall to agilebased methodology challenging your traditionalSDL (Secure Development Lifecycle) approaches.Berin Lautenbach, GE Capital: Five years agowe were doing all this stuff on a PC and a PC is a lotless secure than a mobile phone in general terms.At least with a mobile phone you know people havegot it on them all the time; they know if they’velost it. So there’s actually a whole load of securitymechanisms. Bill, you were speaking about iOS, agreat platform to build this stuff on. Does it meanit’s not compromised? No, it can be compromised.There’s things that can go wrong with it. But as afundamental platform to build on, it’s far betterthan Windows. So your question about DLP (DataLoss Prevention): some of the things that I’mseeing at the moment that are really nice on themobile phones, you can do on iOS. It’s harder onAndroid because the segregation side isn’t as good.A client goes on iOS – it’s your email client, yourcalendar, it’s everything. It’s clunky. But this stuff isalways clunky when it starts. And now I’ve got onecentral point of control on your device, but with mydata on it I can control what data you’ve got. I cansee where that data is going. I actually have morecontrol.“You need to ask, whatare the priorities interms of our slate ofwork? What can youexpose without affectingthe clients or leavingthem vulnerable?”– Tim Richardson, MLC“Five years ago wewere doing all this stuffon a PC and a PC isa lot less secure thana mobile phone ingeneral terms.”– Berin Lautenbach,GE Capital3