Partner Management Meeting

1
The role of PKI in (e)banking possibilities,
prospects, traps Grzegorz Wojtenko Wincor Nixdorf
Sp. z o.o.
2
Agenda

• Snapshot of the Polish banking sector
• E-banking vs banking
• Technology review
• PKI in (e)banking
• Toward perfectness
• Business aspects

3
Snapshot of the Polish banking sector (1)

• Magstripe still in course
• low costs
• low level of frauds
• education in progress
• EMV migration
• high costs
• security aint a sufficient driver
• Technical remark EMV is PKI based solution!

4
Snapshot of the Polish banking sector (2)

• EMV implementations, slip-ups
• CardPoint, KredytBank, BZ WBK
• obstacles EFT POS infrastructure
• Polcard
• PKO BP ( one bank can build a critical mass)
• encrouching RETAIL!!!
• Competitors
• m-commerce
• only in low value transactions
• small trust in wireless solutions

5
EMV conclusion

• Added values for EMV is a must
• Added values
• loyalty (single- and multipartner)
• corporate card (e.g. fleet card)
• internet banking

6
E-banking vs banking (1)

• Electronic banking product and service delivery
  through electronic channels, digital payments,
  mass banking services electronically provided
• E-banking
• home banking
• internet banking
• e-commerce
• m-commerce

7
E-banking vs banking (2)

• Characteristics
• New contact channel
• New services
• Different business model
• Supplement not competitor for classical branches
• Delocalization 24/7/365 always, everywhere
• Functions
• secure transactions
• secure messaging
• time stamping
• e-administration

8
E-banking vs banking (3)

• Questions to answer
• who is my trading partner?
• can I trust him?
• who will pay?
• will he deliver to agreed terms of trade, if not,
  is there comeback?
• can I recourse if things go wrong?

9
Technology review

• One-time password
• scratches
• tokens (time based, EMV based)
• cards (PKI)
• GSM (incl. wireless PKI)

10
PKI in (e)banking
(1)
11
PKI in (e)banking
(2)
12
Toward perfectness (1)

• Review of opinions
• PKI in big value transactions
• PKI needs more e-commerce than e-commerce needs
  PKI
• PKI is complex and lobor intensive
• convergence of wireless PKI solutions with 3G
  networks will encourage big-ticket m-commerce
  transactions
• m-PKI is not the same as card-PKI
• PKI can solve many risks
• the customer does not trust the Internet
• the bank does not trust the Internet

13
Toward perfectness (2)

• To do
• identify potential PKI candidates
• evaluate applicable industry PKI impacts
• map candidates to applicable PKI enabled products
  and services
• select required PKI components that provide
  incremental and strategic alternatives
• identify adaptable, cost effective value
• keep management informed of value
• Source Managing Your ROI for PKI Security in
  the Digital Future, Peter Butziger

14
Toward perfectness (3)

• To do - implementation
• Step 1 design the trust
• Step 2 design the policy
• Step 3 make the application work
• Step 4 Set up the Web Server
• Things to consider
• right technology
• speed to market
• business partner who can bring this all together
  (ask me after the speech for contact ?)

15
Business aspects (1)

• Target group
• B2C (?)
• B2B (!) corporate banking
• Strategic planning assumptions Within two years
  of deployment, 20 to 30 of PKI deployments will
  fail because they do not demonstrate value (0.9
  probability) Source GartnerGroup Justifiying
  PKI as Protection and Opportunity

16
Business aspects (2)

• PKI ROI Checklist
• solicit management buy-in
• evaluate industry PKI impacts
• evaluate assets and risk
• determine scope of PKI applicability
• determine applicable PKI components
• evaluate PKI vendor alliances
• plan for realistic cost recovery strategy
• define and enforce applicable policies
• Source Managing Your ROI for PKI Security in
  the Digital Future, Peter Butziger

17
Business aspects (3)

• Side effects
• rethinking about CRM
• reworking business plan
• redesigning marketing plan
• After that all calculating TCO !

18
Conclusions

• PKI perfect technology
• but not easy in use
• EMV needs added value plug-ins
• EMV PKI very attractive, relatively cheap
• but most suitable for B2B

19
Thank you
Grzegorz WojtenkoGrzegorz.Wojtenko_at_wincor-nixdorf
.com tel.
22 / 571 91 22GSM 0-600 972 775