Mobile Banking growth an Analysis

As mobile device technology evolves from being device driven to consumer driven, we are witnessing a corresponding shift in the consumer’s outlook towards the usage of mobile devices.

In the earlier days, the consumer would feel overawed by the impact of technology and could be easily satisfied with the simple promise of convenience. Today’s consumer, exposed to unprecedented levels of information and awareness, is becoming more and more demanding by the day. The average mobile device user is not swayed by the bundle of services being offered on his device; he now expects service providers to push the envelope continuously, leading to the age of consumer led innovation. The evolution of mobile device technology and the consumer’s expectations has had a significant impact on the banking industry.

With non-banking players venturing into the realm of mobile payments, wallets etc. The consumer is spoilt for choices. However, with the mobile payments industry still in a state of flux, ambiguities remain in terms of regulations, cross-border transactions, and most significantly, ownership of the customer. To survive the onslaught of non-traditional competitors, banks need to ramp up their capabilities to service the connected and aware consumer.

This blog studied the current trends in the mobile banking sector, placing emphasis on the disruptive innovations that are altering the global banking landscape

Over the years, mobile communications technology has evolved from being device-driven to user centric. In the past, the customer’s usage of a mobile communication device was restricted by the device’s capabilities. However, with the evolution in technology, the device no longer dictates the user experience. Instead, it is the other way round; the user’s expectations now drive the device’s capabilities. Increasing computing power, scalability of operations and the increasing interaction between the device and the user have led to innovations such as voice-activated assistants, mobile handsets with built in projectors, wireless battery chargers etc., which are continuously redefining the way we use mobile devices. The past decade or so, we have witnessed the evolution from physical identity cards and passbooks to virtual methods of establishing identity such as secret questions on telebanking, pin codes, barcodes, QR codes etc.

 As technology advances further, mobile devices will play a significant role in multi-factor authentication and authorization. Identity will be sensor driven in the age of robotics, cloud and predictive analytics. Face and voice recognition using biometric technology will enable mobile devices to replace the traditional modes of establishing identity.

Emerging technologies such as Near Field Communication (NFC), which is in vogue these days for making contactless payments, can also be used to enable devices to act as electronic identity documents. Since the technology supports encryption, it is more secure than Radio Frequency Identification (RFID) systems. Unique identity can be further extended to manage access in the form of common access devices, a concept that is already being applied for getting tickets or boarding passes at airports. Innovative applications of NFC technology include car locking mechanisms, tagging of pets, parking meters etc.

The emerging trends of Bring Your Own Device (BYOD) technology, virtual thin clients, and cloud-based network management can be applied to enable authentication even when a local network server does not manage the device.

As wearable’s become more and more prevalent, users will be able to carry their identity with them at all times. As mobile technology becomes more and more affordable and accessible, a mobile device will gradually become an extension of one’s self.

The delivery of a mobile banking service to a consumer in Indian context involves the participation of four primary players; A Bank, Mobile Network Operator (MNO), a Mobile Banking Technology Vendor and the consumer. 

In most instances the mobile banking vendor has been the pioneer in shaping industry adoption and lobbying the other two principle stakeholders on the value of extending the banking franchise to mobile.  The early pioneers of mobile transacting go back around 10 years. These initial visionaries have persisted in lobbying the banking industry over this time with little success, and where implemented, little consumer adoption. However the consumer mobile market has matured and the various stakeholders (banks and MNOs) seem to have taken an interest and realised the potential value of the high penetration in mobile phones amongst their respective customer bases. This is seen through the recurrent press coverage around new launches and new global initiatives to leverage this channel in banking. 

This is also clear when looking at the number of known, deemed successful, implementations in the world. The bank typically has a multi-channel approach to delivering transactional services to its customer base. Its channels include the traditional bricks and mortar branch, ATMs, POS and the internet. These channels have gone a long way in servicing the retail banks in delivering financial transaction volumes and assisting in extending the banks reach to its customers. 

Mobile banking represents a more cost efficient channel for the banks, allowing them to charge less for transactions, and permitting the consumer to have immediate access to information related to their bank accounts. These factors should translate into more transactions more often.

The bank’s mobile banking options include:

• Leveraging the MNO bearer channel and infrastructure to extend its payments franchise to mobile facilities as a channel
• Leveraging the MNO brand, distribution network, and extended customer base to target new market segments
• Allowing a MNO to use the bank’s financial license and/or infrastructure to become a bank.

The Mobile Network Operator (MNO) provides the mobile phone and the ability to use the mobile phone for providing banking services to the consumer. The global mobile phone market is becoming more competitive, with reducing prices, increasing customer churn, and reduction in profits. The highly competitive mobile environment is also reflected in the number of mergers and acquisitions seen in the global market and therefore the sheer size of some of the MNO multinationals. 

The MNO is increasingly focused on innovation in order to offer higher value to its customer base in an attempt to reduce customer churn, as well as a focus on new ways of generating revenue, even from sources not core to their current business.

Mobile software solution vendor has its roots in

• Developing applications or platforms to service its own commerce needs
• Developing applications as foresight to a future with the mobile phone as a banking channel   

These roots have developed into business models that enabled Maximus as application service provision (ASP) and packaged licensing of technology. In other words one can either pay for the use of the technology to a on a per transaction basis or license the system for use by internal operations.

Mobile software solution vendor as a mobile banking play an integral part in the delivery of mobile banking to the customer. The business model the mobile banking system vendor & technology provider we have the ability to do mobile banking, for a Bank, through a MNO, to a consumer.

In crux of the matter, mobile Banking solution facilitates the integration of the bank system with that of the MNO bearer channel, and provides the mobile banking platform or the mobile banking application, that enables the consumer to bank using their mobile phone.

Mobile banking is seen to be an extension of the existing payment infrastructure of a bank to mobile phones as a channel for the leveraging of the mobile network and its reach, to deliver banking services to consumers. The mobile banking infrastructure thus sits in a similar technical environment to the banks ATMs, POS, branch and internet banking service offerings. 

A bank’s core banking system, the system that houses the consumer’s account and related transaction management and history, would require a means to translate banking instructions, received from consumers, through one of the bank channels such as ATMs or the internet, into a format that the core banking system can process. This translation is normally performed by an EFT channel switch. The EFT channel switch would switch transactions from the channel to the appropriate area within the core banking system.   

A generic architecture depiction for Mobile banking solution

The mobile banking channel can be delivered to the consumer through two bearer or application environments. 

Client-side applications are applications that reside on the consumers SIM card or on their actual mobile phone device. Client-side technologies include, .Net, J2ME, etc. Server-side applications are developed on a server away from the consumer mobile phone or SIM card. Server-side technologies include USSD2, IVR, SSMS and WAP.

The bank would only need to select one of these bearer channels, or bearer channel strategies, for implementation. However, in some markets it would be wise to implement more than one bearer channel in order to manage consumer take up and the risk associated with non-take up of a specific technology. The selected bearer channel does not have an effect on where the mobile banking platform should sit.

The extension of the payment franchise to mobile can be as simple as a bank channel enablement or as complex as a complete bank system implementation depending on what infrastructure already exists, and that which can be re-used as part of the implementation

Let’s have close look at multi-layered mobile architecture 

Selecting the right technology for your market will, firstly, require some work to understand the market’s technology environment. Some key elements are:

• Who is your target market and which mobile devices do they have?
• What kind of user experience and value proposition would be sufficient/appropriate in servicing your target market?
• What are the bearer channel costs related to this transaction and is it affordable to your target market? 
• Does your target market have access to the bearer channel?
• Are you able to get the application onto your consumer’s phone or handset without requiring the consumer to have an in-depth knowledge of the technology?
• Is the bearer channel selected secure enough for the risk profile of the customer you are targeting? Is it secure enough to protect the bank from any reputation risk if security is breached? Are there sufficient means to manage the risk around the bearer channel chosen?  
• Does the channel comply with any financial processing rules and regulations relating to: the method of processing; authentication of the customer; transfer of data; and levels of encryption, yet still deliver on the business requirement?  

A bank with a single market segment that a certain bearer technology suits in regard to access; cost; and device and SIM dependency, should implement this single bearer channel and focus its efforts on consumer education and increasing usage.   

In a more complex market segment, or an unknown market environment, a multi-bearer strategy may suit. In this way you mitigate the risk of one technology not being taken up by the consumer. There are good examples of focused as well as spread bearer technology strategies.

Mobile banking is moving up on the adoption curve, which is evident in the number of implementations known in the world and the level of interest and discussion around the technology and its implementation.  It is also evident in the number of technology providers emerging in the mobile banking space.

There are several choices when considering how to implement mobile banking. These choices include whether or not to develop the technology within the bank, use a shared infrastructure, or purchase the enabling technology from one of many vendors. 

The choices also include various mobile bearer channels, suited to differing market segments and differing capabilities of consumers handsets. Each of the bearer channels has unique requirements in provisioning and securing applications, transactions and consumer data.

The selected implementation option including bearer channel, vendor and value proposition, should be driven by consumer adoption of the technology, technical capability of the handsets in the target market, affordability of the bearer channel, and the consumers ease of accessing the service.

Mobile security best practices & Attack Surface

Information security experts are fond of the certain language they use to explore and explain the security threats that companies and organizations routinely face. One particularly interesting notion from this is that of an "attack surface," which identifies a potential point of attack on one's information or financial assets, intellectual property or ability to conduct business.

Because any successful attack brings with it a chance of financial loss, legal or regulatory infractions, or damage to reputation, best practices for dealing with attack surfaces mean limiting exposure to unwanted or uninvited access, hardening them against attack and imposing what's often called "defense in depth." This requires building multiple layers of protection around valuable stuff; if one layer gets breached, the bad guys aren't automatically handed the keys to the treasure vault.

All this makes security for mobile devices both important and vexing. The more that employees and contractors use mobile devices to access organizational systems, applications and data, the more important it is to protect such access. Furthermore, it's essential to prevent the mobile devices that are supposed to boost productivity and add to the bottom line from opening unauthorized means of access to information and other assets; this turns them into a danger and a possible drain on revenue instead.

Given that mobile devices are inherently moving targets used outside the organization's perimeter - and thus also outside its firewalls, threat management, spam and content filtering, and other tools used to keep evildoers at bay - it's vital to apply a battery of best practices to use of mobile devices to keep exposure to risk and loss to a minimum. As any security expert will tell you, though, there's a fine line between enough security to keep things safe and protected and a smothering blanket of security that gets between people and the jobs they must do.

Although it's challenging and comes with some costs, the following list of mobile security best practices can help protect mobile devices and their users from unwanted exposure or unauthorized disclosure of company or organization IP, trade secrets or competitive advantages. Some of these practices aim at securing the mobile devices themselves, while others aim to protect the data and applications with which mobile users need to interact. All will help reduce risk of loss or harm to your company or organization.

Anti – Malware software: A quick look at new malware threats discovered in the wild shows that mobile operating systems such as iOS and (especially) Android are increasingly becoming targets for malware, just as Windows, MacOS, and Linux have been for years. Anybody who wants to use a mobile device to access the Internet should install and update antimalware software for his or her smartphone or tablet. This goes double for anyone who wants to use such a device for work.

Secure Mobile Communications: Most experts recommend that all mobile device communications be encrypted as a matter of course, simply because wireless communications are so easy to intercept and snoop on. Those same experts go one step further to recommend that any communications between a mobile device and a company or cloud-based system or service require use of a VPN for access to be allowed to occur. VPNs not only include strong encryption, they also provide opportunities for logging, management and strong authentication of users who wish to use a mobile device to access applications, services or remote desktops or systems.

Require Strong Authentication, Use Password Controls: Many modern mobile devices include local security options such as built-in biometrics - fingerprint scanners, facial recognition, voiceprint recognition and so forth - but even older devices will work with small, portable security tokens (or one-time passwords issued through a variety of means such as email and automated phone systems). Beyond a simple account and password, mobile devices should be used with multiple forms of authentication to make sure that possession of a mobile device doesn't automatically grant access to important information and systems.

Likewise, users should be instructed to enable and use passwords to access their mobile devices. Companies or organizations should consider whether the danger of loss and exposure means that some number of failed login attempts should cause the device to wipe its internal storage clean. (Most modern systems include an ability to remotely wipe a smartphone or tablet, but mobile device management systems can bring that capability to older devices as well.)

Control Third-party Software: Organizations that issue mobile devices to employees should establish policies to limit or block the use of third-party software. This is the best way to prevent possible compromise and security breaches resulting from intentional or drive-by installation of rogue software, replete with backdoors and "black gateways" to siphon information into the wrong hands.

For BYOD management, the safest course is to require such users to log into a remote virtual work environment. Then, the only information that goes to the mobile device is the screen output from work applications and systems; data therefore doesn't persist once the remote session ends. Since remote access invariably occurs through VPN connections, communications are secure as well - and companies can (and should) implement security policies that prevent download of files to mobile devices.

Create Separate, Secured Mobile Gateways: It's important to understand what kinds of uses, systems and applications mobile users really need to access. Directing mobile traffic through special gateways with customized firewalls and security controls in place - such as protocol and content filtering and data loss prevention tools - keeps mobile workers focused on what they can and should be doing away from the office. This also adds protection to other, more valuable assets they don't need to access on a mobile device anyway.

Choose Secure Mobile Devices, Help Users Lock Them Down: Mobile devices should be configured to avoid unsecured wireless networks, and Bluetooth should be hidden from discovery. In fact, when not in active use for headsets and headphones, Bluetooth should be disabled altogether. Prepare a recommended configuration for personal mobile devices used for work - and implement such configurations before the intended users get to work on their devices.

Perform Regular Mobile Security Audits, Penetration Testing

At least once a year, companies and organizations should hire a reputable security testing firm to audit their mobile security and conduct penetration testing on the mobile devices they use. Such firms can also help with remediation and mitigation of any issues they discover, as will sometimes be the case. Hire the pros to do unto your mobile devices what the bad guys will try to do unto you sooner or later, though, and you'll be able to protect yourself from the kinds of threats they can present.

Security, Mobile or Otherwise, Is a State of Mind : While mobile security may have its own special issues and challenges, it's all part of the security infrastructure you must put in place to protect your employees, your assets and, ultimately, your reputation and business mission. By taking appropriate steps to safeguard against loss and mitigate risks, your employees and contractors will be able to take advantage of the incredible benefits that mobile devices can bring to the workplace.

Just remember the old adage about an ounce of prevention. That way, you're not saddled with costs or slapped with legal liabilities or penalties for failing to exercise proper prudence, compliance and best practices.

Note: The attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment.

The Attack Surface of an application is:

1. The sum of all paths for data/commands into and out of the application, and
2. The code that protects these paths (including resource connection and authentication, authorization, activity logging, data validation and encoding), and
3. All valuable data used in the application, including secrets and keys, intellectual property, critical business data, personal data and PII, and
4. The code that protects these data (including encryption and checksums, access auditing, and data integrity and operational security controls).

Attack Surface targeted to be used by developers to understand and manage application security risks as they design and change an application, as well as by application security specialists doing a security risk assessment. The focus here is on protecting an application from external attack - it does not take into account attacks on the users or operators of the system (e.g. malware injection, social engineering attacks), and there is less focus on insider threats, although the principles remain the same. The internal attack surface is likely to be different to the external attack surface and some users may have a lot of access.

How to find “Attack Surface” Spend a few hours reviewing design and architecture documents from an attacker's perspective. Read through the source code and identify different points of entry/exit:

• User interface (UI) forms and fields
• HTTP headers and cookies
• APIs
• Files
• Databases
• Other local storage
• Email or other kinds of messages
• Run-time arguments
• …. [your points of entry/exit]

The total number of different attack points can easily add up into the thousands or more. To make this manageable, break the model into different types based on function, design and technology:

• Login/authentication entry points
• Admin interfaces
• Inquiries and search functions
• Data entry (CRUD) forms
• Business workflows
• Transactional interfaces/APIs
• Operational command and monitoring interfaces/APIs
• Interfaces with other applications/systems
• ... [your types]

You also need to identify the valuable data (e.g. confidential, sensitive and regulated) in the application, by interviewing developers and users of the system, and again by reviewing the source code.

Attack Surface Analysis is about mapping out what parts of a system need to be reviewed and tested for security vulnerabilities. The point of Attack Surface Analysis is to understand the risk areas in an application, to make developers and security specialists aware of what parts of the application are open to attack, to find ways of minimizing this, and to notice when and how the Attack Surface changes and what this means from a risk perspective.

Attack Surface Analysis is usually done by security architects and pen testers. But developers should understand and monitor the Attack Surface as they design and build and change a system.

Attack Surface Analysis helps you to:

1. identify what functions and what parts of the system you need to review/test for security vulnerabilities
2. identify high risk areas of code that require defense-in-depth protection - what parts of the system that you need to defend
3. identify when you have changed the attack surface and need to do some kind of threat assessment