1 / 41

On-line Banking Risks & Countermeasures By Vishal Salvi – CISO HDFC Bank

IBA Banking Security Summit 2009. On-line Banking Risks & Countermeasures By Vishal Salvi – CISO HDFC Bank. Agenda. 1. Opportunity 2. Threats 3. Solutions. The Opportunity. Opportunity. The Internet. The Internet. Source: Internet World Stats as of Q2 08. The Internet.

channing-thompson
Download Presentation

On-line Banking Risks & Countermeasures By Vishal Salvi – CISO HDFC Bank

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. IBA Banking Security Summit 2009 On-line Banking Risks & Countermeasures By Vishal Salvi – CISO HDFC Bank

  2. Agenda 1. Opportunity2. Threats3. Solutions

  3. The Opportunity Opportunity

  4. The Internet

  5. The Internet Source: Internet World Stats as of Q2 08

  6. The Internet Source: Internet World Stats as of Q2 08

  7. The Internet Source: Internet World Stats as of Q2 08

  8. The Internet 19 % 72.5 % 73.8 % 5.2 % 63.8 % 26.1 % 68.6 % 58.1 % 70.7 % Source: Internet World Stats as of Q2 08

  9. The Internet Internet Users 1.46 Billion (22%) World Popl. 6.6 Billion On-line Users 584 Million (40%) Funds Transfer 146 Million (20%) Source: Internet World Stats as of Q2 08

  10. Threats

  11. Threat Horizon Focus of attacks Organized Crime High Trojans People Pharming Phishing Data Social Engineering Applications Spam Mail Information Leakage / Theft Sophistication of attacks Unauthorised Access Attackers Profile Infrastructure Application Layer Attacks Network Intrusion Malware Website Defacement Disorganized Crime Password Cracking Low Time in years

  12. Threat Horizon

  13. The Crimeware Landscape Trend Micro

  14. Phishing

  15. Phishing Stats

  16. Other Statistics Top Ten Countries by Attack Volume Distribution of Attacks by Hosting Method

  17. The Underground Fraud Ecosystem

  18. The Fraud Supply Chain Technical Infrastructure • Operational • Infrastructure Tools Hosting Delivery Mules Drops Monetizing Harvesting Fraudster Cash Out Fraudster Communication Fraud forum / chat room Customer Account

  19. Fraud as a Service: “Cut the Middle Man” FaaS • Operational • Infrastructure Tools Hosting Delivery Mules Drops Monetizing Cash Out Fraudster User Account

  20. Trojans • Phishing/Pharming Trojans • Keyloggers/Screen-scrapers • MITB Trojans • Active Keylogger + Proxy (Botnet) Trojan

  21. Fast Flux Modus Operandi : Harvesting • Fast-flux networks

  22. Potentially captured via crimeware, given FI & country coverage Underground Market Place : Credentials for Sale

  23. An online ad promoting lists of stolen credit cards Underground Market Place : Credentials for Sale

  24. Underground Market Place : Herding Mules

  25. Phone fraud services to cash out accounts in USA by taking advantage of inherent weaknesses in the Call Centers. This can spoof any number in the United States. The service enables fraudsters to accept incoming calls, posing as the genuine account holder. Latest Trends : Phone Fraud to cash-out

  26. Chat in the Middle : Phishing Attack attempts to steal consumers’ data via bogus live chat support Pop-up chat session with online banking customer Live Chat session with Bank’s “Fraud Dept” looking to validate personal information for better service Request information which may be typically be used for challenge questions New twist in Phishing attack Latest Trends : Chat in the Middle

  27. Solutions

  28. Multilayer Protection Bank Customer Customer Awareness & Education

  29. Awareness

  30. Blocking / Shutdowns Bank Customer Anti-Phishing, Anti-Pharming & Anti-Trojan Service Customer Awareness & Education

  31. Command & Control Bot-Herder Anti-Trojan Service Infection / Update Drop Less than 25% of infected PCs are protected by AV applications. Even less effective against the specific threat. Anti-Trojan Service

  32. Authentication Bank Customer Site-To-User Authentication Anti-Phishing, Anti-Pharming & Anti-Trojan Service Customer Awareness & Education

  33. Site-To-User Authentication

  34. Strong Authentication Bank Customer Second Factor Adaptive Authentication Site-To-User Authentication Anti-Phishing, Anti-Pharming & Anti-Trojan Service Customer Awareness & Education

  35. Adaptive Authentication Fraud Network

  36. Transaction Monitoring Bank Customer Transaction Monitoring Second Factor Adaptive Authentication Site-To-User Authentication Anti-Phishing, Anti-Pharming & Anti-Trojan Service Customer Awareness & Education

  37. Transaction Monitoring Proprietary and Confidential

  38. Bank Customer Physical, N/W, Application, DB & OS level Security Transaction Monitoring Second Factor Adaptive Authentication Site-To-User Authentication Anti-Phishing, Anti-Pharming & Anti-Trojan Service Customer Awareness & Education

  39. Traditional layers of Security

  40. Bank Customer Incident Response, Fraud & Case Management Physical, N/W, Application, DB & OS level Security Transaction Monitoring Second Factor Adaptive Authentication Site-To-User Authentication Anti-Phishing, Anti-Pharming & Anti-Trojan Service Customer Awareness & Education

More Related