Biometrics in Credit Unions: Reduce IT Security Risk while Improving Productivity

DigitalPersona
February 26, 2009 | COMMENTS

Industry scrutiny increases daily in light of the sub-prime lending crisis. Regulators, shareholders, and members seek more transparency. Management seeks operating cost reductions. IT must ensure financial information integrity and personal information privacy while providing fast access to this information. All it takes to compromise this information flow is a single person with the wrong privileges and intent.

Eliminate Costs

Though most employees try to properly manage their identity credentials by creat­ing secure passwords and hiding them from others, these conscientious users still often forget their password, generating support calls to the help desk.

In addition, credit unions are subject to regulatory and corporate mandates that require data to be secured. Failure to comply with these regulations can result in significant financial and legal consequences and costs.

The Solution

Biometrics, fingerprint in particular, provide a solution that links users to specific actions allowing credit unions to know for sure who is accessing what, where, and when. This unique combination of accountability with simplicity improves information security and IT compliance while paying for itself with increased business efficiencies and user productivity. Credit unions are using fingerprint biometrics to:

• Increase security with simplicity
• Increase information security with simplified user access to network resources
• Improve operations and productivity by 1) providing fast access to workstations by eliminating the need to remember passwords or PINs and 2) c entralizing management of identity-security policies for lower operating costs
• Comply with IT security regulations, mandates, and policies
• Comply with identity security reporting requirements for NCUA, GLBA, SOX, PCI-DSS, ISO17799/27001, and other privacy regulations

Why Credit Unions Deploy Fingerprint Identity Solutions

Credit unions throughout the United States are deploying fingerprint identity solutions to eliminate password resets, simplify access to applications and websites, meet auditor demands, and increase network security. Honda Federal Credit Union uses fingerprint authentication in its California, Ohio, South Carolina, and Alabama locations to pro­vide employees with access to over 30 different websites and applications. By replacing the manual entry of passwords with the touch of a finger to a fingerprint reader, help desk calls have dropped from about 20 a day to almost none, saving time and money.

Identity Security Controls Assist with Compliance Regulations

Fingerprint authentication provides credit unions with fundamental identity security controls for GLBA, SOX 404, and PCI DSS that employees like to use:

• Strong passwords. From GBLA Technical Guidelines: “Use password activated screensavers; use strong passwords that change periodically; prevent passwords from being written down.” From SOX404 audit guidelines: “Ensure no one except financial officers, auditors, and executives have access to the data.” From PCI DSS Requirement 8.1: “Identify all users with a unique user name before allowing them to access system components or cardholder data.” And “8.5 Ensure proper user authentication and password management for non-consumer users and administrators on all system compo­nents.”
• Secure communications. From GLBA Technical Guidelines: “Encrypt sensitive customer informa­tion transmitted electronically.”
• Multi-factor authentication. PCI DSS: Requirement 8.2: “In addition to assigning a unique ID, employ at least one of the following methods to authenticate all users: Password, Token devices, or Biometrics.” “8.5.16 Authenticate all access to any database containing cardholder data. This includes access by applications, administrators, and all other users.”
• Transaction proof-of-presence. While not called out explicitly by auditors today, the intent of many regulations pro­motes extending security down to the transaction-level where possible. As requirements for transaction-level proof emerge, DigitalPersona is ready to provide the solution today.

DigitalPersona provides fingerprint identity solutions for consumers, enterprises, and custom application developers. Call 650-474-4000 or e-mail info@digitalpersona.com for more information.