InformationWeek.com

Welcome Guest. | Log In| Register | Membership Benefits

February 15, 1999

Equifax: Who Goes There?

By Bob Violino and Amy K. Larsen

Related links:

Web Security Improves

PKEnable: A Switch For E-Security

And from our sister publications:

InternetWeek Vendors Adding To PKI Interoperability

redit-verification company Equifax Inc. is building an entirely new E-business around IT security, creating Equifax Secure, a subsidiary that helps companies authenticate customer, supplier, and partner identities during Internet transactions.

Equifax, in Atlanta, has been using the Web for years to provide merchants with consumer credit information and provide consumers with their own credit files. The new service involves Equifax more directly in E-business transactions. Using public key infrastructure technology and custom applications such as specialized Web forms, the service lets companies query users accessing a site to make sure they are who they claim to be before allowing them to participate in Internet transactions. Equifax also uses IBM's Vault Registry product to maintain directories of users who are allowed access to its clients' sites.

Equifax Secure remotely authenticates users by issuing a series of questions specific to each user. Once the user is authenticated, the service generates and downloads a certificate to the user's PC, allowing the user to access whatever information he or she needs to conduct permitted transactions over the Web. The Equifax subsidiary manages all the certificates, making sure all permissions are current. "Companies trying to do business on the Web have to translate their old business model into the new Web model," says Equifax senior VP Jeffrey Johnson, who's also general manager of the new unit.

When Equifax was first developing the service bureau concept, it expected to win most of its contracts from businesses involved in supply-chain or other extranet-based applications with their partners. However, its first customers actually came from the business-to-consumer E-commerce space. Equifax services both online consumer auction house eBay Inc. and Internet bank Security First. "EBay had a couple of instances where a seller didn't actually have the goods or a buyer who bid $100,000 at a charity auction turned out to be a teen-ager," Johnson says.

Security: An E-Biz Asset

First Union: Rigorous Standards

E-Trade: An Absolute Priority

Equifax: Who Goes There?

Catholic Healthcare West: Healthy Security

Johnson says most companies doing E-business don't understand the importance of building an IT security framework until they get burned. He also insists that securing Web applications isn't as much a technology issue as it is a management one. "We've had password protection forever, but the reason that fails is administrators don't manage them well," Johnson says, adding that users are equally guilty.

Companies must take a holistic approach to security, developing all their security solutions as an integral part of every new application, Johnson says. "The good news is the technology is there today," he says. Encryption is a mature part of all of Equifax's sensitive Web transactions, whether it's a company requesting credit information on a business customer or a consumer inquiring about his credit report. Johnson says tools such as digital certificates are coming along, and other technologies, such as biometrics, will get better over the next five years.

Back to This Week's Issue

Send Us Your Feedback

Top of the Page