Internet Banking & Trust Encryption

Internet Banking Trust and Encryption Luxembourg Business - May 1998 Security Trust and encryption A new debate has arrived with the advent of Internet banking, concerning trust - trust between the bank and its clients. This issue is critical because, if no trust exists, then no bank-client relationship can succeed.

Some banks are now using the Internet to achieve new business goals using the new medium, by offering the same suite of banking services and products through a new technology.

In the United Kingdom, four major banks have joined up with Microsoft to offer online banking services later this year based on Money98. In Luxembourg, Banque Internationale and Fortis Bank are leading the way in Internet banking, along with Flemings in investment fund services - and others are following.

The main growth areas are in retail banking (both commercial and private clients) and private banking, which comprises wide-ranging and varying services. Also included here are investment fund promoters who can enjoy a much wider geographic spread of their client base.

<*dv_3*>Thus, use of the Internet is not restricted to customers enquiring about daily or weekly fund movements. Internet applications are now being integrated and launched to offer a higher-level service to both existing and new client-bases.

<*dv_5*> However, with the integration of these applications, the critical criterion from the banks perspective in providing Internet banking is security. On no account must an intruder gain access to unauthorized information on the banks systems, whether specific client or other confidential data.

<*dv_0*> From the perspective of the client, the paramount criterion lies in transmission, both in trusting that the transmissions are secure and also that the transmission speeds are not unresponsive.

If there is any doubt in the mind of the clients concerning not only accessing or intercepting account data, but also in authorizing transfers, then they will not trust the system and will resort to alternative methods - or banks.

<*dv_2*> The comparative vulnerability of Internet transactions can be exaggerated, of course. Which credit card holder has not divulged their card details over the telephone, or given it to a restaurant waiter or shop assistant who takes it away and returns with it a few minutes later?

<*dv_1*>Looking at the same concept from a different perspective, many potential clients actively seek banks which offer secure Internet banking, enabling them to authorize transactionsor use other services without leaving their home or office.

This demonstrates that Internet banking is now following ATMs and telephone banking - which does not involve sending encrypted PIN numbers via telephone lines - as the next big phase in electronic banking.

The phenomenal success of ATMs has been convenience, 24-access (as long as youre not at the end of a queue on a bank holiday week-end when the person before you just took the last few notes!) and security. The latter is based on PIN codes and plastic cards.

Internet banking systems require similar security solutions, with user identification and passwords the visible means. What is not visible however, for either ATMs and Internet banking, is the different extents of electronic tagging, encryption, identification, digital certificates, non-repudiation and more all these are invisible to the user but are intricately employed in the engine of the security module.

It is interesting to note that Internet-based encryption algorithms are based on higher levels of encryption than used for ATMs (mostly 56-bit keys).

Encryption is one of the foremost means by which data can be protected from interpretation by unauthorized interception. Various solutions are currently available, but two recent events may result in a new generation of encryption products.

First, Eurokey is based on 4,096-bit encryption, using a PGP-style dual key system. PGP is legally restricted to 128-bitby U.S. export law; versions of browsers such as Microsofts Internet Explorer and Netscapes Navigator exported outside the United States only support 40-bit encryption.

<*dv_4*> At the same time, IBM has announced that it is promoting a new encryption algorithm to the US government (a 128-bit key solution that can be built into hardware, software and in items such as smartcards) as a possible replacement for the Data Encryption Standard (DES).

Before a bank takes the plunge into Internet banking, it is essential to ensure that it has a strategic plan incorporating both business objectives and a marketing strategy. These will provide a solid foundation from which to use innovative means, such as the Internet, to compete among the leading players in the market.

<*dv_6*> Other new developments are set to influence the security picture. Tim Berners-Lee (founder of the Internet) recently announced that he is currently studying the lack of anonymity which accompanies Internet traffic, and is attempting to come up with a radical new approach.

At present, most WebSite visitors and e-mailer users are oblivious to what data their Internet traffic is tagging along with it and this goes far beyond cookies and applets.

This article first appeared in the May 1998 issue of Luxembourg Business. It is the Copyright (1998) of International City Magazines (ICM S.a.r.l.) and we use it with their kind permission.