Nefarious trojans call for two-pronged strategy

Asking customers to help fighting cybercrime isn't exactly a new idea. Since many years, the public again and again gets to read some articles providing well-meant advice, usualls culminating in suggesting the use of firewalls and antivirus software that should be updated frequently.

Did this help in the past ? Only gradually, and it certainly did not defeat cybercrime. Will this help in the future ? Certainly no better than it did in the past.

Should we blame individual customers ? No, that makes not much sense. The average PC user is overwhelmed by the complexity contained in his equipment and provided by the Internet. How could you expect that a bus driver, a kindergarten nurse or a retired reverend would be able to fight sophisticated cybercrime ?

Businesses leveraging the Internet sales channel to obtain higher profits and the IT industry should work together to make that environment reasonably secure. And yes, this could be done by simply removing a lot of unnecessary complexity. Do we really need full PC functionality just to browse the Internet and to do some online transactions ? Probably not, a hardwired browser device not accepting any downloaded code (and hence, not accepting any malware) would do.

Gerhard,

Thank you for your valuable comments. I have two reactions. 

1) From a review of our research data, I'm not in agreement with the following and wonder if you would have research to strengthen your argument: "Did this help in the past ? Only gradually, and it certainly did not defeat cybercrime. Will this help in the future ? Certainly no better than it did in the past.". 

2) The role Javelin calls for in our Safety Scorecards goes well beyond simply education, firewalls and anti-virus software. Based on a US nationally-representative n=5,000 study of the latest actual identity fraud victimization patterns, each year we update a set of fifty highly-specific criteria for customer-involved safety features at either banks and credit card issuers. The features emphasize our Prevention, Detection and Resolution (TM) model to involve consumers in alerting and permissions in order to return control of finances back to the account-holder. We also look for advanced authentication, and certainly we prioritize the usability aspects of security that you make reference to (because unusable or confusing security is no security at all). Certainly the three defensive and educational capabilities you mention are build into our model, but they barely scratch the surface of what our research-based model calls for. 

Amidst increasingly-complex financial sector products, channels and technologies consumers have had steadily declining control over their financial affairs.  In the midst of this, criminals are having a field day. We must tame and use technology to restore control of accounts and identities to their rightful owners, and the solutions for this exist right now. 

No single strategem or solution will defeat cybercrime, yet I believe that financial sector firms are missing a huge opportunity by excluding the impersonated party from the battle. Our data clearly show that consumers and business owners desire to be involved in their security, suffer lower fraud amounts as their involvement increases, and even choose new financial institutions and even merchants based on who is perceived to offer the best customer-involved safety features. 

James,

thanks for your comments, and let's have a quick look at those.

1) Even without expensive research reports, it is obvious that cybercrime has been around for quite some time now, and it is on the rise and not shrinking. At this time, there is no development in sight to change this.

2) The research material and advice coming from your company Javelin is probably useful and worth its price, but has not succeeded so far in reverting the current trend. It is not very clear how this could be achieved in the future.

While consumers have been educated and the majority now can detect very simple phishing schemes, there is little they can do against sophisticated cybercrime such as malware downloads from decent but infected websites.

In my previous comment, I did suggest a potential measure (hardwired browser devices) that might help to reduce cybercrime threats. I'd be interested in any comments regarding that topic.

Gerhard, 

I completely agree with everything you've said. I'm realizing that I wasn't as clear as I should have been with my main point, so let me state it more clearly. 

If malware increasingly renders some of CISO and consumer prevention and malware-detection efforts to be useless, than consumer transaction alerts and controls matter all the more. Let's say that my computer is infected with the worst form of trojan that also happens to be undetectable to either me or my financial provider; at that point, previously-set transaction prohibitions and SMS alerts become even more vital. I should add that despite much spending on publicity, the state of today's bank-provided account controls and alerts is woeful or nonexistent. The axiom "there is no silver bullet" certainly applies to what I'm calling for, yet my issue goes even further to say that (according to our structured research) most CISOs aren't even open to consider the value of end-user account controls and alerts. In crimes of impersonation, the impersonated party must be included. 

In specific regard to your comment about hardwired browser devices, we share the view that this emerging method is vital, and that's why we incorporate them in our 50-criteria scoring model. In a world in which banking and payment web sites still allow consumers to use IE6 yet disallow the use of Google Chrome it't high time we incorporate the latest built-into-the-browser capabilities. 

Thanks again for taking the time to dialog.