RSA changes tack on two-factor authentication

Two-factor alone is no longer enough

Iain Thomson at Infosecurity Europe 2007, vnunet.com 24 Apr 2007

RSA Security, one of the main proponents of two-factor authentication, is morphing into a full service security company because of the changing nature of internet crime.

Andrew Moloney, director of financial services at RSA, told vnunet.com at the Infosecurity Europe 2007 conference in London that security firms must adapt their offerings to cope with evolving threats.

"Two years ago RSA would have been telling you that two-factor is the whole solution," he said.

"But we are facing a changing threat landscape. Now you should use two-factor, but take into account other means to stop the criminals."

Moloney added that, in the past year or so, the company had been offering more managed services to back-up existing products.

Moloney cited RSA's anti-phishing campaign that has seen over 32,000 phishing sites shut down, over half of those in the past 12 months.

"Shutting down these sites is key, and a specialised task. If we know we have the mobile phone number of a Shanghai ISP's manager, for example, we can shut down sites very quickly," he continued.

"We have built personal relationships with these guys so it is a lot easier to clear away bogus sites."

Two-factor authentication still has a role, not least in restoring consumer confidence in web transactions.

Moloney cited Italian bank Unicredit, which sold two-factor tokens to its customers for €5 a month, but credited that back to the customer if they used the technology.

The bank saw the use of online banking, which had been static, rise over 20 per cent.

Similarly in the UK, when Alliance and Leicester introduced stronger authentication for online customers activity increased 25 per cent, giving them a £1m cost saving in nine months.

See also: