KAS BANK Secures High-Value Transactions with Smart Banking ID
The Netherlands-based KAS BANK N.V., regularly handles cash transactions ranging up to 25 million Euros and security transactions worth billions. Needless to say, the 200 year old supplier of investment management, custody, clearing and settlement services is well aware of the growing security risks associated with high-value online transactions. This led to KAS BANK’s ultimate selection of the ActivIdentity Smart Banking ID solution to provide the highest level of security while meeting customer demands for usability and convenience.
Challenge
As banks offer more high-value services online it should come as no surprise that the number and intensity of online attacks continues to grow. The challenge for KAS BANK and all other banks is to economically deploy solutions that balance increased security with customer convenience and that promise to defend against future generations of attacks.
Initial Solution
As a leading user of SWIFT (Society for World-wide Interbank Financial Telecommunications) for bank-to-bank interactions, KAS BANK looked first to SWIFTNet to secure its end customer transactions, including those with institutional investors such as pension funds and insurance companies. KAS BANK soon realized however, that SWIFTNet had some disadvantages for end customer-based transactions.
The cost of SWIFTNet proved quite prohibitive. The complex infrastructure was also a burden for KAS BANK and clients as transfers had to be made from dedicated terminals with special network connections and multiple Hardware Security Module (HSM) servers.
Johan van der Wal
Client Information Management
KAS BANK
“ActivIdentity offered a perfect solution and a good investment in the future because it delivered the highest level of security available with a reusable infrastructure.”
KAS BANK’s customers found the SWIFTNet system inconvenient compared with other Internet-based solutions. Moreover, SWIFT required these customers to endure extensive legal and security audit hurdles. Usability was a major concern as users had to physically get up from their desk and walk to a dedicated SWIFTNet terminal. In the end, KAS BANK customers were clamoring for a more cost-effective, user-friendly solution that would secure transfers over the Internet from their users’ PCs rather than dedicated terminals.
Finding a Better Solution
To satisfy their customers’ demands and reduce operating costs, KAS BANK began evaluating alternatives in late 2004. Through Q&I Nederland BV, KAS BANK learned about ActivIdentity, Inc. which offered a PKI-based smart card solution. The ActivIdentity Smart Banking ID solution uses asymmetric technology that ensures non-repudiation of all customer transactions.
“Our management felt ActivIdentity offered a perfect solution and a good investment in the future because it delivered the highest level of security available with a reusable infrastructure,” says Johan van der Wal, head of Client Information Management at KAS BANK.
“As the market leader, ActivIdentity gave us a feeling that they were the right partner.” ActivIdentity offered a total solution and could demonstrate the experience and knowledge of its Professional Services team through similar project deployments including a multi-million user deployment at the U.S. Department of Defense.
Customer convenience would dramatically increase as well with the ActivIdentity solution as it allowed users to process transactions from their own desktop and utilized a familiar KAS BANK user interface.
Johan van der Wal
Client Information Management
KAS BANK
“We would like to use this solution for all communications with the client. That includes web applications, file transfers, and eventually remote access by clients onto certain parts of our systems.”
KAS BANK also investigated token-based, symmetric key solutions from vendors such as RSA, a division of EMC. However, the Bank was concerned that the token technology could not achieve non-repudiation of transactions because the same password was used to encrypt and decrypt transaction data. The RSA solution offered no guarantee that the key had not been known by an external third party, creating a risk that the Bank was sufficiently concerned about.
“Had we chosen the token-based solution, regulators might have come back to us in two or three years and we would have to change—and lose that investment,” says van der Wal.
Using the ActivIdentity Solution
The heart of the ActivIdentity Smart Banking ID solution is the ActivID™ Card Management System (CMS) which is used to issue and manage the smart cards. The cards are certified to military-grade, providing a very high level of security.
The process for issuing cards begins when KAS BANK sends blank smart cards to their customers. Security officers within customer organizations are responsible for enrolling and issuing cards to end users within their respective organization.
To issue a card, a security officer uses the operator interface of the ActivID CMS to generate asymmetric keys and assign a PIN. The customer also signs a contract with KAS BANK accepting responsibility for the issuance and management of smartcards internally within their organization.
Authorized individuals can then process transactions from their desk after logging in with their smart card to any PC with ActivIdentity ActivClient™.
The ActivIdentity solution will offer rich features and capabilities. “We would like to use this solution for all communications with the client,” says van der Wal. “That includes Web applications, file transfers, and eventually remote access by clients onto certain parts of our systems within KAS BANK.”
Looking Forward
KAS BANK will soon be leveraging the same ActivIdentity technology to provide their employees with the ActivIdentity Smart Employee ID solution. With a single smart card, employees can securely access their PC, perform single sign on (SSO) to applications, securely access the network remotely, sign emails and documents, and complete transactions—and ultimately access secure areas of their building.
Benefits
Reduced user fees, management, and maintenance
The ActivIdentity Smart Banking ID infrastructure is easy and more cost effective to manage and maintain.
Faster, easier transactions with the highest level of security
Users can now process transactions securely from their own desktop using a familiar interface.
Delegated administration and issuance model
KAS BANK customers now have sole control of their private keys ensuring non-repudiation of transactions.
More Information
ActivIdentity Strong Authentication for Banking
Smart Employee ID
ActivClient™
ActivID™ Card Management System
Register for the
Butler Group reviews the ActivIdentity Smart Employee ID solution. Free Download