Four 2016 Trends that will Define Security in 2017

Every year that passes we see huge technology improvements and new developments coming into the market.

Four 2016 Trends that will Define Security in 2017

2016 has been a year primarily defined by the drive of new user experiences. We have not only seen the launch of new augmented and virtual reality products, but also IoT innovations as diverse as smart cars, bike locks and home apps.

Yet, while emphasis is on experience, the new security challenges of innovation cannot be overlooked.

Below, we review some of the key security trends that have been defining the FinTech scene during 2016.

 

  1. 1.       Data breaches

While we haven’t seen in 2016 a breach of the same dimensions as those that attacked the Office of Personnel Management, Target or Sony last year, multiple attacks targeting personal information, federal agencies, health-care organisations and telecom providers did occur.

According to the Identity Theft Resource Centre, there were 522 reported breaches by the middle of July this year, exposing more than 13 million records.[1] In addition, the likelihood of a material data breach involving 10,000 lost or stolen records in the next 24 months has risen to 26%.[2]

Overall, not only have data breaches become more frequent, but their impact has become greater both in terms of the volume of data stolen, and in its sensitive nature. Once a data breach occurs the consequences for the affected organisation can be life-changing. For instance, IBM’s eleventh annual Cost of a Data Breach Study revealed that the average consolidated total cost of a data breach for a company for 2016 is $4 million.[3]

Most companies are already embracing the urgency that this scenario presents and how they can improve their security, but some are reluctant to take steps that will delay internal processes or hinder customer experience.

Nonetheless, data breaches aren’t going anywhere and we will expect to see more organisations in 2017 implementing more preventive and defensive security methods, as well as new technologies being developed and implemented for this purpose. Many companies will focus on employing stronger and multi-layered authentication, as encouraged by the Second Payments Directive (PSD2), which will also mean that even if they face some inevitable breaches, access to accounts will be nullified as the stolen partial information won’t be enough to be usable.

  1. 2.    CNP fraud

Last year, Aité Group reported that US credit card fraud had increased 100% from just seven years ago. The study identified point-of-sale and rising card-not-present (CNP) fraud as contributing factors; which now represents 45% of total US card fraud.[4]

The same trend is true for the UK. Figures from Financial Fraud Action UK show that fraud has been soaring non-stop since 2006, and this figure is growing each year. In the first half of 2016 fraud had risen by 25% and card fraud, which includes card-not-present fraud, was up by 31%.

Fraud Type

2006

2007

2008

2009

2010

2011

2012

2013

2014

2015

% Change 2014/2015

Remote Purchase (CNP)

212.7

290.5

328.4

266.4

226.9

220.9

246.0

301.0

331.5

398.2

20%

Of which e-commerce

154.5

178.3

181.7

153.2

135.1

139.6

140.2

190.1

219.1

261.5

19%

* FFA UK’s Annual fraud losses for CNP fraud on UK-issued cards 2006 – 2015 (All figures in £ millions)

The vast majority of CNP fraud cases involve the use of card details that have been fraudulently obtained through methods such as unsolicited emails, telephone calls or digital attacks. The card details are then used to undertake fraudulent purchases over the internet, phone or by mail order.

With the challenges posed by identifying and verifying someone’s identity digitally and the increased usage of online and mobile shopping, ecommerce is one of the main targets for fraudsters. An estimated £261.5 million of ecommerce fraud took place on UK cards in 2015, accounting for 46% of all card fraud and 66% of total remote purchase fraud.[5]

As ecommerce grows, and it will only continue to expand in the future, so too will CNP fraud.[6] To prevent stolen card details being used to make purchases online, retailers are being advised to take steps to improve their security, including use of online protection services (including American Express ‘SafeKey’, MasterCard ‘SecureCode’ and ‘Verified by Visa’), but also strengthen their ID&V processes.

Many retailers and banks are holding back on tightening their security, potentially fearing retaliation from consumers rejecting transactional friction. While consumers appreciate convenience, in 2017 more businesses will realise that consumers seldom, if ever, place security second to ease of use. Brand value can be enhanced by getting the security experience right, relative to the purchase risk. Many companies will continue to implement two factor authentication, as Google, Apple, Paypal, Amazon and most social media did in 2016.[7]

  1. 3.    Biometrics and identity management

Apple Touch ID triggered a new biometrics security revolution, to the point where it is forecasted that by 2021, 99% of US smartphones will be biometrics-enabled.[8]

Many firms in 2016 explored new methods of verifying user identity. Methods like voice verification, finger vein scanning or iris recognition are slowly but steadily gaining popularity for unlocking smartphones, logging in to bank accounts, verifying payments, accessing sensitive information and governmental border management (including its use in e-passports, e-driving licenses and national IDs).

Many are still sceptical regarding storing and encryption of biological data. Even though it is much harder for hackers to access and use, if accessed, it is extremely valuable, since biological data can’t be changed or replaced in the event of a breach. But these challenges won’t hinder future adoption and biometrics will continue to become more pervasive in everyday life from now onwards.

However, biometrics, on their own, are not infallible. Even if sensors get stronger against fake fingerprint attacks and the technology is refined, if biometrics are to start making headway as a secure authentication technology, the technology will have to be coupled with other forms of authentication, such as password or PIN.

  1. 4.    Machine learning

A lot of conversations have emerged about the improvements and possibilities that machine learning can bring to multiple industries.

For those not familiar with the term, machine learning is a branch of artificial intelligence (AI) study that concentrates on algorithms which enable computers to “learn” without being given specific programming. Being exposed to new data enables the computer to grow, change, develop and solve problems independently of new programing. 

By analysing historical transaction data, machine learning is already effectively being used to prevent and detect fraud attempts, especially in multichannel payments. While it takes one person about 5 minutes to check just one transaction, a machine can check larger amounts of data in nano seconds, saving time and money and making the analysis feasible in real time to prevent  an attack.[9] 

Although not yet explored in depth, the possibilities for machine learning in ID&V are also considerable. Taking, as an example, the mobile phone, we each have our own unique quirks whilst using our device. We will hold the device in a certain way, enter key strokes in a specific manner and have countless other characteristics that can be “learned”.

Machine learning is still in its infancy and needs to be developed in real life use cases but it could allow the inclusion of an additional layer of security to ID&V processes. If taken forward, not only would your device recognise your passcode or biometric information, it would also recognise if this information has been entered in a recognised fashion. We expect to see further developments on how AI and machine learning could be used to satisfy security needs.

Conclusion

Overall, in 2017 we expect to see:

  • Continued growth of payment card fraud, particularly in CNP  and data breaches, as well as increased investments in security and authentication measures to avoid them
  • New developments in biometrics and expansion of current methods
  • Broader implementation of 2-Factor and multi-layered authentication, something you have, something you know, and something you are
  • Developments of machine learning applied to authentication
  • Increased focus on fostering innovation and encouraging competition by regulators


[1] http://www.crn.com/slide-shows/security/300081491/the-10-biggest-data-breaches-of-2016-so-far.htm

[2] https://securityintelligence.com/cost-of-a-data-breach-2016/

[3] https://securityintelligence.com/cost-of-a-data-breach-2016/

[4] https://www.emc.com/collateral/white-papers/card-not-present-fraud-post-emv-env-wp.pdf

[5] https://www.financialfraudaction.org.uk/fraudfacts16/

[6] https://www.javelinstrategy.com/blog/2015/06/02/a-hole-in-the-balloon-analogy-the-complex-evolution-of-card-fraud-in-the-us/

[7] http://www.pcmag.com/article2/0,2817,2456400,00.asp

[8] http://www.businessinsider.com/the-biometrics-report-2016-7

[9] https://blog.markgrowth.com/fighting-fraud-with-machine-learning-ecfbd2239fb9#.dqtvpn2hw