The Field Report
There are 18,000 banking institutions in the U.S., and somebody has to blog about their breaches, concerns and security successes.

February 3, 2010 - Linda McGlasson
Comments (2) Read All Posts (93)The reality, it seems for the majority of us, isn't even close to what I described above. And frankly, I'm not exactly shocked by the news. Why? Let's face it: Passwords are a pain. Yes. There, I said what everyone has thought at least once after being locked out of an account they desperately needed to get into, and the help desk can't help you out with a speedy reset. The other problem with passwords is, well, the people who are charged with creating them.
The newest research ... shows the "stare in your face fact" that '123456' is most popular |
Imperva studied the strength of the passwords that were posted by the attacker online after the hack and found that consumers still aren't taking strong password creation to heart.
Some of the facts Imperva released: 30 percent of all users had passwords of six characters or less, and 60 percent had passwords selected from a limited set of alphanumeric characters.
Nearly half of the passwords used names, slang terms, dictionary words, or passwords with consecutive digits or from adjacent keys, the study showed.
Here's some even more bad news when it comes to passwords: Another study by security firm Trusteer shows that a large majority of online banking customers use their login credentials to access other websites, sharply increasing risk of attack to their bank account.
The British-based security firm says some 73 percent of Internet bank clients share online banking password with non-financial sites, and 47 percent re-use both their online banking user name and password. The numbers are based on a sample of 4 million users.
The firm's CTO, Amit Klein, says, "Our findings were very surprising and reveal that consumers are not aware, or are choosing to ignore, the security implications of reusing their banking credentials on multiple websites."
My advice? If you haven't already, please require your online banking customers to have passwords with multiple alphanumeric (symbols included), and require them to be at least 8 digits -- minimum. Also, changing passwords regularly is a must. Requiring online banking customers to change their passwords every 30 days may seem at first a bit harsh, but based on the above described research, your savings alone on the fraud that you stop will be a reward that you can live with. Here's some advice I penned a while back that can be helpful in creating strong passwords.
Good luck, and remind your customers NOT to recycle their passwords by using the same one on different applications or websites -- especially the ones they use to get onto your online banking portal.


The Electronic Funds Transfer (EFT) Act - Regulation E..Next Topic
The Electronic Funds Transfer (EFT) Act - Regulation E..Next Topic
DoJ: Report to Congress on Implementation of Section 1001 of the USA PATRIOT Act..Next Topic
FFIEC Issues 2009 Mortgage Fraud White Paper:The Detection and Deterrence of Mortgage..Next Topic
FDIC: Fraudulent Work-at-Home Funds Transfer Agent Schemes..Next Topic
Joint Statement by Education Secretary Duncan, Homeland Security Secretary Napolitano and..Next Topic
Obama's Cyberspace Policy Review: Assuring a Trusted and Resilient Information and..Next Topic
Obama's Cyberspace Policy Review: Assuring a Trusted and Resilient Information and..Next Topic
NIST: PIV Card Application and Middleware Interface Test Guidelines, SP800-85A-1..Next Topic