State of Online Security in Financial Institutions in Middle East - 2008

We are pleased to announce the results of our online security survey titled "State of Online Security in Financial Institutions in Middle East - 2008". This is the third in a series of global online transactional security surveys. This is arguably Middle East's first such survey. Survey* respondents represented Middle East's major banks across UAE, Saudi Arabia, Lebanon, Kuwait and Bahrain. The survey primarily focused on the issues pertaining to transactional security & risk mitigation: online identity theft, MITM attacks and online financial frauds.

Key findings of this survey are:

• Over 20% of banks reported to have been the victims of phishing/pharming during the last one year.
• For Stronger User Authentication: software based two-factor authentication [2FA] methods, namely phone factor or device fingerprinting, is gaining increasing popularity over the traditional one-time pin [OTP] generating hardware security devices, because of lower cost and user convenience. Over 30% of respondents now prefer it for their new implementations - a growing trend among the financial institutions.
• All respondents were aware that integrating Stronger User Authentication, with Fraud Detection, and Risk-Based Transaction Authorization is the strongest form of defense against Online Identity Theft, MITM attacks and Financial Frauds. Clearly, there is increasing desire to take holistic approach to transactional security & fraud prevention.
• "Integrated/holistic" approach to transactional security and fraud prevention/risk mitigation is clearly becoming a preference over "point" solutions.
• Accordingly, preference for "stand-alone" 2FA is clearly declining with the availability of "integrated/holistic" solutions. Over 30% respondents now prefer integrated solution for their new implementations: fraud detection and risk based transaction authorization together with stronger user authentication, for transactional security and fraud prevention.
• Operational risk, also called transactional risk, still do not attract enough importance in the financial institutions compared to credit and market risks. This however is changing with new regulatory guidelines, result of alarming increases in identity theft, and online financial frauds including external and internal frauds. Results clearly show that online security and surveillance is a business issue!
• Financial crime surveillance slowly but surely is gaining ground.
• Over 70% of banks still do not have dedicated budget for online security. Online security is still part of the IT budget.
• Identity management and/or fraud prevention, and risk management, are the top two security agendas for 2008 for ME banks.
• Awareness of the impact of online security incidents is still quite low. 75% of respondents were not well aware of online security incidents in their own bank.

*Note to Editor: ReadiMinds conducted this survey during the month of June, 2008. Middle East countries covered included UAE, Saudi Arabia, Lebanon, Kuwait, and Bahrain. Web based survey and phone interview methods were used.

Contact for more information, or interview: