You can rely on the Review to help you
prepare for your IT examination. Designed
especially for IT management, The Weekly IT Security Review
provides a analysis of IT security issues covered in the FFIEC IT
Examination Handbook, which will help in preparing for your IT
examination. For more information and to subscribe visit
Secret Service Paid TJX Hacker $75,000 a Year - Convicted TJX hacker
Albert Gonzalez earned $75,000 a year working undercover for the
U.S. Secret Service, informing on bank card thieves before he was
arrested in 2008 for running his own multimillion-dollar
GAO - IRS Needs to Continue to Address Significant Weaknesses.
More than two-thirds of the weaknesses and
deficiencies in the Internal Revenue Services IT systems remain
unresolved one year after being identified by the GAO, jeopardizing
the confidentiality, integrity and availability of sensitive
taxpayer information, the Government Accountability Office reported.
One in four UK schoolkids admits hacking - One in four UK youngsters
have tried hacking into Facebook or webmail accounts, according to a
Lords pass controversial internet piracy bill - Legislation to
tackle internet piracy, including bans for illegal file-sharers, has
been passed by the Lords. The Digital Economy Bill is now expected
to be rushed through the Commons before the general election.
Russia and US working together to shut down stock hacker -
Cooperative effort to combat stock manipulators. The ongoing case
against hackers using stolen share trading accounts to manipulate
stocks is seeing good cooperation between Russian business and the
US government's Securities and Exchange Commission (SEC).
ATTACKS, INTRUSIONS, DATA THEFT & LOSS
Health records compromised - Alberta's privacy commissioner has
launched an investigation into the potential compromise of thousands
of patient files at a northeast medical clinic.
Stolen Vanderbilt University desktop contained students' personal
information - A Vanderbilt University professor's desktop computer,
containing the personal information of thousands of current and
former students, was recently stolen.
Return to the top
of the newsletter
WEB SITE COMPLIANCE -
OCC - Threats from
Fraudulent Bank Web Sites - Risk Mitigation and Response Guidance
for Web Site Spoofing Incidents (Part 1 of 5)
Web-site spoofing is a method of creating fraudulent Web sites that
look similar, if not identical, to an actual site, such as that of a
bank. Customers are typically directed to these spoofed Web
sites through phishing schemes or pharming techniques. Once at
the spoofed Web site, the customers are enticed to enter information
such as their Internet banking username and password, credit card
information, or other information that could enable a criminal to
use the customers' accounts to commit fraud or steal the customers'
identities. Spoofing exposes a bank to strategic, operational,
and reputational risks; jeopardizes the privacy of bank customers;
and exposes banks and their customers to the risk of financial
PROCEDURES TO ADDRESS SPOOFING
Banks can mitigate the risks of Web-site spoofing by implementing
the identification and response procedures discussed in this
bulletin. A bank also can help minimize the impact of a
spoofing incident by assigning certain bank employees responsibility
for responding to such incidents and training them in the steps
necessary to respond effectively. If a bank's Internet
activities are outsourced, the bank can address spoofing risks by
ensuring that its contracts with its technology service providers
stipulate appropriate procedures for detecting and reporting
spoofing incidents, and that the service provider's process for
responding to such incidents is integrated with the bank's own
Banks can improve the effectiveness of their response procedures by
establishing contacts with the Federal Bureau of Investigation (FBI)
and local law enforcement authorities in advance of any spoofing
incident. These contacts should involve the appropriate
departments and officials responsible for investigating computer
security incidents. Effective procedures should also include
appropriate time frames to seek law enforcement involvement, taking
note of the nature and type of information and resources that may be
available to the bank, as well as the ability of law enforcement
authorities to act rapidly to protect the bank and its customers.
Additionally, banks can use customer education programs to mitigate
some of the risks associated with spoofing attacks. Education
efforts can include statement stuffers and Web-site alerts
explaining various Internet-related scams, including the use of
fraudulent e-mails and Web-sites in phishing attacks. In
addition, because the attacks can exploit vulnerabilities in Web
browsers and/or operating systems, banks should consider reminding
their customers of the importance of safe computing practices.
the top of the newsletter
INFORMATION TECHNOLOGY SECURITY -
We continue the series
from the FDIC "Security Risks Associated with the Internet."
Firewalls - Description, Configuration, and Placement
A firewall is a combination of hardware and software placed between
two networks which all traffic, regardless of the direction, must
pass through. When employed properly, it is a primary security
measure in governing access control and protecting the internal
system from compromise.
The key to a firewall's ability to protect the network is its
configuration and its location within the system. Firewall products
do not afford adequate security protection as purchased. They must
be set up, or configured, to permit or deny the appropriate traffic.
To provide the most security, the underlying rule should be to deny
all traffic unless expressly permitted. This requires system
administrators to review and evaluate the need for all permitted
activities, as well as who may need to use them. For example, to
protect against Internet protocol (IP) spoofing, data arriving from
an outside network that claims to be originating from an internal
computer should be denied access. Alternatively, systems could be
denied access based on their IP address, regardless of the
origination point. Such requests could then be evaluated based on
what information was requested and where in the internal system it
was requested from. For instance, incoming FTP requests may be
permitted, but outgoing FTP requests denied.
Often, there is a delicate balance between what is necessary to
perform business operations and the need for security. Due to the
intricate details of firewall programming, the configuration should
be reassessed after every system change or software update. Even if
the system or application base does not change, the threats to the
system do. Evolving risks and threats should be routinely monitored
and considered to ensure the firewall remains an adequate security
measure. If the firewall system should ever fail, the default should
deny all access rather than permit the information flow to continue.
Ideally, firewalls should be installed at any point where a computer
system comes into contact with another network. The firewall system
should also include alerting mechanisms to identify and record
successful and attempted attacks and intrusions. In addition,
detection mechanisms and procedures should include the generation
and routine review of security logs.
Return to the top of
INTERNET PRIVACY - We continue our
series listing the regulatory-privacy examination questions.
When you answer the question each week, you will help ensure
compliance with the privacy regulations.
Consumer and Customer:
The distinction between consumers and customers is
significant because financial institutions have additional
disclosure duties with respect to customers. All customers covered
under the regulation are consumers, but not all consumers are
A "consumer" is an individual, or that individual's legal
representative, who obtains or has obtained a financial product or
service from a financial institution that is to be used primarily
for personal, family, or household purposes.
A "financial service" includes, among other things, a financial
institution's evaluation or brokerage of information that the
institution collects in connection with a request or an application
from a consumer for a financial product or service. For example, a
financial service includes a lender's evaluation of an application
for a consumer loan or for opening a deposit account even if the
application is ultimately rejected or withdrawn.
Consumers who are not customers are entitled to an initial privacy
and opt out notice only if their financial institution wants to
share their nonpublic personal information with nonaffiliated third
parties outside of the exceptions.
A "customer" is a consumer who has a "customer relationship" with a
financial institution. A "customer relationship" is a continuing
relationship between a consumer and a financial institution under
which the institution provides one or more financial products or
services to the consumer that are to be used primarily for personal,
family, or household purposes.