Portland, Oregon-based secure ID and transaction solutions provider Tyfone's patented technology under the brand name of The Connected Smart CardTM (CSCTM) is currently being tested by CoVantage Credit Union. The technology will provide security for CoVantage Credit Unions' business banking members, vastly improve the security of members' passwords and secure all their mobile banking transactions.
One of the biggest cyber security threat is the threat to passwords being compromised. The inherent flaw in password systems, irrespective of static password or multi-factor one-time-password tokens, is when a user submits her password, the centralized cyber service has to instantly decipher system access or not. For this request-response to work, the centralized service has to store bulk information about all of the user's passwords within it and it is increasingly becoming a lucrative target as computation power to hack passwords has become cheaper.
According to Deloitte Consulting, 90 percent of user-generated passwords, even strong passwords, will be vulnerable to hacking this year. In a recent story, Wired reported that 280 million passwords have been compromised in the recent months.
Tyfone's CSC technology aims to curb this menace as it adds a smart card chip to any device in several convenient form factors. It enables the storage of digital certificates for a two-sided request-challenge-response to every authentication request, instead of the simple one-way request-response. This unique process allows for secure point-to-point ID authentication without bulk storage of user information in the server. All user authentication information is stored with the user in her CSC hardware. This secure point-to-point ID authentication also results in two end-points that trust each other. This trust enables an extra layer of data cryptography (using CSC) to secure transactions even through unsecure networks, e.g. public Wi-Fi.
The technology solution meets recent Federal Financial Institutions Examination Council (FFIEC) guidelines that indicate the need for layered security that goes beyond multi-factor authentication commonly in use today. A Tyfone customer since 2011, CoVantage Credit Union (with locations in North Central Wisconsin and the Upper Peninsula of Michigan) has successfully been using Tyfone's mobile money movement solutions and is now piloting CSC hardware and software transaction platform for a new level of member security without requiring biometrics that create a host of new privacy issues.
"We originally chose Tyfone as our mobile banking provider because, unlike any other vendor, their IP and know-how adds smart card based security to any device, while also supporting the emerging adoption of smart card based EMV for payments in the U.S.," said Robert Van Abel, CIO at CoVantage. "We believe Tyfone's CSC solution, coupled with the work Tyfone is doing with In-Q-Tel for the U.S. government, reflects hardware that bi-directionally secures both ID and transactions will soon be essential for all entities, not just financial services. We were concerned that CoVantage would have to sacrifice either cost or aspects of security we wanted to deploy. By choosing the Tyfone CSC solution we met all our criteria for security and convenience, on top of a low total cost of ownership."
The CoVantage/Tyfone CSC pilot will be initially based on Tyfone's SideSafeTM microSD cards for Android mobile phones. CoVantage employees and select business members will be the first to use the CSC solution. The goals for the pilot are to demystify the trade-off between security and convenience, and prove that layered security is necessary to manage specific high-value banking transactions, particularly given the significant increase in mobile device-based transactions. The pilot is being deployed on Corporate IT issued devices and will migrate to Bring Your Own Device (BYOD) and consumer devices at the end of the pilot period. Post-pilot deployments will add Tyfone's SideKeyTM key chain hidden and/or wearable devices that will work with any mobile phone, tablet or PC. Communication protocols may be NFC or Bluetooth, and commercial offerings will have a menu of form factors for institutions to choose from.
According to Mark Miyamoto, director of mobile banking at Tyfone, "Enhanced security is the natural advancement in mobile banking. Everyone, bad guys included, is aware that mobile is revolutionizing business operations in all capacities, making mobile services a natural target as mobile financial services enable more sophisticated and high-risk transactions," Mark Miyamoto, director of mobile banking at Tyfone said. "CoVantage is at the forefront of implementing this next generation of mobile device-based transactions, proactively defining the boundaries of security, risk mitigation and convenience using defined open standards to scale across all members."
