Powered By InformationWeek Business Technology Network
 
Welcome Guest. | Log In| Register | Membership Benefits
  • Email this page E-mail this page
  • |  Print Print this page
  • |   Bookmark and Share

Product Watch: Gemalto Rolls Out Secure Online Banking On A Stick

USB thumb drive helps protect against man-in-the middle attacks

Mar 08, 2010 | 03:28 PM

By Kelly Jackson Higgins
DarkReading

Gemalto last week at RSA Conference 2010 in San Francisco unveiled a USB-based online banking application that digitally signs transactions and helps prevent man-in-the-middle attacks.

The new Ezio Plug&Sign comes with its own browser in addition to its own hardware, and it uses a smart card-based USB token that contains a digital certificate for digital signatures. The plug-and-play device is mainly aimed at commercial banking applications. "While some devices use cryptographic key exchange for authentication, we use a smart card and do certificate-based authentication and leverage digital signing of the client," says Tom Flynn, director of identity and access marketing for Gemalto.

Banks will distribute the USBs, and the browsers will automatically go to the bank's online banking site. The end user will enter a PIN via a virtual PIN pad on the screen to protect against keylogging, validating both the bank site and end user's identities. The entire session is encrypted, and the user digital signs his transaction.

The USB device can be branded by banks or e-commerce providers, according to Gemalto. Gemalto earlier this year announced its smart cards were integrated with IBM Tivoli Ready Smart Card Identity Credentials.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.


Subscribe to RSS



Database Security Reports

report You've Been Breached: Responding to a Database Compromise
Criminals are after your corporate databases, and sometimes, despite your best efforts, they get in and steal credit card numbers, personally identifiable information, proprietary business data or sensitive intellectual property. What do you do then? In this Dark Reading Tech Center report, we discuss the basics of incident response; discovering what was breached, and how; and the best way to protect your assets going forward.

report Beyond the Database: Protecting Unstructured Data
Corporate databases may be the crown jewels, but unstructured data stores contain plenty of diamonds in the rough. Organizations can be burned by an exposed spreadsheet of credit card numbers, an e-mail with patient information or a file share containing reports on a pharmaceutical company's new wonder drug. In this Dark Reading Tech Center report, we show how to classify, find and protect unstructured data across the enterprise.

report Protecting Databases from Web Applications
Most external hacks of databases occur because of flaws in Web applications that link to those databases. Yet, enterprises are increasingly exposing their most valuable data to these outward-facing interfaces. In this Dark Reading Tech Center report, we'll discuss how security teams, database administrators and application developers can work together to improve the defenses of both front-end Web applications and back-end databases to prevent these attacks from succeeding, and offer a look at the most frequent Web-borne database attacks.

Other reports from the Database Security Tech Center:

Related Content

HOWTO Secure and Audit Oracle 10g and 11g
Read the "Hardening Your Database" chapter from the 454-page book "HOWTO Secure and Audit Oracle 10g and 11g" and learn how to navigate the many security options within Oracle (authored by database security expert and Guardium CTO, Ron Ben Natan, Ph.D.)

HOWTO Monitor Database Activity
Read the "Database Activity Monitoring (DAM)" chapter from "HOWTO Secure and Audit Oracle 10g and 11g" (CRC Press, 2009) and learn how to leverage DAM to prevent cyberattacks, monitor privileged users and track access to sensitive data.

8 Steps to Holistic Database Security
Get the 8 essential best practices for a holistic approach to both safeguarding databases and achieving compliance with key regulations such as SOX, PCI-DSS, NIST 800-53 and data protection laws.

Essential Steps to Implementing Database Security and Auditing
Learn best practices and specific tips for effectively securing Oracle, SQL Server, DB2, MySQL and Sybase environments, including tracking security vulnerabilities, the anatomy of buffer overflow vulnerabilities and database auditing.

Databases at Risk: Current State of Database Security (ESG Research)
This recently published ESG report analyzes the current state of database security -- concluding it depends upon too many manual processes -- and also offers concrete steps to improve database security across the enterprise.