Converting online browsers into online shoppers by reducing security concerns

E-trgovina, Palić, April 2010 CONVERTING ONLINE BROWSERS INTO ONLINE SHOPPERS BY REDUCING SECURITY CONCERNS Žarko Vukadinović Head of E-banking Unit Payment Cards and Direct Channels Department

Albert Gonzalez (born 1981) is a computer hacker and computer criminal who is accused of masterminding the combined credit card theft and subsequent reselling of more than 170 million card and ATM numbers from 2005 trough 2007 – the biggest such fraud in history. Source: Wikipedia WASHINGTON, 2009. Federal prosecutors on Monday charged a Miami man with the largest case of credit and debit card data theft ever in the US, accusing the one-time government informant of swiping 130 million accounts on top of 40 million he stole previously. Albert Gonzalez, 28, broke his own record for identity theft by hacking into retail networks, according to prosecutors, though they say his illicit computer exploits ended when he went to jail on charges stemming from an earlier case. Gonzalez is a former informant for the U.S. Secret Service who helped the agency hunt hackers. The agency later found out that had also been working with criminals and feeding them information on ongoing investigations, even warning off at least one individual, according to authorities... FROM “BACKYARD HACKING” TO ORGANIZED CRIME VERDICT: 20 YEARS
Security threats are continuously increasing and are becoming global phenomenon
Phishing
per mail/links
Man-in-the-Middle
per mail/links, as virus
Man-in-the-Browser
“ The Trojan”, extremely powerful, have no observable symptoms, will be prevalent
Combination of existing threats, new threats, transferring of focus from financial services to other institutions and usage of social engineering techniques.

ONLINE SECURITY FROM MERCHANTS PERSPECTIVE
Risk management processes conducted by merchants in order to prevent online fraud:
Automated screening
Profit leaks
Manual review
Staffing & Scalability; 18% of orders
Accept/Reject operations
Lost sales; 4.6% of orders are rejected
Fraud/Claim Management
Fraud Loss & Administration
70% of merchants manually review suspicious orders
5% of merchants manually review every order
23% of chargebacks in 2009. were fraud reason-coded
1.6% of orders in 2009. proved to be fraudulent
Merchants are expecting to lose an average of 1.8% of their overall online revenue in 2010. to payment fraud
One third of merchants are seeing that percentage of online revenue lost to fraud increases year-to-year
Fraud as a greatest business threat, as seen by the merchants, is increasing Source: Sixth Annual UK Online Fraud Report, 2010 edition, CyberSource

ONLINE SECURITY FROM CONSUMERS PERSPECTIVE
In 2009. 50% of consumers still didn’t used online shopping, comparing to 51% in 2008. and 54% in 2007.
67% of non-shoppers just like to buy on street
47% of non-shoppers stated that they are concerned about the security aspects
On the total consumers sample, 71% stated that they are concerned with the level of risk when purchasing over the web, which is increase in 5% comparing to 2008.
59% of consumers stated that they heard more negative stories then positive
Just over a third of consumers have been a victim of online credit card fraud, or know someone that has
Source: Sixth Annual UK Online Fraud Report, 2010 edition, CyberSource

ONLINE SECURITY FROM CONSUMERS PERSPECTIVE Over the years, there have been a few minor changes in the measures that consumers take to protect themselves when buying on the Internet
Consumers are becoming aware that the followings roles in Internet shopping process could provide higher security:
Banks with their products and services
Government
Themselves
Source: Sixth Annual UK Online Fraud Report, 2010 edition, CyberSource

PRODUCTS INSPIRED BY MARKET DEMANDS
Several products were developed during last two decades (first Internet transaction in 1992.). Some of them less or more successful, but only rear were able to assure efficient prevention in online fraud.
Address Verification Service
Consumer was asked to present his address which should be paired with the one registered in his issuing bank
Card Verification Number
CVC/CVV number printed on the back of the card
SMS alert
Consumer is informed by his bank on the mobile phone number he registered in his bank that the purchase has occurred, presenting him the details about the transaction (date, amount, place/url,...)
Virtual cards
Cards designed only for online shopping. Before shopping consumer must assign necessary amount of many from his account to the card.
MasterCard SecureCode and Verified by VISA
Based on 3D Secure protocol, created and standardized by VISA and MasterCard in 2002. If one of party doesn't participates, “liability shift” is applied.
Static Password
Consumer is redirected to the secure web page of the issuing bank in order to authenticate himself by presenting the password
Dynamic Password
Consumer is redirected to the secure web page of the issuing bank in order to authenticate himself by presenting the password generated by the card’s chip on the card reader, after entering the card’s PIN on reader

Service designed for prevention of MasterCard and Maestro cards misuse by enabling PIN based transaction over the Internet
Having CAP certified card reader is a prerequisite for service usage
Gemalto, Vasco, Xiring, Todos,... Could be obtained in Banca Intesa branches from May 15th
Service available for every existing and every new Banca Intesa Maestro or Master card
Debit cards automatically enrolled
Only SecureCode enabled Maestro cards can participate on Internet, over 500,000 issued cards
Credit cards must be enrolled by card user
User must enroll his card, Simple enrollment procedure, Enrollment URL https://online.bancaintesabeograd/enrollment/
Converting Internet transaction form “card not present” to “card present transaction”
Look for logo on merchant’s web site when shopping online
After presenting card data you will be redirected to the Banca Intesa’s secure web page
Check out the SSL certificate and personal message on the page in order to be sure that you are at the bank’s authentication page
Check out the transaction data (Merchant name, Amount, Date, Card number)
Insert the card in the reader and enter the PIN in the reader
After PIN verification you will be asked to enter in the reader challenge presented on the authentication web page
Enter the Password generated by the reader on authentication page and submit the transaction
CHIP AUTHENTICATION PROGRAM – CAP Tool for bringing online shopping security and consumer confidence to the new level

HOW DOES IT LOOK LIKE?

AUTHENTICATION IS WHAT MAKES IT SECURE
Two Factor Authentication principle implemented – “what you have and what you know”
I trust my card
card’s chip as a security device (CAP application, Private key, Transaction counter)
I have my card
only original card can create correct cryptogram
I know my PIN
PIN must be presented to the chip trough card reader, must be validated before creation of cryptogram and the result of validation is included in cryptogram
Customer authentication and transaction signing – “what you see is what you sign”
Input data (Challenge, Amount, Currency) included in cryptogram
CAP advantages in comparing to static password authentication model
Preventing multiply transaction
Preventing fraudulent transaction
Authentication dependable on risk parameters
“ Back-door” security modules
Risk assessment, Fraud detection, Anomaly detection
Constant education in order to increase security awareness of customers
Could security be measured in money? Yes Depending on authentication mode Yes CAP BASED PASSWORD No No No STATIC PASSWORD Man-in-the-Browser Man-in-the-Middle Phishing PREVENTING THEFT

WHY ARE WE DOING THIS?
... create customers needs.
Exclusive representative of American Express for Serbia
... are lieder in new technologies appliance.
Card business
First in implementing EMV, MC PayPass and MC CAP
Only bank in Serbia with >1million issued cards
Internet banking
~100,000 retail and corporate users
>1 2.5 million Internet transactions with amount of ~15 billion € in 2009.
... define the direction of market development.
Only bank in Serbia licensed for VISA and MC Internet acquiring
53 live merchants
~73,000 transactions with amount of ~10 million € for 2009.
because we …

WILL THIS BE ENOUGH? Now this is not the end. It is not even the begining of the end. But, it is, perhaps, the end of the begining. Sir Winston Churchill November 1942

Converting online browsers into online shoppers by reducing security concerns

by ITDogadjaji.com on Apr 21, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

1 Embed 101

Statistics

Converting online browsers into online shoppers by reducing security concerns — Presentation Transcript