Enhanced security can go hand in hand with a better user experience, as CIMB Securities has demonstrated with its new i*Trade@CIMB online trading portal.

Launched on 14 August, i*Trade@CIMB is aimed at offering investors an enhanced online trading experience. “Fast and secure are the key words defining the experience we aim to provide customers with the new iTrade@CIMB,” said Ms Carol Fong, Chief Executive Officer, CIMB Securities. “We have made investments into the right resources and technology, and have teamed up with excellent partners to deliver a superior portal with the speed and security required to keep pace with today’s online trading environment.”

CIMB is the first broker to host its online trading platform within co-location facilities at Singapore Exchange, giving its retail investors the fast access to market data and trade execution systems that was previously available only to institutional investors. It is also the first broking firm working with Assurity Trusted Solutions to require the use of OneKey two-factor authentication (2FA) for added security.

Contrary to the widely-held view that enhanced security tends to result in greater inconvenience for users, Mr Raymond Chin, Senior Vice President, E-Trading, CIMB Securities, said the use of OneKey actually helps to improve the customer experience because the customer only needs to key in the one-time password from the security token only once. When he enters the secure environment, the customer can go on to execute multiple trades or access sensitive information without having to authenticate himself again. In comparison, using the conventional password-only approach, the customer would have had to key in a password every time he submits an order.

At i*Trade@CIMB, customers can perform the 2FA authentication when they first login to the trading portal, or they will be prompted to do so when they execute a critical function for the first time, for example, when they submit their first order.

Mr Chai Chin Loon, Chief Operating Officer of Assurity Trusted Solutions, said CIMB Securities’ move to require the use of 2FA when accessing private information will help boost investor confidence in the new trading platform.

He noted that while passwords still have a place in online security, they are no longer enough to protect sensitive information in today’s high-threat environment. Passwords can be lost through phishing scams or when users inadvertently click on links in compromised emails. The harvested passwords can then be used to perpetrate online fraud or other cybercrimes.

2FA addresses this weakness in password security by combining two of the three common ways of authenticating identity using what you know (for example, passwords), what you have (for example, security tokens) and what you are (for example, fingerprint recognition). “Every one of these has its strengths and weaknesses, but 2FA means that at least two of them must be present, which makes it safer,” said Mr Chai.

OneKey incorporates three 2FA functions for optimal security. They are:

• One-time password or OTP which is valid for only one login session or transaction and is thus not vulnerable to replay attacks because it cannot be used a second time.
• Challenge-response authentication which requires the user to “respond” to the “challenge” posted by OneKey by providing a password, and
• Transaction signing which requires users to key in their transaction details, thus providing an additional layer of security.

As part of Singapore’s National Authentication Framework, OneKey also allows authentication services for multiple online service providers to sit on the same security token, preventing a proliferation of tokens that customers have to carry around.

“With the OneKey 2FA device, investors can trade online with peace of mind while enjoying the convenience and security of using only one device for many online service providers,” said Mr Chai.