Forest Global Training Partners

Cyber Risks · Krebs on Security

What Is Your Bank’s Security Banking On?

Summary: Multiple U.S. banks and credit unions moved customers onto new e-banking platforms on Feb. 26, 2018, instructing them to reset passwords using static identifiers such as the first four letters of a last name plus the last four digits of an SSN, or the last six digits of an SSN. Associated Bank, Wisconsin's largest by assets at over $30 billion, emailed temporary passwords to roughly 50,000 customers (about 15 percent) before switching to US mail, and its CISO Joe Smits said the platform provider required the static-data approach.

Why it matters: The identifiers used as temporary passwords - partial SSN, date of birth, surname - are the same static data long sold cheaply in the cybercrime underground, and one regulator said the institutions seen transitioning that day were customers of Fiserv, which controls a large share of the core processing market. As one regulator put it, smaller institutions 'can't outsource accountability' - yet many accept platform defaults rather than push for random password generation.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related