The Federal Financial Institutions Examination Council (FFIEC) released the long-awaited supplement to its authentication guidance, Authentication in an Internet Banking Environment.  The supplement represents the most current and authoritative guidance regarding data security in connection with online banking platforms. 

Here are a few highlights of the supplement:

• Financial institutions should perform periodic risk assessments that take into account, among other factors, changes in the internal and external threat environment. 
• Institutions should implement more robust controls for business and commercial banking as opposed to retail and consumer banking. 
• Institutions should implement a layered approach to security for high-risk Internet-based banking applications, including processes to detect and respond to anomalies and tighter access controls for administrative functions. 
• The supplement discusses the effectiveness of authentication techniques such as device identification and challenge questions. 

The federal banking regulators are expected to more closely scrutinize banking institutions’ security practices, especially in light of recent data breaches affecting the industry, and to use the supplement in conducting examinations.