David Smyth of Brooks, Pierce, McLendon, Humphrey & Leonard, LLP writes:
When I was at the SEC and online broker-dealers’ customers were the victims of hacking incidents, I used to wonder, why don’t the broker-dealers require multi-factor authentication to gain access to accounts? It was a silly question. I knew the answer. Multi-factor authentication is a pain and nobody likes it.
[…]
But here comes Ben Lawsky, the Superintendent of New York’s Department of Financial Services, who just unveiled a number of proposals to increase cybersecurity at banks under his jurisdiction. One of these is to require that banks use multi-factor authentication. This move could take a lot of the economic pressure off banks that would otherwise like to implement this control for its customers, but have been unwilling to do so for fear of losing those customers to rivals. If everybody has to do it, there’s not a lot of fear from imposing it unilaterally.
Read more on National Law Review.
This guy is way behind the curve. FFIEC regulations already require banks to utilize multi-factor authentication. He is just trying to make himself seem like a cyber superhero…….which he is not. The regulation was issued JUNE 2011.
Summary: The FDIC, with the other FFIEC agencies, has issued the attached guidance, which describes
updated supervisory expectations regarding customer authentication, layered security, and other controls in
an increasingly hostile online environment. Financial institutions will be expected to comply with the guidance
no later than January 1, 2012.
This FFIEC guidance supplements the FDIC’s
supervisory expectations regarding customer
authentication, layered security, and other controls in
an increasingly hostile online environment.
The FDIC expects institutions to upgrade their controls
for high-risk online transactions through:
o Yearly risk assessments;
o For consumer accounts, layered security
controls;
o For business accounts, layered security
controls consistent with the increased level of
risk posed by business accounts; and
o More active consumer awareness and
education efforts.
Layered security controls should include processes to
detect and respond to suspicious or anomalous
activity and, for business accounts, administrative
controls.
Certain types of device identification and challenge
questions should no longer be considered effective
controls.