What might look like a typical thumb drive to members of Northern Lights Federal Credit Union may actually be what regulators consider a top-tier secure and compliant way to access the Internet for online banking and shopping.
IronKey, a data and online security management provider, is offering that backing for its IronKey Trusted Access for Banking solution. Rather than storage, the firm said the device houses a secured, virtualized operating system and Web browser in a read-only format that thwarts known and first-day attacks that often go undetected on users’ computers until long after the damage is done.
“We really wanted to be able to provide a value-added service, not just securing our home banking. With this, our members can feel confident that they can go out to their favorite sites, like L.L. Bean or Cabela’s, and are using an enclosed tunnel of connectivity,” said Rita St. Arnauld, CEO of the $17 million, 3,500-member Northern Lights FCU in St. Johnsbury, Vt.
The device also meets the new Federal Financial Institutions Examination Council guidance issued in recent weeks, according to Northern Lights. One of the layered measures now recommended is the use of Universal Serial Bus or USB devices which “enable a secure link between the customer’s PC and the financial institution independent of the PC’s operating system and application software,” the FFIEC document said.
“You also hear recommended that you bank online only using a PC dedicated just for that purpose, but that really isn’t very practical for most people,” said Kevin Bocek, director of product marketing for IronKey in Sunnyvale, Calif.
Bocek said about 40 financial institutions are using the Trusted Access devices and that Northern Lights is one of the first credit unions.
The devices go beyond protecting online banking sessions. They also provide a customizable white list of e-commerce sites. In this case, companies popular with the Vermont credit union’s members that can be accessed with the same level of security, IronKey and Northern Lights said.
St. Arnauld is working with John Revilla, CEO of Credit Union Service Alliance Group, in Langdon, N.H., on the project. CUSAG specialties include compliance, risk-based lending and marketing, Revilla said. He and his client are now in the process of preparing a formal launch.
“We’re designing the campaign now, but a number of their [credit union] board and other members are aware the product is about to be launched and they’re already actively asking for it,” Revilla said.
Pricing hasn’t been determined.
“There’s the old marketing adage that people won’t perceive the value of something if it’s free. We’re discussing that and working to get a feel for what the comfort level would be,” Revilla said. “Probably a recurring monthly fee of somewhere south of $10.”
St. Arnauld said the device will be optional and members can choose to continue to use the standard password and-PIN dual authentication they’re using now to access their credit union’s CMC FLEX transaction and online banking systems.
She also said she can’t predict the level of adoption, but added, “Based on what I’m hearing from the people I’ve talked to, I think we’ll have a very good penetration rate, because people really want to protect their information now as much as possible.”
Revilla agreed and said he expects the ability to secure Internet banking in general and the white listing of favored online merchants to be a selling tool to Gen X and Gen Y consumers.
“This can serve as a differentiator to groups that have been hard for credit unions to reach,” Revilla said. “They’re Internet-savvy and they want to use the channels that also happen to be the least costly to provide – home banking, e-statements and debit cards.”
Revilla argued that the devices can, in fact, help drive debit card usage, a trait growing in desirability in the face of Durbin Amendment regulatory changes, by ensuring safety of the online transactions with those favored merchants.
St. Arnauld, meanwhile, said she liked being able to tell members that the devices allow her small credit union to offer a level of security approved by NACHA – The Electronics Payment Association and the FBI, among others. It also shows a proactive stance and the ability for Northern Lights to provide services that compete with major banks, she added.
“Being first to market in your area is important,” St. Arnauld noted. “We’re also going to be rolling out mobile banking within the next couple months, and being able to show your members that you care about them and that you can safely and easily do business with us no matter where you live now, will help us remain their primary financial institution. And it speaks volumes about us.”