Winning the Fight Against Man-in-the-Browser - Entrust IdentityGuard Mobile Now Available

In April 2010, Entrust, Inc., announced the newest innovation in strong authentication technology - Entrust IdentityGuard Mobile. The advanced mobile authentication application is a component of a layered security approach to thwart malicious man-in-the-browser malware attacks - like the nefarious Zeus Trojan - and is now available as part of the newest release of Entrust IdentityGuard 9.3.

"To effectively fight the increasingly sophisticated strands of malware, including man-in-the-browser attacks, financial institutions should use a layered approach powered by proven identity-based security solutions," said TowerGroup senior research director George Tubin. "In addition to successful strong authentication and fraud detection methods, out-of-band transaction verification via a mobile application can prove effective in helping defeat man-in-the-browser attacks."

Going Mobile

Establishing itself as a leader in identity-based security strategies and solutions, Entrust and the innovative mobile identity application allows organizations to strongly authenticate customers, partners, vendors or users via a smartphone device. Whether for consumer, government or enterprise environments, Entrust IdentityGuard Mobile represents an extremely cost-effective and secure approach for authenticating any end-user.

Leveraging deployed smartphones and without requiring any specialized hardware, Entrust IdentityGuard Mobile delivers unique security capabilities for organizations, including out-of-band transaction verification, to defeat the latest malware threats affecting online-banking users.

"This is a critical tool in the fight against online fraud, particularly man-in-the-browser malware like Zeus that have, unfortunately, been successful defrauding large and small organizations alike," said Entrust President and CEO Bill Conner. "Coupled with a versatile authentication platform and fraud-monitoring capabilities, secure mobile applications can help consumers and financial institutions defend against these malicious malware attacks."

Defeating Man-in-the-Browser

Entrust IdentityGuard Mobile works in conjunction with Entrust's proven authentication and fraud detection solution - a strategy that is recognized by leading analyst firms for its ability to stop man-in-the-browser malware.(1) The mobile security platform enables strong authentication, as well as detailed transaction review and confirmation, on the handheld device. The application then generates standards-based, one-time passcodes (OTP) based on the values of the transaction itself.

"A mobile security application that provides strong authentication and out-of-band transaction verification is undeniably critical for customers in the fight against today's malware threats," said Neosecure S.A. CEO Eduardo Diaz. "Having this tool as a component of a larger versatile authentication platform - and right on their smartphone - only increases its value to organizations seeking solutions that will help protect their customers from online attacks."

In fact, Entrust is one of the only vendors that offers three distinct and highly effective methods of addressing man-in-the-browser attacks - behavioral and transactional fraud detection; SMS authentication with transaction details; and mobile out-of-band transaction verification and signature.

Easy to Use

One of the most convenient, easy-to-use strong mobile authentication methods available today, Entrust IdentityGuard Mobile enables out-of-band transaction verification, OATH-compliant signatures and even a method to immediately report suspicious account behavior. It is designed to operate on today's leading smartphone platforms, including the Apple iPhone, RIM BlackBerry, Microsoft Windows Mobile and Symbian (Java).

Affordable Authentication

Unlike physical options, Entrust IdentityGuard Mobile leverages a user's existing smartphone; there's no extra physical hardware to buy and deploy. In addition, Entrust IdentityGuard Mobile delivers transaction notifications directly to the phone without the use of SMS, which can reduce the overall cost of deployment for organizations.

Securing the Enterprise

And while Entrust IdentityGuard Mobile is proven to authenticate identities and transactions in the external world of consumer and business transactions, it's equally effective as a strong authenticator for internal enterprise VPN access, web portal access or corporate desktop security. The smartphone application can manage multiple identities on a single device, making it one of the most versatile and easy-to-use soft tokens available on the market today.

Popular Authenticators, One Platform

Entrust enables organizations to layer security - according to access requirements or the risk of a given transaction - across diverse users and applications. Entrust's authentication capabilities include username and password, IP-geolocation, device, questions and answers, out-of-band one-time passcode (delivered via voice, SMS or e-mail), grid and eGrid cards, digital certificates (in software or on smart cards/USB Tokens) and a range of one-time-passcode tokens, including Entrust IdentityGuard Mobile.

Want to know more about how Entrust IdentityGuard Mobile can help defeat man-in-the-browser malware? Visit entrust.com/mobile for detailed capabilities, features and supported platforms.

(1) "Where Strong Authentication Fails and What You Can Do About It," Avivah Litan, Gartner, Inc., December 3, 2009.

About Entrust

Entrust provides identity-based security solutions that empower enterprises, consumers, citizens and Web sites in more than 4,000 organizations spanning 60 countries. Entrust's identity-based approach offers the right balance between affordability, expertise and service. For strong authentication, fraud detection, digital certificates, SSL and PKI, call 888-690-2424, e-mail entrust@entrust.com or visit www.entrust.com.

Entrust is a registered trademark of Entrust, Inc. in the United States and certain other countries. In Canada, Entrust is a registered trademark of Entrust Limited. All Entrust product names are trademarks or registered trademarks of Entrust, Inc. or Entrust Limited. All other company and product names are trademarks or registered trademarks of their respective owners.