See your link here
Is your bank responsible for protecting you from key loggers?
12 comments- IT TOPICS:Business Intelligence, Security
Where does your bank's responsibility to protect you and your online transactions end? Apparently the HSBC bank of Great Britain knew for 2 years that they had a vulnerability and did nothing about it. There are very few details about the vulnerability, but one thing is known -- an attacker would already have to have a key logger on the customer's system to take advantage of the vulnerability. Maybe I'm being naive, but if an attacker has a key logger on the system, I figure your online banking credentials being stolen is just the start of your worries.
The vulnerability HSBC has is apparently extremely difficult to actually take advantage of, a factor HSBC took into account when they decided to live with it because other concerns were more pressing. As security professionals, we should understand this balancing act, even if we don't always agree with the decisions that are reached. The cost to fix the issue was considered to by management to exceed the probability of an exploit multiplied by the possible cost of paying for any such breaches. Pretty standard business reasoning.
The bank could have put any number of safeguards in place to mitigate the vulnerability, but the question is, should they? One possibility that comes to mind is your bank having a variation of Network Admissions Control (NAC) that would require you to have up to date patches and anti-virus on your system before you can access your account. As much as I'd like to see that, I think the first bank to do this is going to face a huge battle with their customers. I can imagine the calls now, "Mrs. Smith, you have to upgrade your computer to SP4 before you can access your account. No, I can't offer you support on how to do that." Not a pretty scenario.
Banks face a tough situation. They're considered to be the safe house for your money and need to do everything they can to protect it, but at the same time they can't reach into your computer and do what they'd really need to to protect the endpoint. And unless the endpoint, your desktop, is properly protected, there's no way they can guarantee that the banking transaction is going to be safe. This is where the unwritten, unspoken contract between the bank and the customer comes into play: While the money is in the bank's possession, they'll do their best to protect it, but when you are accessing your money, it's on you to do your best to protect your side of the transaction.
Print
Email this
Digg this
