N&H Investments Inc. March 12, 2012 To: David Maybach, Director IT security From: Norman Haughton, IT Security Analyst Subject: Progress of the ‘’Web Security Two-­‐Factor access‘’ Project at N&H Investments Dear Mr. Maybach, In keeping with our corporate objective of being Canada’s most secure financial institution, I must report that the progress of the “two-­‐factor” security access system is underway at a steady pace. We are currently looking at different hardware and software systems analyzing their cost versus benefits, and usability. The project is forecasted to be on time with the final details of the findings being ready for April 4, 2012.

Background: As per your request, I am in the process of completing a feasibility study on new types of “two-­‐factor” security access for our customers. I strongly recommend such a system in our world of online piracy and identity theft. According to Criminal Intelligence Service Canada, banking information and passwords are listed as some of the most commonly targeted data for online pirates. The study also finds that 1 in 2 Canadians feel that their personal information is not adequately protected by computer systems (Criminal Intelligence Services Canada, 2008). In 2008 Phonebusters reported 12,142 claims on identity theft, which amounted to losses over $9.5 million dollars in Canada (Stolen Identity, 2009). With these facts, I support the initiative of increasing our web security measures, and will use all the resources available to achieve our target of implementation by the end of 2012. I am currently completing impact studies on your hardware device proposed (token with changing codes every 60 seconds). I suggested a keychain type, due to the ergonomics and ease of use. I also formulated an idea for a new “two-­‐factor” software identification system, that asks for your login username and password but also tracks users’ last transactions. The software will ask intuitive questions based on previous account activities during high-­‐risk transactions. The concepts were tendered for bidding and I authorized a budget for this project from our ‘’innovations” allotment for the financial year. On completion of the designs, the products will be tested by a focus group that will be providing us insight on the products and personal relevance of tighter security measures when using online banking tools.

N&H Investments Inc.

Work completed: On February 25, 2012, I tendered a contract for bidders to propose designs for a keychain card with an electronic interface, which gives a pin-­‐ code that changes once every 60 seconds. On February 27, 2012 I submitted a request to a local statistical company to gather a diverse “focus group.” The group will give insight on tighter security measures, and the ergonomics of a keychain card access code device. On February 28, 2012, I tendered a contract to 5 software developers. Details of the type of software system were proposed, and the contractors will make their pitches on March 17, 2012. They are currently in the process of design authentication. On March 1, 2012, I contacted our business analyst, giving her a detailed description of the project. We made a schedule for testing the software and hardware that will be implemented. We discussed and drafted minimum system requirements that would meet our firm’s objectives. Work to be completed: Currently we are waiting for the contractors to give their design models. On delivery of the design models, we will begin testing with the focus group. The findings from the group will be tabulated by the statistical firm chosen for the project and results presented for your review. Anticipated problems: The problems we forecast will be in the form of implementation funding. The feasibility study will be completed on time, but the implementation process might be stalled while waiting for decisions as to how we plan to fund the new security product for our customers. The current options suggested are to fund the new systems by increasing user fees, or adding the associated cost to our expense bill. Studies will be completed to assess the impacts of increasing user fees. Some initial reviews show a reduction in our competitive advantage. As it relates to adding the associated cost to our wage bill, we did a preliminary assessment and found that this would be possible by utilizing the projected retained earnings of the fiscal year ending 2012. The final report containing the feasibility of the project will be completed on April 4th 2012 for your review. Works Cited: Criminal Intelligence Services Canada. (2008). Retrieved from Government of Canada: http://www.cisc.gc.ca/annual_reports/annual_report_2008/feature_focus_20 08_e.html

N&H Investments Inc.
Stolen
Identity. (2009, September 29). Retrieved from CBCNEWS: http://www.cbc.ca/news/story/2009/01/21/f-­‐idtheft.html