Malware is quickly becoming a ubiquitous method for attacking customer and corporate accounts. Once inside the system, fraudsters are known for stealing sensitive information or funds.
In response, Gartner predicts that by 2014, 15 percent of enterprises will be going beyond simple authentication methods, using layered fraud prevention techniques for their internal systems.
The layered approach to fraud prevention tries to keep the attackers from getting inside in the first place, but it also assumes that they will make it in, explains Avivah Litan, vice president and distinguished analyst at Gartner, and author of the report, "The Five Layers of Fraud Prevention and Using Them to Beat Malware."
She said that no authentication measure on its own, especially when communicating through a browser, is sufficient to counter today's threats.
While not every recently breached company (e.g., Sony) has revealed how the attackers got into their system, Gartner says layered fraud prevention approach could have prevented attacks in the past year against Epsilon, RSA Security and other companies.
“With most of these breaches, a fraudster presumably accessed and retrieved the thousands or millions of records that were compromised,” Litan says. “A layered fraud prevention system would have flagged this type of massive record retrieval as a clear aberration, and raised a big red flag alert that in turn could have blocked the subsequent data theft.”
Gartner breaks down fraud prevention into five layers. Briefly, Layer 1 is endpoint-centric, Layer 2 is navigation-centric, Layer 3 is user and account-centric for a specific channel, Layer 4 is user and account-centric across multiple channels and products, and Layer 5 is entity link analysis.
Implementing a layered fraud management framework can take three to five years, and organizations don't have years to wait, emphasizes Litan. Gartner recommends starting with the first and second layer, since these can be deployed relatively quickly.
“These layers are part of an overall strategy that relies on basic fraud prevention principles, such as user and account profiling, that have generally stood the test of time" Litan says.
On a final note, Litan mentions, “Technology is just one part of the solution. Enterprises must be organized to manage the fraud alerts coming out of the systems.”
Valerie Valentine is senior editor for Information Management. You can follow her on Twitter at @va1va1entine or via email at valerie.valentine@sourcemedia.com.
Be the first to comment on this post using the section below.