Biometrics within Financial Institutions

Abstract
This paper presents a problem with the use of technology within the Credit Unions and Banking industries. Technological innovations have allowed the industry to be more open to consumers and challenges that the current economy has posed. Modern technology is also change the landscape of how, when and where business is conducted with financial institutions and consumers, businesses, and other organizations.
Technology driven issues such as privacy, security and trust, have been pushed to the forefront, which makes the line between mobile banking and banking online increasing difficult to distinguish. Credit Unions like other banking institutions rely on gathering, processing, analyzing and providing information to meet the demands of the consumer. Given the importance of information systems within banking its not surprising to find, risks within the systems are developing in nature.

History

Truliant Federal Credit Union was started in Winston-Salem, North Carolina around 1952. They serve over 180,000 member owners and more than 900 business and organizations with $1.6 billion in assets. Truliant as it will be referred to in this paper has 21 financial locations in North Carolina, South Carolina, and Virginia. One philosophy that stands out or is a representation of what this particular Credit Union stands for is “ people helping people”.

Like other not for profit organizations, they provide individuals and small business with products and services to include but not limited to checking accounts, online banking, certificates, along with business, auto and home loans.

The banking industry is just like every other institution out there; they are subjected to fraud and theft. With modern technology there bring about new ways or more creative ways to take advantage of the methods that the banking industries such as Truliant Federal Credit Union and others have in place. For the purpose of this paper, a look will be taken at the challenges, problems and solutions that occur with Truliant’s organization.
Listed below are a few problems within this industry:

1. Mobile banking risks – Consumers are using more of modern technology to obtain conduct personal business. One of the biggest changes in how banking is conducted is through mobile or cellular phones. Banks have made an option to consumers, which cannot access their accounts while “on the go” With this newly found freedom comes a risk. Mobile security has been a challenge that’s affecting banks and credit unions. The same controls that are put in place for online banking do not fair well for mobile banking. In recent years Bank of America, Chase, Wells Fargo and TD Ameritrade have all suffered from security flaws with their mobile banking applications.

2. Social Networks - Just like consumers are using mobile devices to conduct personal business transaction, the connection to social media also poised to become an increasing target to users. Credit unions and banks are on or have established social media sites such as Facebook, LinkedIn, Twitter, etc. in part to stay connected to consumers. The risks of personal sensitive information being shared are high whether it is intent or inadvertently. Fake sites can be set up to look like the real ones and information such as social security number can be given out.

3. Malware and Denial of Service attacks (DoS) – To crash a network server hacker send thousands of false communications or request. All are aim at shutting down the system. Zeus is one of the top bank credential stealing Trojan. It has been linked to over 100 million dollars of financial losses world wide, according to the Federal Bureau of Investigation. Once this Trojan is thought to be under control a new more sophisticated one will take its place. .” (Laudon, 12ed) “The infected computer then becomes a slave, or zombie, serving a master computer belonging to someone else. Once a hacker infects enough computers, her or she can use the amassed resources of the botnets to launch DDos attacks, phishing campaigns, or unsolicited “spam” e-mail.” (Laudon, 12ed)

4. Phishing – Phishing, smishing and vishing attacks are on the rise. This type of threats targets not only banks but also Amazon and other e-commerce. Phishing involves setting up fake websites, emails or text messages that may look legitimate but in fact they are disguised to get personal information.
Another technique to phishing called the “evil twin” is harder to detect because it preys on people on the go. Wireless network connections that are found in airport lounges, coffee shops and hotels are built to seem trustworthy but in fact are bogus networks made to look like legitimate networks to try and capture passwords or credit card numbers once users log in to conduct business. (Laudon, 12ed)

5. ACH Fraud – Is part of corporate account takeovers. Banks are suing customers and vice versa over the responsibility for fraud incidents and losses.

6. Cloud Computing – Credit Unions and banks are slow into cloud computing. However, as the idea becomes more adaptable, the risks are paramount. There is a chance for hackers or frauds to hone their skills when looking for vulnerabilities within the system.
7. First Party Fraud – This risk has been in place for a long period of time, where criminals specialize in setting up duplication of a person’s identity and learn a financial institution practices. Once everything is in place, they set up credit card accounts, loans, etc.
8. Skimming – Counterfeit ATM cards, credit cards, etc. are being used all over the world. Hackers are becoming more intelligent in the abilities to steal and duplicate personal data.
9. Inside Attacks – Disgruntled employees are the biggest risks to a financial institution. By malicious attacks or hacks on a system from the inside, they can release all kinds of sensitive data and cause a corruption of files. A lot outside people that steal and duplicate credentials in order to gain access to financial records can pose a danger.

High-level Solution

Biometric authentication is technology for authenticating systems users that compare a person’s fingerprint, face or retinal image, which are unique to every person and then compared to a stored set of these features within the financial institution database ((Laudon, 12ed). This kind of solution method would be a start in the right direction for all financial institutions. Fingerprint recognition is currently being used in emergency rooms in lieu of identification cards or insurance cards. Newer model PC’s are beginning to use biometric identification to authenticate users.
With the rising access and intelligence of hackers and other unauthorized users of personal information, biometrics increases the difficulty of duplicating ones identity. Since personal features are unique in appearance, it will be become easier to identify customers and transactions can be handled more securely.
Benefits:
No two fingerprints are the same.
It is equally hard to duplicate ones fingerprint, facial imprint or retinal scan.
A business can achieve the highest level of security once in place.
Difficulty of system being duplicated is a great benefit (L., B.B. 2010).

Business/Technical Approach

Fingerprint readers are either trusted or non-trusted. The most secured biometric reader has a fingerprint template, which is a numerical representation of the fingerprint, and it never leaves it once assigned. The reader allows communication to interact with the software and sends back a “yes” or “no” when a person is trying to gain access to information (Johnson, C, 2006).

The Four-Factor based Privacy Preserving Biometric (4F2PB) authentication system four main phases such as the Initialization Phase, the Registration phase, the Login phase and the Mutual Authentication phase. An additional password change phase is added to ensure that the user can change his/her password when required. In each phase distinct operations are defined for the user and the server. (Kathrine, G., & Kirubakaran, E. E. (2011).

The proposed authentication methodology is shown below:

Initialization Phase – Server is initialized
Registration Phase – User confirms registration
Login Phase – User logins for grid access (Kathrine, G., & Kirubakaran, E. E. (2011)

Technology or business practices used to augment the solution

Financial institutions should be willing to work for a more secure solution to the risks of phishing, mobile banking, fraud, cloud computing, etc. by implementing a biometric authentication database, which will insure employees and consumers, are protected. It will be easy to detect fraudulent transactions made by disgruntle employees or hackers within a secured system.
Key personnel should be required to submit fingerprint and retinal scans upon handling large clients and deposits. Clients that have deposits or transactions of six figures or more should be required to have retinal and fingerprint scans before transactions are allowed or cleared. This would be similar to a safety deposit box having two keys to open.

Conclusion and overall recommendation

The basic conclusion would be to implement a biometric authentication system that would best meet the need of not only the bank but the consumer as well. Corporations with large amount of daily transaction cannot afford to have every person fingerprinted or scanned to make a simple transaction. However, actions not unlike check signature can be done with a simple thumb print signature. Key personnel can be fingerprinted, facial and retinal scan as permitted based on the security level.
High-level implementation plan

Summary

Modern technology is making it increasingly easy for consumers to use their cellphones or mobile devices to conduct business. Wireless connection being made available everyplace you go help to facilitate these transactions. All this information is just making it less difficult for hackers to access information and duplicate a person’s identity.
Security should be first and foremost within the minds of the consumers and especially the banking industry. Hard working individuals that believe their transactions are secured and federally insured by their financial institution when they make direct deposits each day. Biometrics authentications will allow for consumers to feel more secure and at ease with their transactions.

References
Hopkins, B. (2009). Master Perspective: Security Architecture Requires Careful Planning. Infonomics, 23(2), 16-17.

Johnson, C. (2006). CryptoMetrics: Security at Your Fingertips. Information Today, 23(1), 37.

Kathrine, G., & Kirubakaran, E. E. (2011). Biometric Authentication and Authorization System for Grid Security. International Journal Of Hybrid Information Technology, 4(4), 43-58.

Kumar, M., & Karthikeyan, S. S. (2011). Security Model for TCP/IP Protocol Suite. Journal Of Advances In Information Technology, 2(2), 87-91. doi:10.4304/jait.2.2.87-91

Laudon, K. L. a. J. Management Information Systems, 12/e for DeVry University (12th ed). Pearson Learning Solutions. Retrieved from http://devry.vitalsource.com/books/9781256399933/id/ch08lev3sec3

References
L., B. B. (2010). Fingerprint Checkout. School Library Journal, 56(7), 12.

Top 9 Security Threats of 2011 - BankInfoSecurity. (n.d.). Retrieved from http://www.bankinfosecurity.com/top-9-security-threats-2011-a-3228/op-1