Images Events Jobs Premium Services Media Kit Network Map E-mail Offers Vendor Solutions Webcasts
IT Management Webcasts:
The Role of Security in IT Service Management

Preparing for an IT Audit

More Webcasts

Search EarthWeb Network

Be a Commerce Partner
Domain registration
KVM Switch over IP
Web Hosting Directory
Corporate Gifts
Web Design
Auto Insurance Quote
Online Universities
Memory Upgrades
Imprinted Gifts
Car Donations
Disney World Tickets
KVM Switches
Online Shopping

Linked Data Planet Conference & Expo

IT Management : Columns : Executive Tech: Banks Say, 'Phishing Season Is Over'

Heroes Happen Here Launch Events
Attend the upcoming launch of three powerful new products, take a test drive, meet the teams, and leave with promotional copies of Windows Server 2008, Microsoft SQL Server 2008, and Microsoft Visual Studio 2008. Register here. »

Install What You Need with Windows Server 2008
Windows Server 2008 is Microsoft's most full-featured server operating system yet, so it's ironic that one of its most exciting new features is an install option that cuts out most of the other features. Paul Rubens explores why a Server Core installation makes a great deal of sense in many instances. »

Simplify Big Business IT for Small and Midsize Companies
Windows Small Business Server 2008 and Windows Essential Business Server 2008 deliver all-in-one solutions to help fuel growth for customers and partners. »

Q&A with Bob Muglia: Senior VP, Server and Tools Division
Bob Muglia, senior vice president, Server and Tools Division, discusses Microsoft's new interoperability principles and the steps the company is taking to increase the openness of its products. »

Q&A with Lutz Ziob, GM of Microsoft Learning
Lutz Ziob, the general manager of Microsoft Learning, talks about how IT professionals can become certified heroes within their enterprises by getting trained and certified in Windows Server 2008. »

Related Articles
Don't Get Killed by 'Spam Trap Poisoning'
Has Julian Haight Gone Straight?
Phish This, You Scum
- ITSMWatch Newsletter -
Tech Focus: Security

Cybersecurity: Laws Only Go So Far

Mozilla Firefox vs. Internet Explorer: Which is Safer?

Is Your Blog Leaking Trade Secrets?

The Las Vegas Counterfeiting Story: Is Your Privacy Worth More Than a Poker Chip?

Stopping Spammers at The Point of Sale

Product Watch
IOGEAR KVM - Includes Audio/Peripheral Sharing
Coverity Prevent / Coverity Thread Analyzer - Analyze Source Code For Defects, Security Vulnerabilities
USSD Series - SDRAM-Based Solid State Drives to 256 GB
UltraSMS - Send SMS From Your PC
Sentinel Sensors - Wi-Fi Based Temperature Monitoring Especially For Cold Storage

more products >>

Datamation Definitions
data mining
grid computing
network appliance
FREE Tech Newsletters

Download: Solaris 8 Migration Assistant Rapidly move your Solaris 8 application environments to new systems running Solaris 10 with the Solaris 8 Migration Assistant.

Banks Say, 'Phishing Season Is Over'
June 29, 2004
By Brian Livingston

Brian Livingston A little-known organization of 55 of the world's largest banks has finally become fed up enough with the online thieves known as "phishers" that the banks are doing something about it.

The group is called Identrus LLC, and it proposes that online banks use so-called digital certificates to identify themselves and their customers on the Internet. But will this by itself be enough to stop the con games?

Financial Institution or Hackers' Piggy Bank?

As I explained in my May 3 column, phishing is an international sport. High-tech criminals, many based in Asian or Eastern European countries, send out millions of e-mails that look exactly like messages from respected Western financial institutions. When end users click the links in these messages, their browsers are directed to phony Web sites that look exactly like online banks, but are designed by hackers to steal their passwords.

Wells Fargo Bank on June 8 became the first bank to announce the widespread adoption of SimpleSign, which is an Identrus solution to one part of this problem:

Banks As "Certificate Authorities." In the Identrus system, a financial institution becomes its own registration authority for digital certificates. This means it can issue such certificates for itself and also to known customers with whom it has a trusted banking relationship.

Authenticating a Banking Document. Using Adobe Acrobat version 6, the bank can create PDF (Portable Document Format) files that are "signed" with its digital signature.

Real-Time Validation. All of the above technology has been available for some time. What's new is that any copy of version 6 of the free Adobe Reader will automatically recognize a PDF file encoded with the Identrus system. Using the Internet, the Reader contacts the certificate authority online to verify that the signature in the document matches the identity of the author. The Identrus system uses worldwide standards, such as X.509 certificates and the Online Certificate Status Protocol (OCSP), so as to interoperate with as many existing banking networks as possible.

Signed, Sealed and Delivered. The receiving party can digitally "sign" the document, if it's set up with data-entry fields to do so. Once the signed PDF is sent back to the financial institution, Adobe Reader will check the authenticity of that signature online. In this way, contracts and other documents can be guaranteed to be tamper-proof without relying on mere passwords, which can be guessed or stolen.

Enormous Potential

With heavyweights such as Bank of America, Citicorp, J.P. Morgan Chase and many others supporting Identrus, the sky is the limit from here on out.

The "Identrus Global I.D." program has, so far, been used primarily to ensure the security of business-to-business financial transactions, not consumer online banking. For example, Sixt AG, one of the largest car-rental companies in Europe, uses the system to transact millions of dollars of leasing transactions annually with the Royal Bank of Scotland, entirely replacing paper documents.

But the potential of Identrus to secure the communications between banks, credit-card companies, online auction services and consumers is enormous. With proper education and implementation, end users could receive letters in PDF form from their financial institutions and be certain that the document hadn't come from a "phisher." Financial communications could be conducted in both directions with security. Any data a customer entered into a PDF form could be encrypted before transmission back to the bank, and verified against the customer's own digital certificate upon receipt.


It won't be next week or next month when we'll be able to say that phishing is obsolete and people don't have to watch out for it any more. But the technology is available to put an end to it reasonably soon — if computer users will insist on the proper tools being put into place.

An Executive Tech Update. I wrote in the May 17 installment of Executive Tech that the U.S. government's new Medicare prescription-drug Web site was a great example of how not to build a search engine for consumers.

Reader Charles J. Tarr, an attorney in Santa Rosa, Calif., writes, "A little known law in California — to which pharmacies cringe — is that if you are on Medicare, any pharmacy that accepts Medi-Cal (which is virtually every pharmacy) must sell drugs to a senior at the same price that the State of California pays, which is generally a fraction of the retail price. Not some silly 10 to 20 percent discount. Perhaps other states have such statutes."

Funny, that's one more thing I didn't see at the Medicare site. For being the first to e-mail me a tip that I printed, I'm sending Tarr a gift certificate for a book, CD, or DVD of his choice.

Brian Livingston is the editor of and the co-author of Windows Vista Secrets and 10 other books. Send story ideas to him via his contact page. To subscribe free and receive Executive Tech via e-mail, visit our signup page.

Add to your favorites
Add to your browser search box
IE 7 | Firefox 2.0 | Firefox 1.5.x
Receive news via our XML/RSS feed

Executive Tech Archives

Access FREE HP High-Availability Solutions for Exchange 2007 Tools:
Access FREE HP Server Solutions Tools:
Backup and Recovery Best Practices for Microsoft Exchange Server 2007 with HP

Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange

Optimizing HP Servers with Microsoft SQL Server 2008

Backup and Recovery Best Practices for SQL Server 2005

Configuration Best Practices for Microsoft SQL Server 2005 with HP EVA4000 and HP Blade Servers



Jupitermedia Corporation has two divisions: Jupiterimages and JupiterOnlineMedia

Jupitermedia Corporate Info

Legal Notices, Licensing, Reprints, & Permissions, Privacy Policy.

Advertise | Newsletters | Tech Jobs | Shopping | E-mail Offers

Whitepapers and eBooks
Microsoft Article: Will Hyper-V Make VMware This Decade's Netscape?
Microsoft Article: 7.0, Microsoft's Lucky Version?
Microsoft Article: Hyper-V--The Killer Feature in Windows Server 2008
Avaya Article: How to Feed Data into the Avaya Event Processor
Microsoft Article: Install What You Need with Windows Server 2008
HP eBook: Putting the Green into IT
Whitepaper: HP Integrated Citrix XenServer for HP ProLiant Servers
Intel Go Parallel Portal: Interview with C++ Guru Herb Sutter, Part 1
Intel Go Parallel Portal: Interview with C++ Guru Herb Sutter, Part 2--The Future of Concurrency
Avaya Article: Setting Up a SIP A/S Development Environment
IBM Article: How Cool Is Your Data Center?
Microsoft Article: Managing Virtual Machines with Microsoft System Center
HP eBook: Storage Networking , Part 1
Microsoft Article: Solving Data Center Complexity with Microsoft System Center Configuration Manager 2007
Intel Video: Are Multi-core Processors Here to Stay?
On-Demand Webcast: Five Virtualization Trends to Watch
HP Video: Page Cost Calculator
Intel Video: APIs for Parallel Programming
HP Webcast: Storage Is Changing Fast - Be Ready or Be Left Behind
Microsoft Silverlight Video: Creating Fading Controls with Expression Design and Expression Blend 2
Downloads and eKits
Sun Download: Solaris 8 Migration Assistant
Sybase Download: SQL Anywhere Developer Edition
Red Gate Download: SQL Backup Pro and free DBA Best Practices eBook
Red Gate Download: SQL Compare Pro 6
Iron Speed Designer Application Generator
Tutorials and Demos
How-to-Article: Preparing for Hyper-Threading Technology and Dual Core Technology
eTouch PDF: Conquering the Tyranny of E-Mail and Word Processors
IBM Article: Collaborating in the High-Performance Workplace
HP Demo: StorageWorks EVA4400
Intel Featured Algorhythm: Intel Threading Building Blocks--The Pipeline Class
Microsoft How-to Article: Get Going with Silverlight and Windows Live