FFIEC: Two-Factor Authentication Big Focus

2005 Authentication in an Electronic Banking Environment

The FFIEC's 2005 update became the industry standard for online banking authentication and risk assessments, highlighting regulators' desire for financial institutions to conduct risk-based assessments, evaluate customer awareness programs, and develop security measures that reliably authenticate customers who remotely accessing Internet-based financial services.

In 2005, the agencies noted that single-factor authentication, as the only control mechanism, could no longer be considered adequate for high-risk transactions - those involving access to customer information or the movement of funds to other parties. Financial institutions offering Internet-based products and services, the agencies recommended, should use effective methods to authenticate the identity of their customers. Account fraud and identity theft, regulators contended, frequently result from single-factor [e.g., ID/password] authentication exploitation. "Where risk assessments indicate that the use of single-factor authentication is inadequate, financial institutions should implement multifactor authentication, layered security or other controls reasonably calculated to mitigate those risks," the 2005 update notes.

Consistent with the "FFIEC Information Technology Examination Handbook," Information Security Booklet, which was published in December 2002, regulators also said in the 2005 guidance that financial institutions should periodically ensure their information security programs:

• Identify and assess the risks associated with Internet-based products and services;
• Identify risk mitigation actions, including appropriate authentication strength;
• Measure and evaluates customer awareness efforts;
• Adjust, as appropriate, their information security programs in light of any relevant changes in technology, the sensitivity of customer information and internal or external threats to information;
• Implement appropriate risk mitigation strategies.

The list of FAQs aimed to clarify the authentication guidance issued in 2005, addressing the need for:

• Risk-based assessments;
• Customer awareness;
• Enhanced security measures to authenticate customers that process high-risk transactions.

Over the next four to five years, as industry threats continued to evolve, regulators noted that a majority of U.S. financial institutions had taken few steps to adequately detect and stave off new and emerging cyber risks and attacks. Increasing incidents in 2009 and 2010 of ACH and wire fraud, resulting from phishing attacks often perpetrated by Zeus on small to mid-sized commercial bank customers, led regulators to begin evaluating steps to address new and emerging fraud threats.

2010 Interagency Supplement to Authentication in an Internet Banking Environment

In the draft, regulators clearly note that financial institutions have not done sufficient jobs of maintaining authentication standards that resist new online threats posed by malware. Regulators also note that financial institutions have fallen short when it comes to conducting internal risk assessments.

The five key recommendations emphasized in the 2010 FFIEC draft:

• Better risk assessments to help institutions understand and respond to emerging threats, including man-in-the-middle or man-in-the-browser attacks, as well as keyloggers;
• Widespread use of multifactor authentication, especially for so-called "high-risk" transactions;
• Layered security controls to detect and effectively respond to suspicious or anomalous activity;
• More effective authentication techniques, including improved device identification and protection, as well as stronger challenge questions;
• Heightened customer education initiatives, particularly for commercial accounts.

This draft is currently under review by the FFIEC member agencies, and no date has been set for its ultimate issuance.