12:33 PM
Connect Directly

Citi Boosts Treasury Biz by Joining CertiPath Credentialing Program

Citi (New York) has become the first bank to cross-certify with the CertiPath information-sharing bridge. This allows the bank to deliver identity credentialing services to companies that wish to do business with the aerospace and defense (A&D) industry. The program is being offered through Citi's Global Transaction Services.

CertiPath is the identity management and information sharing authority for the A&D sector. It was established to address the problems of partners and customers to electronically share critical information with a degree of trust, confidence and security. CertiPath credentials are based on global, uniform requirements for medium- and high-assurance certification for identity management.

According to Gary Greenwald, chief innovation officer with Citi Global Transaction Services, Citi already does a significant amount of work with the federal government and the public sector in general. "Pursuing the CertiPath certification was a logical expansion for Citi Managed Identity Services since CertiPath already serves our largest clients in the defense sector, as well as their supply chain," Greenwald told BS&T. "In addition, they have ties to the federal government, which is another large Citi client, so it is a natural extension to our Managed Identity business."

Citi's Managed Identity Services enables its clients to use digital identities and certificates to transact digital commerce securely. The certificates can authenticate end users to applications, encrypt and lock down data, and replace "wet ink" with digital signatures without compromising legal enforceability, claims the bank. Citi currently provides these services to corporates for performing financial and pharmaceutical transactions. With the introduction of CertiPath, its clients can now expand their dealings to those companies in the A&D industry and U.S. federal agencies already on the CertiPath Bridge.

According to the bank, it invested in extensive policy, procedure and infrastructure development to become a CertiPath Certified Credential Provider. These are military-grade credentials that will allow Citi's clients to perform business with the government in a more streamlined, electronic manner. Citi also says it will help corporates reduce cost and risk by eliminating the need for them to create their own certified credentials.

Citi's timing in gaining this certification could not have been better, given the added pressure on public companies to secure their infrastructures. "Citi recognizes that for public sector organizations, these are challenging times. With the increased pressure to secure the national infrastructure, combined with the increased costs of cyber security, identity management has become one of the most critical business problems in recent years for organizations to tackle in an efficient and cost-effective manner," says Greenwald.

Although companies in this sector recognize the cost savings associated with doing business electronically, he says identity assurance had always been a sticking point, since organizations in the A&D industry and federal government handle transactions of a very sensitive nature that require signatures and approvals. To Greenwald, providing services around digital credentials and identity assurance are a natural for an institution like Citi.

"Citi's approach to the identity problem is unique in the marketplace," he explains. "As a regulated financial entity, Citi is already experienced in performing and managing the process of vetting both corporates and individuals. Citi is accustomed to the development of solutions that are highly secure, highly scalable, and global in scope, yet with a strong understanding of local and regional audit and compliance dynamics, and more importantly, solutions that support seamless end-to-end integration of business processes."

Other organizations in the CertiPath program include Boeing, Lockheed-Martin, EADS, Raytheon and Northrop Grumman.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.