The "RISKY BUSINESS" Blog

Lost in the glow of Operation Aurora was the American Bankers Association (ABA) recommendation “that small to midsized businesses only conduct online banking on dedicated work-stations”.  On first blush,  sounds like sound information security advice; so why is it that I find this so significant?

Because the banking industry  finally “gets it”. 

When the ABA (dedicated to enhancing the competitiveness of the nation's banking industry and strengthening America's economy) suddenly throws a wet blanket onto online banking we have reason to be concerned.  In short, what they are saying is that online banking is only as secure as the end-point that it is conducted on and that the viruses, spyware, Trojans and identity-stealing key-loggers that regularly infect computers are something they no longer can pretend they can control.

They finally get that HTTPS, strong passwords, and two-factor authentication can’t keep us safe from ourselves and the increasing risk posed by organized crime.

Unfortunately, the proposed solution, while it may be the best we have, is insufficient.  Even a dedicated workstation is vulnerable to malware infection, even if “safe” web practices are followed (comically, AVG just reported that I happened upon a malware loading site following  a link on organized crime and online banking while researching this post).  What we need is a trusted, fully immutable, computing device – I have to think someone really smart is working on this right now.

In the meantime, I’m not worried enough to give up on online banking.  However, I won’t do it from a windows machine any longer.  Right now, I’m only using my iMac, but plan on moving to either a dedicated Ubuntu machine or a bootable USB Linux. 

I thought this blog post on “more secure” options for online banking was well done.