Connect with us

Technology

How to keep video conferencing compliant and secure in finance

Published

on

How to keep video conferencing compliant and secure in finance 1

By Owen Morris, Operations Director at Doherty Associates, leading specialists in managing and securing cloud services. 

Video conferencing is the new normal way of collaborating in finance since the pandemic, with reports revealing a record growth in conferencing app downloads. In the week around lockdown, Microsoft Teams saw an average 11-fold increase globally on download figures.

Prior to lockdown many finance firms operated video conferencing facilities as part of their IT provision but the steep increase in the use of video shows how it’s set to remain one of the main ways of staying connected and doing business. Especially with 74% of CFOs planning to shift some employees to permanent remote working post-COVID-19, according to Gartner,

The desirability of cloud hosted systems has increased as opposed to technology being provided as part of an on-premise office communications system, with finance having to adapt to video becoming central to their core business processes.

While the flexibility and diversity to video conferencing apps has a multitude of productivity benefits, these apps are another route for hackers to access the rich data stored by finance companies if the organisations are not properly securing all routes in.

The greater the use and volume of cloud based video available, the greater the opportunity to breach security and privacy. It’s therefore ever more critical for financial services to control how video is used and disseminated, especially with employees now using multiple personal and work devices from various locations to access a variety of video platforms.

Video conference securely

When implementing or securing a video conferencing system finance firms must consider what their security posture will be, covering the following 10 steps:

  1. If possible, configure your video platform to generate individual links to specific people for a specific time slot and passcodes for meeting access to stop the distribution and re-use of links otherwise known as ‘zoombombing’, which allows uninvited people to join meetings.
  2. Maintain a distinction between internal and externally available meetings by controlling the people attending. If possible, use integration between your cloud sign-on and the video platform to identify users, for example, using Azure Active Directory in conjunction with Microsoft Teams. This will help ensure that confidential data is not accidentally shared externally.
  3. Understand how meetings are recorded and where the recordings are stored. For compliance reasons, systems that can store recordings within the cloud rather than on user machines should be preferred as a more secure means. This also allows easier searching for compliance and auditing purposes, as I explain later in this article.
  4. Identify any additional sources of personal information that could be held in recordings such as HR information especially associated with protected characteristics defined under the GDPR, or patient information. Have a way of identifying and segregating access to these recordings – again, important for compliance and auditing.
  5. Understand how to quickly find out who was involved in past meetings as this is also required for audit reasons.
  6. It’s a breach of data protection regulations not to request consent from the person recorded. Understand how platforms notify people of recordings and ensure your company’s privacy policies reflect this.
  7. Investigate what information can be gathered from the recordings for later audit purposes – some platforms allow automatic transcription of recordings to text.
  8. Does your video conference platform allow a broadcast/mass-meeting option as well as multi-attendee conferencing, and do you need a separate privacy policy for this? For example, when people attend webinars, their personal data may be retained under a different lawful basis (for example, legitimate interest) so it this may need addressing separately in a privacy policy.
  9. Does the platform allow the transfer of other data to meeting attendees – is this a possible vector for data leakage?
  10. Screen sharing can disclose information to meeting attendees so look to lock this down by implementing policies such as only being able to share individual windows rather than a whole desktop.

    Owen Morris

    Owen Morris

Keep your video data compliant

As mentioned above, for compliance purposes it’s important to understand how data is stored in the video platform so it can be searched and audited later. Specific compliance requirements such as HIPPA may require banks and finance to disable the ability to download video content and the video provider should allow you to configure this. Cloud video storage is preferred but understanding your expected data volumes and what’s included in a plan is key as even compressed video can use up lots of space.

Understand whether you are the data controller for any meeting content. Ensuring that the meeting content is covered in your organisation’s compliance processes (such as GDPR data subject access requests) is important when implementing a video platform. The major video conferencing providers have well defined policies around their processing and is a good reason to choose them over smaller entrants to the market.

A full service platform that performs automatic transcription, stores recordings to the cloud, and has a good set of eDiscovery tooling for searching both attendees and contents of recordings, is invaluable especially for auditing. Such a platform reduces the number of places that your data can be stored and reduces the number of individual policies that need to be maintained, so combining your video conferencing with your data storage and office tooling can make a lot of sense.

However, the increased availability of video brings opportunities as well as risks. Recording and making available meetings and training sessions for employees can enhance learning and development as well as improve key processes like employee onboarding or mandatory training – which may need to be done differently within a Covid-19 restricted workplace.

So, embrace the benefits of video conferencing for your business, customers and clients but just remember to ensure its secure and compliant at all times, with efficient data storage and access should your finance firm be audited any time soon.

Technology

Entersekt provides clarity on Secure Remote Commerce authentication techniques for financial institutions

Published

on


Entersekt provides clarity on Secure Remote Commerce authentication techniques for financial institutions 2

New whitepaper from Mercator available: Revisiting Authentication in the Age of SRC and EMV 3-D Secure

Is it time for a new authentication strategy in light of international mandates for Secure Remote Commerce (SRC) and EMV 3-D Secure? This is the question posed to financial institutions (FIs) in a new Mercator Advisory Group whitepaper entitled Revisiting Authentication in the Age of SRC and EMV 3-D Secure.

The paper, licensed by Entersekt for public distribution, delves into the role SRC and EMV 3-D Secure will play in the European Union’s Strong Customer Authentication (SCA) requirements under the revised Payment Services Directive (PSD2). It finds that now would be the ideal time for FIs to rethink customer authentication strategies, particularly with the deadline for full SCA compliance approaching on the 1st of January 2021.

“Consumers face an increasingly complex authentication landscape, which can vary greatly depending on the communication channels they use,” said Frans Labuschagne, UK&I country manager at Entersekt. “Multiple authentication techniques create unwanted friction and uncertainty. This paper gives actionable advice to FIs that need to keep security top of mind while also providing a good user experience.”

All card issuers competing for top of wallet will find useful insights in this whitepaper, which states that, “Since it is well recognised that convenience is critical to consumer adoption, it is time for financial institutions to rein in the multiplicity of authentication methods they use to identify account holders and even employees.”

Some of the key findings include:

  • The lack of an integrated solution results in an inconsistent user interface.
  • Inconsistency not only detracts from a customer’s experience but is likely to disrupt any cross-channel implementation plans an organisation might have.
  • A customer who is presented with the same authentication technique for every interaction becomes more familiar with that technique.
  • The authentication technique should be implemented on a smartphone, which 89% of UK residents between 16 and 75 already have.
  • Consumers increasingly trust smartphone-based biometrics and are growing accustomed to using smart speakers for a range of use cases.

 

To download the whitepaper in full, please visit: https://www.entersekt.com/resources/white-papers/revisiting-authentication-src-3ds

 

This is a Sponsored Feature

Continue Reading

Technology

Using AI to identify public sector fraud

Published

on

Using AI to identify public sector fraud 3

When it comes to audits in the public sector, both accountability and transparency are essential. Not only is the public sector under increasing scrutiny to provide assurance that finances are being managed appropriately, but it is also vital to be able to give early warnings of financial pressures or failures. Right now, given the huge value of funds flowing from the public purse into the hands of individuals and companies due to COVID measures, renewed focus on audit is essential to ensure that these funds are used for the purposes intended by parliament.

As Rachel Kirkham, former Head of Data Analytics Research at the UK National Audit Office and now Director of AI Solutions at MindBridge, discusses, introducing AI to identify and rectify potential problems before they become an issue is a key way for public sector organisations and bodies to ensure public funds are being administered efficiently, effectively and economically.

Crime Wave

The National Crime Agency has warned repeatedly that criminals are seeking to capitalise on the Covid crisis and the latest warnings suggest that coronavirus-related fraud could end up costing the taxpayer £4bn. From the rise in company registrations associated with Bounce Back loan fraud, to job retention scheme (furlough) misuse, what plans are in place for government departments to identify the scale of fraud and error and then recoup lost funds?

There is no doubt that the speed with which these schemes were deployed, when the public sector was also dealing with a fundamental shift in service delivery, created both opportunities for fraud and risk of systematic error. But six months on, while the pandemic is still creating economic challenges, the peak of the financial crisis has passed. Ongoing financial support for businesses and individuals remains important and it is now essential to learn lessons in order to both target fraudulent activity and, critically, minimise the potential loss of public funds in the future.

Timing is everything. Government has an opportunity to review the last 6 months’ performance and strengthen internal controls to ensure that further use of public funds is appropriate. Technology should play a critical role in detecting and preventing future fraud and error.

Intelligence-Led Audit

If the public sector is to move beyond the current estimates of fraudulent activity and gain real insight into both the true level of fraud and the primary areas to address, an intelligent, data-led approach will be critical. The use of Artificial Intelligence (AI) in public sector IT systems can be used to detect errors, fraud or mismanagement of funds, and enable the process changes required to prevent further issues.

HMRC is leading the way, using its extensive experience in identifying and tackling tax fraud to address the misuse of furlough – an approach that has led to many companies making use of the amnesty to repay erroneous claims. Other public sector bodies, especially smaller local authorities, are less likely to have the skills or resources in place to undertake the required analysis. If public money is to be both recouped and safeguarded in the future, it is likely that a central government initiative will be required.

Data resources are key; the government holds a vast amount of data that could be used, although this will require cross-government collaboration and co-operation. It is possible that the delivery speed of COVID-19 responses will have led to data collection gaps – an issue that will need rapid exploration and resolution. It should be a priority to take stock of existing data holdings to identify any gaps and, at the same time, use Machine Learning to identify anomalies that could reveal either fraud or systematic error.

Taking Control

In addition to identifying fraud, this insight can also feed back into claims processes providing public sector bodies with a chance to move away from retrospective review towards the use of predictive analytics to improve control. With an understanding of the key indicators of fraud, the application process can automatically raise an alert when a claim looks unusual, minimising the risk of such claims being processed.

While many public sector bodies may still feel overwhelmed, it is essential to take these steps quickly. Even at a time of crisis, good processes are important – failing to learn from the mistakes of the past few months will simply compound the problem and lead to greater misuse of public funds. The public sector, businesses, and individuals need to learn how to operate in this environment, and that requires the right people to spend time looking at the data, identifying problems and putting in place new controls. With an AI-led approach, these individuals will learn lessons about what worked and what didn’t work in this unprecedented release of public funds. And they will gain invaluable insight into the identification of fraud – something that will provide on-going benefit for all public sector bodies.

Continue Reading

Technology

Why dependency on SMS OTPs should not be the universal solution

Published

on

Why dependency on SMS OTPs should not be the universal solution 4

By Chris Stephens, Head of Banking Solutions at Callsign

In our day-to-day lives, SMS one-time passwords, also known as OTPs, have unintentionally become the default authentication factor when carrying out high risk and confidential transactions online. Banks, telcos, and businesses are opting for this method as SMS OTPs are relatively quick and simple to put in place. In our digital age, this solution works for the majority of users, who more often than not possess a mobile phone and are familiar with the user experience. As a result, companies are using them to securely authenticate both their customers and employees.

When looking into SMS OTPs, businesses should consider the bigger picture and how time- and cost-efficient solutions are as a whole by taking into account other key elements that might have been neglected in the past, such as hidden fees and security vulnerabilities. Apart from this approach, there are also other options better suited to different business needs – the European Authority (EBA) has already recognised other forms, such as employing the secure binding of a device to achieve possession and the use of behavioural biometrics as an inherence factor. For example, earlier this year Google officially began moving away from SMS OTP-based authentication. Whilst in the UK both the Financial Conduct Authority (FCA) and UK Finance have recommended banks ought to reduce their dependence on its use in the longer-term.  Whereas, in the past, financial institutions were choosing to use this solution because it enabled them to save time on becoming compliant with the PSD2 Strong Customer Authentication (SCA) regulation.

It is common knowledge that SMS OTPs are not without their flaws, and with the extended deadline for SCA for e-commerce less than a year away (September 2021) – is now the best time for the industry to look elsewhere for more intelligent approaches to authentication?

SMS as the go-to solution

Fraudsters are sophisticated criminals, who attack the weakest points in the system – they have observed that banks and businesses heavily rely on SMS OTPs for 2FA (two-factor authentication) transactions, which is why they continue to abuse and weaken existing systems and exploit these solutions for their own benefit. Fraudsters commonly practise SIM-swap – where they steal personal information about the victim and then contact the target’s mobile operator pretending that their phone has been lost or stolen. With lockdown rules constantly changing, not all customers are able to easily visit stores right now, therefore operators are dependent on mobile-authentication channels that are more susceptible to this type of manipulation to service their customers.

SIM-swap fraud can easily be done. As soon as the fraudster has duped the mobile operator, a number transfer is authorised and then activated on a new SIM card – it works by granting cybercriminals access to the victim’s number and consequently all one-time passwords and authentication codes that are sent to that number. In March 2020, Europol warned that SIM-swap scams are a growing problem across Europe, following an investigation that resulted in the arrest of 12 suspects associated with the theft of more than €3 million ($3.3 million).

However, consumers and businesses need to be aware that SIM-swap fraud is not the only method cybercriminals are deploying to intercept OTPs from their victims during the pandemic and beyond.

Spotting a scam

SIM-swap attacks are not the only method scammers are using, there is also a growing number of cases that take advantage of malware and remote access applications to steal SMS OTPs. They do this by socially engineering individuals to download remote access apps or hidden surveillance apps to grant access to the victim’s device, without coming into contact with it. The cybercriminals can, therefore, directly read their messages or secretly record all their texts and phone calls to another device. The unknowing victim’s personal messages, including OTPs, are tapped into by the fraudster using the same approach as SIM-swap attacks. However, this time they also have direct access to the target’s device.

Several different parties are involved in the delivery of OTPs and at each stage of the process there is an opportunity for fraudsters to capture  messages. There is also the potential mass compromise as a result of hidden vulnerabilities in the SS7 network and the attack surface to consider. With all these in mind, banks need to have a good overview of all data sub-processors to allow them to adopt the most suitable security controls, such as multi-factor authentication (MFA), audit logs, and dashboards.

Watch out for hidden costs

It comes as no surprise that intercepted OTPs result in fraud losses, which quickly increase as hidden fees go unnoticed over time. Beyond the upfront costs of SMS OTPs, such as cost per text, there are also several hidden costs that are difficult to budget for and avoid. They are typically the result of the domino effect of the aforementioned issues – forcing businesses into a reactive mode that is tricky to handle.

As an example, where drop-offs take place in an authentication journey, including when SMS texts are not received, financial institutions need to be ready to manage an influx in calls to their customer service helplines and the associated fees. Or else the customer may decide to use another card to make the payment, which is worse for the bank. This is due to the fact that customers are likely to abandon the use of a card when they are fed up with a customer journey that involves too much unnecessary friction. These abandonments lead to a decrease in interchange fees for banks and could even potentially reduce the customer base for merchants.

Evaluating the user experience

Whilst most consumers possess a mobile phone, SMS is not a reliable solution for everybody. For instance, SMS OTPs are not accessible to those living in remote or low-service locations, who may struggle to receive SMS alerts. This overall experience is also cumbersome as it takes roughly 30 seconds of transaction time for the text to be delivered, compared with the almost instantaneous transactions experienced by alternative authentication approaches, such as biometrics.

In this digital age, businesses are constantly adapting to accommodate different generations including Gen Z who are digital natives – so mobile use is only going to increase and, along with it, the volume of transactions taking place on these devices will also grow. This goes hand in hand with the ever-changing needs and expectations of customers as they look for hyper-personalised online experiences as the new norm. Yes, SMS OTPs are mobile-first, but they do still require the user to switch to another app to view the SMS so they can complete the transaction, which can be annoying for the customer as it interrupts the e-commerce user journey. After a friction-filled experience, it would be unsurprising if the user then decides to abandon the transaction. With this and other existing security implications in mind, the EBA recommends banks adopt other options.

Chris Stephens

Chris Stephens

Benefits of behavioural biometrics

Every person has their own unique behaviour and habits when swiping across the screen, which can be tracked through the analysis of the data signals captured from hardware sensors when the user engages with their device. These signals are crucial to designing user features such as finger movement, hand orientation, and wrist strength. Together, artificial intelligence and machine learning provide us with the capability to analyse this information to develop a personalised prototype of that user’s swipe behaviour, which only takes milliseconds to confirm whether the customer is who they say they are. This immediately allows the bank to seamlessly carry out appropriate security actions and stop fraudsters in their path before they can even begin using a target’s device.

Behavioural biometrics is ideal for positively identifying an individual and also effectively identifies bad actors. Including when cybercriminals use technologies, such as bots or remote access Trojan (RAT) software, to control transactional flows without the user being aware. This approach to biometrics works on both high- and low-end devices and helps to protect potential victims against both blind (where the fraudster has never observed how the user swipes their phone) and over-the-shoulder attacks (where the fraudster has been able to observe the victim’s swipe movements). Both forms of attack can be detected unique algorithms, with an accuracy rate of 98%; by layering in device intelligence and locational habits it is the most accurate and robust identification method currently available on the market. By preventing criminal access, even when the attacker has observed the user’s behaviour, it offers an added level of security to businesses and banks that other traditional methods, such as a PIN or password, cannot.

In order for organisations to maintain a competitive edge and successfully navigate through the pandemic, they will need to deliver hyper-personalised journeys to meet consumers’ expectations. They are increasingly looking to bank with or sign-up to services that offer a secure and bespoke service that meets their daily needs during and beyond the pandemic.

Therefore, a holistic approach to security empowers businesses to take back control of their fraud and authentication management. Unfortunately, single point solutions, like SMS OTPs, do not allow businesses to scale or provide enough flexibility to meet these requirements. By adopting a strategic, and intelligence-based, approach financial institutions and organisations will be able to upgrade security measures and enhance the user experience – whilst keeping IT spend low.

Continue Reading
Editorial & Advertiser disclosureOur website provides you with information, news, press releases, Opinion and advertorials on various financial products and services. This is not to be considered as financial advice and should be considered only for information purposes. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third party websites, affiliate sales networks, and may link to our advertising partners websites. Though we are tied up with various advertising and affiliate networks, this does not affect our analysis or opinion. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you, or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish sponsored articles or links, you may consider all articles or links hosted on our site as a partner endorsed link.

Call For Entries

Global Banking and Finance Review Awards Nominations 2020
2020 Global Banking & Finance Awards now open. Click Here

Latest Articles

Entersekt provides clarity on Secure Remote Commerce authentication techniques for financial institutions 5 Entersekt provides clarity on Secure Remote Commerce authentication techniques for financial institutions 6
Technology15 hours ago

Entersekt provides clarity on Secure Remote Commerce authentication techniques for financial institutions

New whitepaper from Mercator available: Revisiting Authentication in the Age of SRC and EMV 3-D Secure Is it time for...

Thinking Long-Term When Your Shareholders Won’t Let You 8 Thinking Long-Term When Your Shareholders Won’t Let You 9
Business16 hours ago

Thinking Long-Term When Your Shareholders Won’t Let You

By MaryLee Sachs, US CEO, Brandpie In a recent study of nearly 700 CEOs across the US and Europe, my...

Are clients truly getting value from their BR solution? 10 Are clients truly getting value from their BR solution? 11
Investing17 hours ago

Are clients truly getting value from their BR solution?

By Matt Dickens, Senior Business Development Director at Ingenious Financial planners and wealth managers strive to deliver on the needs...

New TransUnion Study Finds Smooth Digital Transactions “Essential to Business Survival” During and After Pandemic 14 New TransUnion Study Finds Smooth Digital Transactions “Essential to Business Survival” During and After Pandemic 15
Business20 hours ago

New TransUnion Study Finds Smooth Digital Transactions “Essential to Business Survival” During and After Pandemic

Economist Intelligence Unit report for TransUnion highlights the crucial role emerging technologies will play in balancing fraud prevention and customer...

How technology has made us communicate better in crisis 16 How technology has made us communicate better in crisis 17
Business22 hours ago

How technology has made us communicate better in crisis

By Pete Hanlon, CTO of Moneypenny COVID-19 has taught us a lot. We have embraced technology, some might say, survived...

Futureproofing Your Credit Management Now 18 Futureproofing Your Credit Management Now 19
Finance23 hours ago

Futureproofing Your Credit Management Now

By Marieke Saeij, CEO, Onguard The pandemic has forced a shift in day-to-day operations for the majority of businesses. In...

Will covid-19 end the dominance of the big four? 20 Will covid-19 end the dominance of the big four? 21
Top Stories1 day ago

Will covid-19 end the dominance of the big four?

By Campbell Shaw, Head of Bank Partnerships, Cardlytics Across the country, we are readjusting to refreshed restrictions on our daily...

Why cybercriminals have ‘Gone Vishing’ during the COVID-19 Pandemic 22 Why cybercriminals have ‘Gone Vishing’ during the COVID-19 Pandemic 23
Business2 days ago

Why cybercriminals have ‘Gone Vishing’ during the COVID-19 Pandemic

More than 215,000 vishing attempts in the last year alone As new coronavirus restrictions look set to confine much of...

Risk Mitigation vs. Risk Avoidance: Why FIs Need to Maintain Risk Appetite and Not Place All Bets on De-Risking 24 Risk Mitigation vs. Risk Avoidance: Why FIs Need to Maintain Risk Appetite and Not Place All Bets on De-Risking 25
Finance2 days ago

Risk Mitigation vs. Risk Avoidance: Why FIs Need to Maintain Risk Appetite and Not Place All Bets on De-Risking

De-risking aims to protect financial institutions from the increasing pressures placed by regulators and threats, associated with clients operating in...

Using AI to identify public sector fraud 26 Using AI to identify public sector fraud 27
Technology2 days ago

Using AI to identify public sector fraud

When it comes to audits in the public sector, both accountability and transparency are essential. Not only is the public...

Newsletters with Secrets & Analysis. Subscribe Now