N G H I E N C O U • T R A O O O I
4 chien iifcJc quan trpng trong an ninh ngan hang di ddng
Quy Tai, Thanh Thuy - Mpe vien Ngan hang, Houg Minh - Ngan hang Ddng A
Hien nay, cac dich vu ngan hang tren di dong (Mobile Banking) dang rat phd bien tai cac nUdc phat trien. 0 My, theo nghien cifu vao thang 3 nam 2012 cua Cue dutrff lien bang (FED) cif 5 ngUdi thi CO mpt ngudi sCf dung dien thoai di dpng de truy cap vao cac thong tin tai chinh. Den nam 2013 ky vong se CO khoang 1/3 so ngifdi sif dung cac djch vu ngan hang tren di dpng. Tai Viet Nam thi mdi chi bk dSu lam quen siji dung Mobile Banking, nhung do lai la mpt xu the tat yeu, va chung ta cung phai ludng trudc duoc nhiing rui ro khi sif dung cac dich vu Mobile Banking nay.
Theo nghien eUu nam 2012 ciia Javelin Strategy & Research, 1/3 chu sd hffu cua nhOng chiec dien thoai thdng mmh (smartphone) la nan nhan ciia nhffng vu gia mao danh tinh. Nguyen nhan chinh cua nhffng vu nay phai k l den la su bat d n ciia chinh nhffng ngudi sCf dung dien thoai, hp da sif dung eac phin mIm Idi thdi, khong sCf dung mat khiu khoa man hinh, thim chi ghi chep cac mat khau quan trong trong nhung tip tin van ban don gian hay nhffng ghi chu rat d l dang b| phat hien.
Nham dam bao dich vg ngan hang tren di dong dupc thdng sudt va an toan, he thdng cac ngan hang can duoc trang bi nhung cdng cu de cd till phIt hien duoc nhOng hoat ddng bat tiiudng va ca nhung gian lan, mao danh cd the xay ra NgUdi dung cudi - khach hang eung d n duoe trang bj nhffng kT nang, phirong phap de dam bao dupe an ninh khi thuc hien cle giao d|ch tren ngan hang di ddng.
Dudi diy la 4 chien luoc tdng the de dam bao an nmh di ddng:
1. Chimg thuc rui ro cd so (Risk-Based Authentication}
Cle ngan hIng eIn phan hdi khac nhau vdi nhffng yeu cau tU xa eua khach hang dUa tren mifc dd rui ro eua giao dieh dd. Thdng thudng, nhffng giao dieh cd nguy co rui ro thip thi cd the duoc chip nhan • ngay trong khi nhffng giao djch khdng dien hinh, cd nguy eo rui ro eao thi cin phai dUpc xae nhin vdi khach hang thdng qua nhilu kenh khac (nhu dipn thoai hay email). Day ehinh ia Jfli ieh ciia chUng thuc rui ro CO sd (Risk-based authentication - RBA) - nln tang an ninh ctJa cac td chUe tai chinh hien dai.
RBA duoc thue hien dpe lip ben ngoai eac dich vg tai chinh, day II mdt hudng tiep d n bao vg theo nhieu Idp ma khdng ddi hdi nhilu ve Ung dgng hay thiet bi. ChUng thuc da yeu td bao gdm cac tiilnh phin:
- Nhffng gi ban bidt {something you know): chang han mat khau - Nhffng gi ban ed (something you have): nhu tiiilt bi sinh mat khau
diing mpt lan (one-time password).
- Nhffng gi ban sd hDU (something you are): ching han nhu van tay, mdng mit...
RBA cd thi duoc xem nhuthanh phin thUtucuachUng thuc da yeu td bang d e h nhan biet ban chat cua hanh ddng viec khach hang dang thuc hi&n. RBA cd the duoc tnen khai d cac may ATM, dien thoai di ddng... neu he thdng ngan hang Idi du sUe dap Ung dUpc eac kha nang ve phan tich eac riii ro.
2. (ilng dung tren dl dong: Ang dung thong minh, cai dat don gian
Hien nay nhffng phuong thUc tiep can cu (nhUtin nhan SMS, trinh duyet WAP..,) vin duoc si^f dung tUOng ddi rdng rai. Tuy nhi^n, nhiJng phuong thUc nay cd nhffng han che nhat dinh. Tin nhan SMS chi cd thi cung d p cac djch vu mobile banking han che, do che do giao tiep khdng ddng bd va gidi han sd lupng ki tU tren mdi tin nhan. Theo dd, tin nhan SMS sCf dgng tdt nhat cho cic yeu ciu nhu tiuy van sd du (theo Fed truy van sd dU la dich vg dUOc si!f dung pho bien nh^t tren mobile banking), tim may ATM gin nhat. Hien nay, mdt sd ngan hang v l td ehUc tin dgng Idn vin cung d p djch vu mobile banking thdng qua trinh duyet WAP. Van de ehinh ciia viec sif dung frinh duyet WAP la mUc dd bao mit phu thude do an toan eua loai mang dtJ^c SLf dung. Neu siS dgng mang ciia nha cung d p djch vu di dpng ttu
1 0 • TAP CHi TIN HOC NGAN HANG « s 6 2(134) - 3/2013
NGHIEN CUtJ - TRAO DOI
cd le diJ an toan, nhung nlu sii dung mang WiFi d l truy cap vao trang web ngin hang thdng qua mdt diem truy cap edng cdng thi rit nguy hiem bdi thdng tin ca nhin ciia ngudi diing se rat d l dang bj danh cip. Do dd, theo cae chuyen gia v l bao mpt thi khich hang khdng nen sCf dgng mang khdng an toan trong ciia hang, quan cafe, nha hang... d l truy cap thdng tin ca nhin,
Tren tiiUc te, cac ngan hang ed the kiem soat dUOc cic phien giao dich end-to-end tren cac Ung dgng di ddng ma ngUdi dung tai v l . Tuy nhien, tai v l Ung dung cung cd the gap phai nhffng rui ro, ngUdi dung hoan toan cd thi bi lUa tai v l nhffng Ung dgng gia mao Do do, ngan hang va cac to chUc tai chinh eung d n chi cho khach hang iam the nao d l tim va tai v l cac Ung dgng chinh xlc. Ldi khuyen la ban hay tdi trang web ngan hang ciia bpn rdi tai ve cac Ung dung. Khi da cai dat v l sLf dung Ung dung, d n dmh ky cap nhit de ed dUOe nhOng phien ban mdi vcfi nhffng tinh ning bao mat nang eao.
3. Mat khiu dung mgl lan [One-Tlme Passwords)
cac nha cung d p dich vg dang chiu ap Igc de phat tiiln cac ifiig dung cho t i t d eac he sinh thai di ddng. May min la hien nay viec phat tnln Ung dung cho cac nln tang di ddng da de dang hon trUdc nhilu, Ung dung ed the viet eho nhieu nln tang khic nhau vdi mdt sd dilu chinh nhd, tuy nhien vin cin dilu chinh bao mat cho mdi nln tang Thuc te ia trang web cua cic ngin hang thudng tao ra cac the nhan dang thiet bi duy nhit eho mdi miy tinh khi truy cap vao trang web, bang each nay, trang web cd the phat hien xem khach hang dang truy cap vao trang web bing mdt may tinh da duoe nhan dang hay chua?
Tuy nhien, tren cac thiet bi chay lOS cua Apple se rat khd d l tao ra mot ma dmh danh thiet bi do sU thieu ving Flash, bdi trinh duyet va he cfilu hanh se khdng eho phep tiuy cap sau vao iOS (nhudd phan giai man hinh, Ung dung da cai dat, font chff, mui gid va nhffng thU da bl an di). "iPhone an toan hdn, nhung that dau diu khi mudn phat trien mpt "dau van tay" cho thiet bj nay".
Mat khiu diing mdt lin cung d p cho ngUdi si!f dung mdt ml duy nhit thdng bao cho ngin hang biet dd chinh la ngUdi dimg chU khdng phai II ke trom lay d p mat khau.
Mat khau diing mdt lin la mdt lUa chon tdt eho ngUdi diing. Ching han, neu khach hang dang thuc hien mdt giao dich nao dd cd kha nang riii ro tren mdt trang web cua ngan hang (nhu chuyen tiln, thanh toan..,) thi cd thi se bi ngimg lai cho den khi nhap vao mot ml dac biet duoc gffi tdi khich hang qua email hay dien thoai di ddng.
Nguyen tac phin phdi mat khau mdt lin la mat khau nay phai dUOc cung d p tren nhieu kenh khac nhau. Tuy nhien, nguyen tac nay se b| vi phpm trong trudng hop ngUdi diing sff dgng dipn thoai thdng minh d l vUa nhan cude goi thoai, tin nhan SMS, email, duyet web va truy cap vao cac dich vu ngan hang. Do dd, neu dien thoai thdng mmh da bi xam pham tiii mat khiu mdt lin cung cd the bi chan trong phien giao dieh vdi ngin hIng. Tai My, dot vdi eac khach hang Idn, ngan hang cd the phan phdi cac thiet bi ed kha nang tao ra mat khau mpt lin (nhu the thdng mmh, token),
4.Diuvantavcholhi^lb!
Hien nay, tiong mdi trudng c^nh tranh khdc lipt, cac ngan hang va
Nguoc lai, cac he sinh thai Android cho phep Flash do do hd trp nhan dang thilt bi. Nhung tien Android lai cd qui it cae ehinh sich han che vdi cac Ung dung, va chinh dac tinh "md" cua he dilu hanh nay la mieng mdi ngon cho cac phin mIm ddc hai, Tai tiidi diem nay, Apple cd mdt mdi trudng an toan hdn nhung dieu dd khdng cd nghTa la iPhone miln dich vdi phin mIm ddc hai (mmh chUng la t i t d cac phien ban iPhone diu da bi be khoa),
Vl phia cac ngan hang, se la ly tudng khi ap dung t i t d cac chien lupc bao mat tren khi tnen khai cae d|ch vu mobile banking. Tuy nhien, tren thuc t l dieu dd la khd kha thi fadi ngudn luc tai chinh, nhan lue, thdi gian la cd han. Mdt sd ngan hang cd the dpt cUde vao ehien luoc chUng thuc dUa tren riii ro vdi muc dich dua Ung dung ngan hang dien thoai di ddng tren tat ca eac thiet bi elm tay tren th|
trudng; mot sd khae thi cd the quyet dmh dat cupc vao nln tang he dilu hanh va kha nang bao mat ciia he dilu hinh dd; tham chi ed ngan hang lai ap dgng nhffng edng nghe cua ti/dng lai nhu edng nghe sinh trie hoc tren cic thilt bi tien tien nhat tren thj trudng, Va cudi ciing, dilu quan trong ddi vdi cac ngin hang la hay cham rai va ehpn iua khdn ngoan •
TAP CHI TIN HOC NGAN HANG • s 6 2
