Senior Technology Consultant Mike Drabicky has been working in the computer industry for more than three decades in programming, system and network management and design, data center management and database security and compliance. He’s a regular and welcome correspondent and I was so taken with his most recent comments that I asked him for permission to publish them. Here, with slight edits, is his discussion of a new wrinkle in authentication ("I" refers to Mike).

* * *

I have a Bank of America (BoA) credit card and use the bank's Web site all the time to check charges, pay bills and all those normal online activities. As one who deals with security as part of his job, I am always concerned about phishing and phony Web sites masquerading as the real thing, all dedicated to taking that which is not theirs to take: my personal information.

A year or so ago, BoA offered the SiteKey, a second level of authentication. With this, you would pick an icon representing something of interest as a way of authenticating the Web site and only then provide a password to access your account. Mich published a couple of articles last April about SiteKey.

More recently, BoA offered another front-end security option: SafePass, a text message code sent to your cell phone. Upon request, BoA will send a six-digit code to your cell phone via text message. When you enter the code, BoA validates the code and allows you to proceed to the icon/password verification page just described. The token expires in 10 minutes. They also offer an alternative mechanism of authentication should you be in a place unable to receive the message on your cell phone.

There are a number of really positive things to say about this scheme:

1. It is low-cost. No tokens to tote, no tokens to lose, no software to load, nothing extra needed other than what you very likely already have: a cell phone.

2. It is easy to understand and use. There’s nothing complicated about this: anyone accessing their Web site should be more than knowledgeable enough to appreciate the simplicity and elegance of this system.

3) It speaks volumes for BoA. This tells me that Bank of America understands the security risks of doing credit card business on the Web and has taken steps to make sure the person on the other end of the browser is indeed who they say they are.

M. E. Kabay, PhD, CISSP-ISSMP, specializes in security and operations management consulting services. CV online.