I-IBComptroller of the CurrencyAdministrator of National BanksInternet Banking Comptroller’s HandbookOctober 1999IOther Income Producing Activities
Internet BankingTable of Contents Introduction1Growth in Internet Banking2Types of Internet Banking4Internet Banking Risks5Credit Risk5Interest Rate Risk6Liquidity Risk6Price Risk7Foreign Exchange Risk7Transaction Risk8Compliance Risk9Strategic Risk 10Reputation Risk 11Risk Management 12Internal Controls 14Technology: In-House or Outsourced? 16Issues in Internet Banking17Examination Procedures22Appendix A — Firewalls and Associated Controls 48Appendix B — Cryptography53Appendix C — Types of Online Attacks58Appendix D — Discussion Points60Glossary62References92Comptroller’s Handbook InternetBankingi
Internet BankingIntroductionThis booklet provides guidance to bankers and examiners on identifying andcontrolling the risks associated with Internet banking activities. It is one of aseries of specialized booklets in the Comptroller’s Handbook.“Internet banking” refers to systems that enable bank customers to accessaccounts and general information on bank products and services through apersonal computer (PC) or other intelligent banking products and services can include wholesale products forcorporate customers as well as retail and fiduciary products for consumers. Ultimately, the products and services obtained through Internet banking maymirror products and services offered through other bank delivery channels. Some examples of wholesale products and services include:CCash management. CWire transfer. CAutomated clearinghouse (ACH) presentment and payment. Examples of retail and fiduciary products and services include:CBalance transaction presentment and payment. CLoan activity. COther value-added services. Other Internet banking services may include providing Internet access as anInternet Service Provider (ISP). The OCC has determined that a national banksubsidiary may provide home banking services through an Internet connectionto the bank’s home banking system and, incidental to that service, may alsoprovide Internet access to bank customers using that service (see OCCInterpretive Letter No. 742, the “Apollo” letter). Historically, banks have usedinformation systems technology to process checks (item processing), drive ATMmachines (transaction processing), and produce reports (managementComptroller’s Handbook 1 InternetBanking
information systems). In the past, the computer systems that made theinformation systems operate were rarely noticed by customers. Today, Websites, electronic mail, and electronic bill presentment and payment systems arean important way for banks to reach their banks have experimented with various forms of online banking formany years. Some of the early experiments involved closed systems where thecustomers accessed banks through a dial-in or cable TV connection. Thesesystems limited a bank’s potential customer base because they required out-of-area customers to either incur long-distance charges on their phone bills orsubscribe to a particular cable TV service to access the bank. With thewidespread growth of the Internet, customers can use this technology anywherein the world to access a bank’s network. The Internet, as an enablingtechnology, has made banking products and services available to morecustomers and eliminated geographic and proprietary systems barriers. Withan expanded market, banks also may have opportunities to expand or changetheir product and service in Internet BankingNumerous factors — including competitive cost, customer service, anddemographic considerations — are motivating banks to evaluate theirtechnology and assess their electronic commerce and Internet bankingstrategies. Many researchers expect rapid growth in customers using onlinebanking products and services. The challenge for national banks is to makesure the savings from Internet banking technology more than offset the costsand risks associated with conducting business in cyberspace. Marketing strategies will vary as national banks seek to expand their marketsand employ lower cost delivery channels. Examiners will need to understandthe strategies used and technologies employed on a bank-by-bank basis toassess the risk. Evaluating a bank’s data on the use of their Web sites, mayhelp examiners determine the bank’s strategic objectives, how well the bank ismeeting its Internet banking product plan, and whether the business is expectedto be of the market factors that may drive a bank’s strategy include thefollowing:Internet Banking 2 Comptroller’sHandbook
Competition — Studies show that competitive pressure is the chief drivingforce behind increasing use of Internet banking technology, ranking ahead ofcost reduction and revenue enhancement, in second and third placerespectively. Banks see Internet banking as a way to keep existing customersand attract new ones to the bank. Cost Efficiencies — National banks can deliver banking services on the Internetat transaction costs far lower than traditional brick-and-mortar branches. Theactual costs to execute a transaction will vary depending on the deliverychannel used. For example, according to Booz, Allen & Hamilton, as of mid-1999, the cost to deliver manual transactions at a branch was typically morethan a dollar, ATM and call center transactions cost about 25 cents, andInternet transactions cost about a penny. These costs are expected to continueto decline. National banks have significant reasons to develop the technologies that willhelp them deliver banking products and services by the most cost-effectivechannels. Many bankers believe that shifting only a small portion of theestimated 19-billion payments mailed annually in the . to electronicdelivery channels could save banks and other businesses substantial sums ofmoney. However, national banks should use care in making product decisions. Management should include in their decision making the development andongoing costs associated with a new product or service, including thetechnology, marketing, maintenance, and customer support functions. Thiswill help management exercise due diligence, make more informed decisions,and measure the success of their business Reach — Internet banking allows expanded customer contactthrough increased geographical reach and lower cost delivery channels. In fact some banks are doing business exclusively via the Internet — they donot have traditional banking offices and only reach their customers online. Other financial institutions are using the Internet as an alternative deliverychannel to reach existing customers and attract new customers. Branding — Relationship building is a strategic priority for many nationalbanks. Internet banking technology and products can provide a means fornational banks to develop and maintain an ongoing relationship with theircustomers by offering easy access to a broad array of products and ’s Handbook 3 InternetBanking
By capitalizing on brand identification and by providing a broad array offinancial services, banks hope to build customer loyalty, cross-sell, andenhance repeat business. Customer Demographics — Internet banking allows national banks to offer awide array of options to their banking customers. Some customers will rely ontraditional branches to conduct their banking business. For many, this is themost comfortable way for them to transact their banking business. Thosecustomers place a premium on person-to-person contact. Other customers areearly adopters of new technologies that arrive in the marketplace. Thesecustomers were the first to obtain PCs and the first to employ them inconducting their banking business. The demographics of banking customerswill continue to change. The challenge to national banks is to understand theircustomer base and find the right mix of delivery channels to deliver productsand services profitably to their various market of Internet BankingUnderstanding the various types of Internet banking products will helpexaminers assess the risks involved. Currently, the following three basic kindsof Internet banking are being employed in the marketplace:CInformational — This is the basic level of Internet banking. Typically,the bank has marketing information about the bank’s products and services on a stand-alone server. The risk is relatively low, asinformational systems typically have no path between the server and the bank’s internal network. This level of Internet banking can be providedby the bank or outsourced. While the risk to a bank is relatively low,the server or Web site may be vulnerable to alteration. Appropriatecontrols therefore must be in place to prevent unauthorized alterations tothe bank’s server or Web site. CCommunicative — This type of Internet banking system allows some interaction between the bank’s systems and the customer. Theinteraction may be limited to electronic mail, account inquiry, loanapplications, or static file updates (name and address changes). Becausethese servers may have a path to the bank’s internal networks, the risk ishigher with this configuration than with informational systems. Appropriate controls need to be in place to prevent, monitor, and alertmanagement of any unauthorized attempt to access the bank’s internalInternet Banking 4 Comptroller’sHandbook
networks and computer systems. Virus controls also become muchmore critical in this — This level of Internet banking allows customers toexecute transactions. Since a path typically exists between the serverand the bank’s or outsourcer’s internal network, this is the highest riskarchitecture and must have the strongest controls. Customertransactions can include accessing accounts, paying bills, transferringfunds, Banking RisksInternet banking creates new risk control challenges for national banks. From asupervisory perspective, risk is the potential that events, expected orunexpected, may have an adverse impact on the bank’s earnings or capital. TheOCC has defined nine categories of risk for bank supervision purposes. Therisks are credit, interest rate, liquidity, price, foreign exchange, transaction,compliance, strategic, and reputation. These categories are not mutuallyexclusive and all of these risks are associated with Internet banking. Credit RiskCredit risk is the risk to earnings or capital arising from an obligor’s failure tomeet the terms of any contract with the bank or otherwise to perform asagreed. Credit risk is found in all activities where success depends oncounterparty, issuer, or borrower performance. It arises any time bank fundsare extended, committed, invested, or otherwise exposed through actual orimplied contractual agreements, whether on or off the banks balance banking provides the opportunity for banks to expand their geographicrange. Customers can reach a given institution from literally anywhere in theworld. In dealing with customers over the Internet, absent any personalcontact, it is challenging for institutions to verify the bonafides of theircustomers, which is an important element in making sound credit collateral and perfecting security agreements also can be challengingwith out-of-area borrowers. Unless properly managed, Internet banking couldlead to a concentration in out-of-area credits or credits within a single industry. Moreover, the question of which state’s or country’s laws control an Internetrelationship is still ’s Handbook 5 InternetBanking
Effective management of a portfolio of loans obtained through the Internetrequires that the board and management understand and control the bank’slending risk profile and credit culture. They must assure that effective policies,processes, and practices are in place to control the risk associated with suchloans. See the “Loan Portfolio Management,” booklet of the Comptroller’sHandbook for a more complete discussion of credit Rate RiskInterest rate risk is the risk to earnings or capital arising from movements ininterest rates. From an economic perspective, a bank focuses on the sensitivityof the value of its assets, liabilities and revenues to changes in interest rates. Interest rate risk arises from differences between the timing of rate changes andthe timing of cash flows (repricing risk); from changing rate relationshipsamong different yield curves affecting bank activities (basis risk); from changingrate relationships across the spectrum of maturities (yield curve risk); and frominterest-related options embedded in bank products (options risk). Evaluationof interest rate risk must consider the impact of complex, illiquid hedgingstrategies or products, and also the potential impact that changes in interestrates will have on fee income. In those situations where trading is separatelymanaged, this refers to structural positions and not trading banking can attract deposits, loans, and other relationships from alarger pool of possible customers than other forms of marketing. Greateraccess to customers who primarily seek the best rate or term reinforces theneed for managers to maintain appropriate asset/liability management systems,including the ability to react quickly to changing market RiskLiquidity risk is the risk to earnings or capital arising from a bank’s inability tomeet its obligations when they come due, without incurring unacceptablelosses. Liquidity risk includes the inability to manage unplanned changes infunding sources. Liquidity risk also arises from the failure to recognize oraddress changes in market conditions affecting the ability of the bank toliquidate assets quickly and with minimal loss in banking can increase deposit volatility from customers who maintainaccounts solely on the basis of rate or terms. Asset/liability and loan portfoliomanagement systems should be appropriate for products offered throughInternet Banking 6 Comptroller’sHandbook
Internet banking. Increased monitoring of liquidity and changes in depositsand loans may be warranted depending on the volume and nature of Internetaccount RiskPrice risk is the risk to earnings or capital arising from changes in the value oftraded portfolios of financial instruments. This risk arises from market making,dealing, and position taking in interest rate, foreign exchange, equity, andcommodities may be exposed to price risk if they create or expand deposit brokering,loan sales, or securitization programs as a result of Internet banking activities. Appropriate management systems should be maintained to monitor, measure,and manage price risk if assets are actively Exchange RiskForeign exchange risk is present when a loan or portfolio of loans isdenominated in a foreign currency or is funded by borrowings in anothercurrency. In some cases, banks will enter into multi-currency creditcommitments that permit borrowers to select the currency they prefer to use ineach rollover period. Foreign exchange risk can be intensified by political,social, or economic developments. The consequences can be unfavorable ifone of the currencies involved becomes subject to stringent exchange controlsor is subject to wide exchange-rate fluctuations. Foreign exchange risk isdiscussed in more detail in the “Foreign Exchange,” booklet of theComptroller’s may be exposed to foreign exchange risk if they accept deposits . residents or create accounts denominated in currencies other than . dollars. Appropriate systems should be developed if banks engage inthese RiskTransaction risk is the current and prospective risk to earnings and capitalarising from fraud, error, and the inability to deliver products or services,maintain a competitive position, and manage information. Transaction risk isevident in each product and service offered and encompasses productComptroller’s Handbook 7 InternetBanking
development and delivery, transaction processing, systems development,computing systems, complexity of products and services, and the internalcontrol high level of transaction risk may exist with Internet banking products,particularly if those lines of business are not adequately planned, implemented,and monitored. Banks that offer financial products and services through theInternet must be able to meet their customers’ expectations. Banks must alsoensure they have the right product mix and capacity to deliver accurate, timely,and reliable services to develop a high level of confidence in their brand name. Customers who do business over the Internet are likely to have little tolerancefor errors or omissions from financial institutions that do not havesophisticated internal controls to manage their Internet banking business. Likewise, customers will expect continuous availability of the product and Webpages that are easy to to support various Internet banking functions is provided to thecustomer from a variety of sources. Banks may support customers usingcustomer-acquired or bank-supplied browsers or personal financial manager(PFM) software. Good communications between banks and their customers willhelp manage expectations on the compatibility of various PFM or intrusion attempts on banks’ computer and network systems are amajor concern. Studies show that systems are more vulnerable to internalattacks than external, because internal system users have knowledge of thesystem and access. Banks should have sound preventive and detective controlsto protect their Internet banking systems from exploitation both internally andexternally. See OCC Bulletin 99-9, “Infrastructure Threats from Cyber-Terrorists” for additional and business resumption planning is necessary for banks to besure that they can deliver products and services in the event of adversecircumstances. Internet banking products connected to a robust network mayactually make this easier because back up capabilities can be spread over awide geographic area. For example, if the main server is inoperable, thenetwork could automatically reroute traffic to a back up server in a differentgeographical location. Security issues should be considered when theinstitution develops its contingency and business resumption plans. In suchsituations, security and internal controls at the back-up location should be asInternet Banking 8 Comptroller’sHandbook
sophisticated as those at the primary processing site. High levels of systemavailability will be a key expectation of customers and will likely differentiatesuccess levels among financial institutions on the Internet. National banks that offer bill presentment and payment will need a process tosettle transactions between the bank, its customers, and external parties. Inaddition to transaction risk, settlement failures could adversely affectreputation, liquidity, and credit risk. Compliance RiskCompliance risk is the risk to earnings or capital arising from violations of, ornonconformance with, laws, rules, regulations, prescribed practices, or ethicalstandards. Compliance risk also arises in situations where the laws or rulesgoverning certain bank products or activities of the bank’s clients may beambiguous or untested. Compliance risk exposes the institution to fines, civilmoney penalties, payment of damages, and the voiding of contracts. Compliance risk can lead to a diminished reputation, reduced franchise value,limited business opportunities, reduced expansion potential, and lack ofcontract Internet banking customers will continue to use other bank deliverychannels. Accordingly, national banks will need to make certain that theirdisclosures on Internet banking channels, including Web sites, remainsynchronized with other delivery channels to ensure the delivery of a consistentand accurate message to consumer protection laws and regulations, including CRA and FairLending, are applicable to electronic financial services operations includingInternet banking. Moreover, it is important for national banks to be familiarwith the regulations that permit electronic delivery of disclosures/noticesversus those that require traditional hard copy notification. National banksshould carefully review and monitor all requirements applicable to electronicproducts and services and ensure they comply with evolving statutory andregulatory and record-keeping requirements also apply to banks’ Web sitesand to the products and services offered. Advertisements should clearly andconspicuously display the FDIC insurance notice, where applicable, socustomers can readily determine whether a product or service is insured. Comptroller’s Handbook 9 InternetBanking
Regular monitoring of bank Web sites will help ensure compliance withapplicable laws, rules, and regulations. See the “Consumer ComplianceExamination” booklet of the Comptroller’s Handbook, OCC Bulletin 94-13,“Nondeposit Investment Sales Examination Procedures,” and OCC Bulletin 98-31, “Guidance on Electronic Financial Services and Consumer Compliance” formore of Bank Secrecy Act (BSA) requirements to cyberbanking productsand services is critical. The anonymity of banking over the Internet poses achallenge in adhering to BSA standards. Banks planning to allow theestablishment of new accounts over the Internet should have rigorous accountopening standards. Also, the bank should set up a control system to identifyunusual or suspicious activities and, when appropriate, file suspicious activityreports (SARs).The BSA funds transfer rules also apply to funds transfers or transmittalsperformed over the Internet when transactions exceed $3,000 and do not meetone of the exceptions. The rules require banks to ensure that customersprovide all the required information before accepting transfer instructions. Therecord keeping requirements imposed by the rules allow banks to retain writtenor electronic records of the Office of Foreign Asset Control (OFAC) administers laws that imposeeconomic sanctions against foreign nations and individuals. This includesblocking accounts and other assets and prohibiting financial transactions. Internet banking businesses must comply with OFAC requirements. A bankneeds to collect enough information to identify customers and determinewhether a particular transaction is prohibited under OFAC rules. See the FFIECInformation Systems Examination Handbook (IS Handbook) for a discussion RiskStrategic risk is the current and prospective impact on earnings or capitalarising from adverse business decisions, improper implementation ofdecisions, or lack of responsiveness to industry changes. This risk is a functionof the compatibility of an organization’s strategic goals, the business strategiesdeveloped to achieve those goals, the resources deployed against these goals,and the quality of implementation. The resources needed to carry out businessstrategies are both tangible and intangible. They include communicationInternet Banking 10 Comptroller’sHandbook
channels, operating systems, delivery networks, and managerial capacities andcapabilities. The organization’s internal characteristics must be evaluatedagainst the impact of economic, technological, competitive, regulatory, andother environmental must understand the risks associated with Internet banking beforethey make a decision to develop a particular class of business. In some cases,banks may offer new products and services via the Internet. It is important thatmanagement understand the risks and ramifications of these decisions. Sufficient levels of technology and MIS are necessary to support such abusiness venture. Because many banks will compete with financial institutionsbeyond their existing trade area, those engaging in Internet banking must have astrong link between the technology employed and the bank’s strategic introducing a Internet banking product, management should considerwhether the product and technology are consistent with tangible businessobjectives in the bank’s strategic plan. The bank also should consider whetheradequate expertise and resources are available to identify, monitor, and controlrisk in the Internet banking business. The planning and decision makingprocess should focus on how a specific business need is met by the Internetbanking product, rather than focusing on the product as an independentobjective. The bank’s technology experts, along with its marketing andoperational executives, should contribute to the decision making and planningprocess. They should ensure that the plan is consistent with the overallbusiness objectives of the bank and is within the bank’s risk tolerance. Newtechnologies, especially the Internet, could bring about rapid changes incompetitive forces. Accordingly, the strategic vision should determine the waythe Internet banking product line is designed, implemented, and RiskReputation risk is the current and prospective impact on earnings and capitalarising from negative public opinion. This affects the institution’s ability toestablish new relationships or services or continue servicing existingrelationships. This risk may expose the institution to litigation, financial loss,or a decline in its customer base. Reputation risk exposure is presentthroughout the organization and includes the responsibility to exercise anabundance of caution in dealing with customers and the ’s Handbook 11 InternetBanking
A bank’s reputation can suffer if it fails to deliver on marketing claims or toprovide accurate, timely services. This can include failing to adequately meetcustomer credit needs, providing unreliable or inefficient delivery systems,untimely responses to customer inquiries, or violations of customer bank’s reputation can be damaged by Internet banking services that arepoorly executed or otherwise alienate customers and the public. Welldesigned marketing, including disclosures, is one way to educate potentialcustomers and help limit reputation risk. Customers must understand whatthey can reasonably expect from a product or service and what special risksand benefits they incur when using the system. As such, marketing conceptsneed to be coordinated closely with adequate disclosure statements. Anational bank should not market the bank’s Internet banking system based onfeatures or attributes the system does not have. The marketing program mustpresent the product fairly and accurately. National banks should carefully consider how connections to third parties arepresented on their Web sites. Hypertext links are often used to enable acustomer to link to a third party. Such links may reflect an endorsement of thethird party’s products or services in the eyes of the customer. It should beclear to the customer when they have left the bank’s Web site so that there isno confusion about the provider of the specific products and services offered orthe security and privacy standards that apply. Similarly, adequate disclosuresmust be made so that customers can distinguish between insured and non-insured banks need to be sure that their business continuity plans include theInternet banking business. Regular testing of the business continuity plan,including communications strategies with the press and public, will help thebank ensure it can respond effectively and promptly to any adverse customer ormedia ManagementFinancial institutions should have a technology risk management process toenable them to identify, measure, monitor, and control their technology riskexposure. Examiners should refer to OCC Bulletin 98-3, “Technology RiskManagement” for additional guidance on this topic. Risk management of newtechnologies has three essential elements:Internet Banking 12 Comptroller’sHandbook
CThe planning process for the use of the of the means to measure and monitor OCC’s objective is to determine whether a bank is operating its Internetbanking business in a safe and sound manner. The OCC expects banks to use arigorous analytic process to identify, measure, monitor, and control risk. Examiners will determine whether the level of risk is consistent with the bank’soverall risk tolerance and is within the bank’s ability to manage and risk planning process is the responsibility of the board and seniormanagement. They need to possess the knowledge and skills to manage thebank’s use of Internet banking technology and technology-related risks. Theboard should review, approve, and monitor Internet banking technology-relatedprojects that may have a significant impact on the bank’s risk profile. Theyshould determine whether the technology and products are in line with thebank’s strategic goals and meet a need in their market. Senior managementshould have the skills to evaluate the technology employed and risks assumed. Periodic independent evaluations of the Internet banking technology andproducts by auditors or consultants can help the board and senior managementfulfill their the technology is the responsibility of management. Management should have the skills to effectively evaluate Internet bankingtechnologies and products, select the right mix for the bank, and see that theyare installed appropriately. If the bank does not have the expertise to fulfill thisresponsibility internally, it should consider contracting with a vendor whospecializes in this type of business or engaging in an alliance with anotherprovider with complementary technologies or and monitoring risk is the responsibility of should have the skills to effectively identify, measure, monitor,and control risks associated with Internet banking. The board should receiveregular reports on the technologies employed, the risks assumed, and howthose risks are managed. Monitoring system performance is a key successfactor. As part of the design process, a national bank should include effectivequality assurance and audit processes in its Internet banking system. The bankComptroller’s Handbook 13 InternetBanking
should periodically review the systems to determine whether they are meetingthe performance Controls Internal controls over Internet banking systems should be commensurate withan institution’s level of risk. As in any other banking area, management has theultimate responsibility for developing and implementing a sound system ofinternal controls over the bank’s Internet banking technology and products. Regular audits of the control systems will help ensure that the controls areappropriate and functioning properly. For example, the control objectives foran individual bank’s Internet banking technology and products might focus on:CConsistency of technology planning and strategic goals, includingefficiency and economy of operations and compliance with corporatepolicies and legal availability, including business recovery integrity, including providing for the safeguarding of assets,proper authorization of transactions, and reliability of the process confidentiality and privacy safeguards. CReliability of control objectives are established, management has the responsibility toinstall the necessary internal controls to see that the objectives are met. Management also has the responsibility to evaluate the appropriateness of thecontrols on a cost-benefit basis. That analysis may take into account theeffectiveness of each control in a process, the dollar volume flowing throughthe process, and the cost of the will need to understand the bank’s operational environment toevaluate the proper mix of internal controls and their adequacy. According tothe Information Systems Audit and Control Association (ISACA) the basicinternal control components include:Internet Banking 14 Comptroller’sHandbook
CInternal accounting controls — Used to safeguard the assets andreliability of financial records. These would include transaction recordsand trial balancesCOperational controls — Used to ensure that business objectives arebeing met. These would include operating plans and budgets tocompare actual against planned controls — Used to ensure operational efficiency andadherence to policies and procedures. These would include periodicinternal and external separates internal controls into three general categories. The threecontrol categories can be found in the basic internal controls discussed Controls — Prevent something (often an error or illegal act)from happening. An example of this type of control is logical accesscontrol software that would allow only authorized persons to access anetwork using a combination of a user ID and Controls — Identify an action that has occurred. An examplewould be intrusion detection software that triggers an alert or Controls — Correct a situation once it has been detected. Anexample would be software backups that could be used to recover acorrupted file or or service providers offering transaction-based Internet banking productsneed to have a high level of controls to help manage the bank’s transactionrisk. Examples of these controls could include:CMonitoring transaction activity to look for anomalies in transactiontypes, transaction volumes, transaction values, and time-of-daypresentment. CMonitoring log-on violations or attempts to identify patterns of suspectactivity including unusual requests, unusual timing, or unusual trap and trace techniques to identify the source of the request andmatch these against known customers. Comptroller’s Handbook 15 InternetBanking
Regular reporting and review of unusual transactions will help identify:CIntrusions by unauthorized parties. CCustomer input for customer : In-House or Outsourced?The different levels of complexity associated with certain areas involvingsecurity, operations, planning, and monitoring have caused many nationalbanks to outsource all or parts of their Internet banking operations. Banksshould periodically reassess their sources of technology support to determinewhether a given solution continues to fit their business plan and is flexibleenough to meet anticipated future needs. Regardless of whether technologyservices are provided in-house or through a third-party servicer, national banksneed to have a strong link between their technology provider and their strategicplanning process. This will enable the bank to link new products and serviceswith the existing technology and product mix. There are pros and cons to offering technology-based products and services in-house versus contracting with a vendor. Larger national banks with substantialresources may choose to purchase computer hardware and operating systemsand/or develop the necessary application software in-house. This option mayprovide the greatest flexibility to customize product offerings. Other banks may choose to purchase a “turnkey” system from a vendor. In thisarrangement the vendor typically provides the hardware, operating systems,and applications software necessary to enable the bank to offer the particularproduct or service to its customers. The vendor will typically provide theservice and maintenance for the turnkey system. A variation is to outsource theservice. Using this option, national banks contract with a vendor to operatetheir Internet banking Web sites at the vendor’s location. This option may beespecially well suited for banks that do not have the technical expertise todevelop this service in-house. However, such banks need to place additionalemphasis on their due diligence to ensure that security is not companies are responding to the developing markets for Web pages, Internet banking applications, and bill presentment and payment services. Internet Banking 16 Comptroller’sHandbook
Although many companies in this market are prosperous and well managed,some are start-up companies with unproven products, services, or trackrecords. National banks need to perform due diligence before selecting a vendor toprovide Internet banking services. They should have a formal serviceagreement with the vendor that clearly addresses the duties and responsibilitiesof the parties involved. National banks need to monitor their vendor’soperational performance, financial condition, and capability to stay currentwith evolving technologies. National banks typically fulfill their responsibilityto assure their vendors have sound internal controls by obtaining internal orthird-party audit reports. Examiners should refer to the IS Handbook for a complete discussion ofoutsourcing issues. Whatever the source of Internet banking technology,products, and services, it is important for the national bank to have personnelwith an appropriate level of specialized expertise, consistent with risk, tomonitor and manage the business. Issues in Internet BankingFinancial institutions, their card associations, and vendors are working todevelop an Internet payment infrastructure to help make electronic commercesecure. Many in the banking industry expect significant growth in the use ofthe Internet for the purchase of goods and services and electronic datainterchange. The banking industry also recognizes that the Internet must besecure to achieve a high level of confidence with both consumers management of banking products and services, especially those providedover the Internet, is fundamental to maintaining a high level of publicconfidence not only in the individual bank and its brand name but also in thebanking system as a whole. Key components that will help maintain a highlevel of public confidence in an open network environment include:CSecurityCAuthenticationCTrustCNonrepudiationCPrivacy Comptroller’s Handbook 17 InternetBanking
CAvailabilitySecurity is an issue in Internet banking systems. The OCC expects nationalbanks to provide a level of logical and physical security commensurate with thesensitivity of the information and the individual bank’s risk tolerance. Some national banks allow for direct dial-in access to their systems over aprivate network while others provide network access through the Internet. Although the publicly accessible Internet generally may be less secure, bothtypes of connections are vulnerable to interception and alteration. Forexample, hardware or software “sniffers” can obtain passwords, accountnumbers, credit card numbers, etc. without regard to the means of access. National banks therefore must have a sound system of internal controls toprotect against security breaches for all forms of electronic access. A soundsystem of preventive, detective, and corrective controls will help assure theintegrity of the network and the information it handles. See appendix C for adiscussion of online are frequently used on Internet banking systems as a security measureto protect internal systems and should be considered for any system connectedto an outside network. Firewalls are a combination of hardware and softwareplaced between two networks through which all traffic must pass, regardless ofthe direction of flow. They provide a gateway to guard against unauthorizedindividuals gaining access to the bank’s network. The mere presence of a firewall does not assure logical security and firewallsare not impenetrable: firewalls must be configured to meet a specific operatingenvironment and they must be evaluated and maintained on a regular basis toassure their effectiveness and efficiency. Individuals who are technicallycompetent must perform the installation, configuration, evaluation, andmaintenance of firewalls. The specific risks involved may require a broadrange of security controls. Appendix A contains a more detailed discussion offirewalls and associated IS Handbook discusses other logical and physical security controlsapplicable to Internet banking environments. Examiners should be familiarwith these controls before conducting a Internet banking is another issue in a Internet banking system. Transactions onthe Internet or any other telecommunication network must be secure to achieveInternet Banking 18 Comptroller’sHandbook
a high level of public confidence. In cyberspace, as in the physical world,customers, banks, and merchants need assurances that they will receive theservice as ordered or the merchandise as requested, and that they know theidentity of the person they are dealing with. Banks typically use symmetric (private key) encryption technology to securemessages and asymmetric (public/private key) cryptography to authenticateparties. Asymmetric cryptography employs two keys — a public key and aprivate key. These two keys are mathematically tied but one key cannot bededuced from the other. For example, to authenticate that a message camefrom the sender, the sender encrypts the message using their private key. Onlythe sender knows the private key. But, once sent, the message can be readonly using the sender’s public key. Since the message can only be read usingthe sender’s public key, the receiver knows the message came from theexpected sender. Internet banking systems should employ a level of encryption that isappropriate to the level or risk present in the systems. OCC is aware thatstronger levels of encryption may slow or degrade performance and,accordingly, management must balance security needs with performance andcost issues. Thus, a national bank should conduct a risk assessment indeciding upon its appropriate level of encryption. The OCC does not mandatea particular strength or type of encryption. Rather, it expects management toevaluate security risks, review the cost and benefit of different encryptionsystems, and decide on an appropriate level of encryption as a businessdecision. Management should be able to explain the supporting analysis fortheir common asymmetric cryptography system is RSA, which uses key lengths upto 1,024 bits. By using the two forms of cryptography together, symmetric toprotect the message and asymmetric to authenticate the parties involved, bankscan secure the message and have a high level of confidence in the identity ofthe parties involved. See appendix B of this handbook for examples of how thistechnology devices are an advanced form of authentication. These devices maytake the form of a retina scan, finger or thumb print scan, facial scan, or voiceprint scan. Use of biometrics is not yet considered mainstream, but may beused by some banks for authentication. Examiners should evaluate biometricComptroller’s Handbook 19 InternetBanking
activities based on management’s understanding of risks, internal or externalreviews, and the overall performance of these devices. Trust is another issue in Internet banking systems. As noted in the previousdiscussion, public and private key cryptographic systems can be used to secureinformation and authenticate parties in transactions in cyberspace. A trustedthird party is a necessary part of the process. That third party is the certificate authority is a trusted third party that verifies identities incyberspace. Some people think of the certificate authority functioning like anonline notary. The basic concept is that a bank, or other third party, uses itsgood name to validate parties in transactions. This is similar to the historicrole banks have played with letters of credit, where neither the buyer nor sellerknew each other but both parties were known to the bank. Thus the bank usesits good name to facilitate the transaction, for a fee. See OCC Bulletin 99-20,“Certification Authority Services,” for more information on this also may need a way to validate themselves in cyberspace, as theft ofidentity has taken place. According to GAO testimony (GAO/T-66D-99-34),perpetrators have copied legitimate brokerage-firm Web sites, altered addressesfor customers to contact (and send checks), then put the fraudulent Web siteback on the Internet. Except for the post office box and possibly the URL,everything on the Web site could appear legitimate. Banks will have to guardagainst a variety of frauds and scams as banking on the Internet becomes moreprominent. A proper mix of preventive, detective, and corrective controls canhelp protect national banks from these pitfalls. Digital certificates may play animportant role in authenticating parties and thus establishing trust in Internetbanking is the undeniable proof of participation by both the sender andreceiver in a transaction. It is the reason public key encryption was developed,., to authenticate electronic messages and prevent denial or repudiation bythe sender or receiver. Although technology has provided an answer to nonrepudiation, state laws arenot uniform in the treatment of electronic authentication and digital signatures. The application of state laws to these activities is a new and emerging area ofthe Banking 20 Comptroller’sHandbook
Privacy is a consumer issue of increasing importance. National banks thatrecognize and respond to privacy issues in a proactive way make this a positiveattribute for the bank and a benefit for its concerns over the proper versus improper accumulation and use ofpersonal information are likely to increase with the continued growth ofelectronic commerce and the Internet. Providers who are sensitive to theseconcerns have an advantage over those who do not. See OCC Advisory Letter99-6, “Guidance to National Banks on Web Site Privacy Statements,” for amore complete discussion of this is another component in maintaining a high level of publicconfidence in a network environment. All of the previous components are oflittle value if the network is not available and convenient to customers. Usersof a network expect access to systems 24 hours per day, seven days a week. Among the considerations associated with system availability are capacity,performance monitoring, redundance, and business resumption. Nationalbanks and their vendors who provide Internet banking products and servicesneed to make certain they have the capacity in terms of hardware and softwareto consistently deliver a high level of service. In addition, performance monitoring techniques will provide management withinformation such as the volume of traffic, the duration of transactions, and theamount of time customers must wait for service. Monitoring capacity,downtime, and performance on a regular basis will help management assure ahigh level of availability for their Internet banking is also important to evaluate network vulnerabilities to prevent outages dueto component failures. An entire network can become inoperable when asingle hardware component or software module malfunctions. Often nationalbanks and their vendors will employ redundant hardware in critical areas orhave the ability to switch to alternate processing locations. The latter is oftenreferred to as contingency planning. This topic is covered at length in the addition to these issues, appendix D contains some discussion pointsexaminers can use in national banks that are contemplating engaging in ’s Handbook 21 InternetBanking
Internet Banking Examination Procedures General ProceduresThe objective of these examination procedures is to determine the adequacy ofthe institution’s policies, procedures, and internal controls as they relate toInternet banking. The extent of testing and procedures performed should bebased upon the examiner’s assessment of risk. This assessment should includeconsideration of work performed by internal and external auditors, formalpolicies and procedures, and the effectiveness of internal controls andmanagement information systems (MIS).Examiners should use the FFIEC Information Systems Examination Handbookand related OCC issuances for additional information and guidance asreferenced in these procedures. It may not be necessary to complete all the procedures. When planning,examiners should determine the extent of the bank’s reliance on externalvendors for Internet banking operations and/or monitoring activities. Procedures to evaluate outsourced activities are incorporated in these : To set the scope for assessing the quantity of risk and quality of riskmanagement in Internet banking. the following documents to identify any previously notedproblems related to the Internet banking area that require follow-up: CPrevious examination reports (Asset Management, BIS,Commercial, Compliance, etc.).CSupervisory scope -up papers from previous and external audit Banking 22 Comptroller’sHandbook
CCorrespondence.(Note: If an examiner is assigned Internal and External Audit, a copy ofany significant deficiencies for this area should be obtained from thatexaminer. If internal and external audit is not part of the overall scopeof the examination, review the work performed by the internal andexternal auditors in this area and obtain a list of any deficiencies notedin their most recent review.) the completeness of requested information with the request other reviews, assessments or system certifications performed byinternal/external auditors, consultants, or technology experts contractedby the bank. Note any outstanding whether external vendors are used and what services orproducts are provided. Examiners should document the major entitiesresponsible for development, operation, and/or support of all or portionsof Internet banking documentation and conduct early discussions with managementto determine:(Note: Consultation with examiners responsible for reviewing overallbank information security should be performed and work papersreviewed to avoid any redundancy in reviewing security controls.)CHow security for Internet banking is management supervises Internet banking functions, including those functions that are significant changes in policies, practices, personnel, orcontrol internal or external factors that could affect the Internetbanking the bank’s business and strategic plans to determine whethermanagement’s plans for the Internet banking business are clear andreflect the current direction of the ’s Handbook 23 InternetBanking
whether management has incorporated Internet banking aspart of contingency and business resumption an understanding of the bank’s Internet banking business anddisclosures by reviewing the bank’s Web site(s). on the performance of the previous steps, combined withdiscussions with the EIC and other appropriate supervisors andexaminers, determine the scope and objectives of this examination procedures are performed, test for compliance withestablished policies or practices and the existence of appropriateinternal control processes. Identify any area with inadequatesupervision and/or undue risk, and discuss with the EIC the need toperform additional from among the following examination procedures the steps that arenecessary to meet examination objectives. An examination will seldomrequire every step to be Banking 24 Comptroller’sHandbook
Quantity of Risk Conclusion: The quantity of risk is (low, moderate, high).Internet Banking Products and ServicesObjective: To gain an understanding of the type and volume of the bank’s Internet banking product line, transaction flow and settlement a description or diagram of the configuration of the Internetbanking system and its capabilities. Consider hardware, software,points of connectivity to internal systems, and remote access points. Tohelp determine the level of risk, evaluate:CHow the Internet banking system is linked to other host systemsor the network infrastructure in the transactions and data flow through the type(s) of telecommunications channels and remote accesscapabilities (direct modem dial-in, Internet access, or both) the current types, volumes, and complexity of retail, wholesale,and fiduciary products and services in the bank’s Internet bankingproduct and services systems and network architecture to identify access points andpotential areas of discussion with management, note any changes in the type,volume or complexity of products or services expected in the next Internet banking marketing strategies to determine whetherplans include expansion into new markets, product lines, or ’s Handbook 25 InternetBanking
from management an overview of transaction and paymentservices flow and settlement processes and determine whether: CManagement understands the transaction flow and settlementprocesses between the parties bank’s settlement responsibilities are clearly on the settlement process, the bank assumes additionalcredit risk caused by settlement time vendor’s policies address uncollected funds, settlement,backup, contingency, customer service, and disaster is adequate exception the transaction and payment services products and determinewhether adequate control features are built into the systems to ensureauthentication of the user, data integrity, and confidentiality oftransactions. the extent of the company’s use of an Automated ClearingHouse (ACH) for the Internet banking products and determine whetherthe bank has adequate ACH controls. (See the FFIEC Information SystemsExamination Handbook for guidance.) key MIS reports provided and whether they are adequate toproperly manage Internet banking transaction and payment whether a risk assessment or audit has been performed onany vendors supporting the transaction or payment services Banking 26 Comptroller’sHandbook
Compliance with Laws, Rules, and RegulationsObjective: To assess the bank’s compliance with applicable banking whether the bank is subject to notification requirementsoutlined in the Bank Service Corporation Act, section 1867(c)(2). (Anexample may include banks with investment in or partnerships withInternet service providers). whether the bank is staying informed on legal developmentsassociated with Internet the findings from the most recent examinations (assetmanagement, BIS, commercial, compliance, etc.) and theinternal/external audit for issues associated with the institution’s Internetbanking products and services. If applicable, determine whethermanagement has corrected any identified whether the FDIC notice is appropriately displayed andwhether uninsured products or services are clearly designated (12 CFR328). whether reporting is in place to identify potential moneylaundering activities associated with Internet banking whether Office of Foreign Asset Control (OFAC)identification and reporting capabilities are maintained for Internetbanking products and a way to expedite possible litigation and investigation resultingfrom security breaches, determine whether management has establisheda warning banner for users, announcing that intruders are accessing aprivate computer and that unauthorized access or use is not permittedand constitutes a crime punishable by law (18 USC 1030). the bank is aware of computer-related crimes (see AL 97-9, “ReportingComputer-Related Crimes,” for guidance), determine whether asuspicious activity report was ’s Handbook 27 InternetBanking
whether the bank is providing accurate privacy disclosuresassociated with its Internet banking product Banking 28 Comptroller’sHandbook
Quality of Risk ManagementConclusion: The quality of risk management is (weak, acceptable, or strong).Policy and Strategic PlanningObjective: Determine whether the board of directors has adopted effective policiesfor Internet banking that are consistent with safe and sound banking practicesand are appropriate to the size of the bank and the nature and scope of whether Internet banking security policies include:CClear lines of responsibility for system security: -Review the duties of the security administrator anddetermine whether they are knowledgeable of internalsecurity policies and controls.-Determine whether their authority as security administratoris adequate to dictate controls and enforce and data access whether Internet banking firewall policies address:CResponsibility for firewall maintenance and -defined access rules that dictate what traffic is allowed or whether encryption is adequately addressed in the securitypolicy, noting whether the policy includes:CWho is responsible for control of encryption encryption is classification ’s Handbook 29 InternetBanking
CUse of encryption to protect transmission of passwords,messages, or data during internal and open networkcommunications a public key cryptographic system is used, determine whether privatekeys are under the control of the bank and determine whether policiesand controls have been established that address private key management. Note whether policies or procedures address the following points:CManagement of keys generated by the bank or a third of secret or private key has access to the keys and how the environment private key escrow arrangements exist, how they are and practices for proper revocation and reissuance oflost, compromised, or expired of keys on a server or computer that have no connectionto outside networks. whether policies establish the use of virus detection softwareand note the products whether security policies are periodically reviewed and updatedand note whether the board of directors or senior managementcommittee approves the policies. whether the institution has established policies over hypertextlinks that enable consumers to clearly distinguish:CInsured and non-insured financial versus non-bank leaving the bank’s Web Banking 30 Comptroller’sHandbook
ProcessesObjective: Determine whether processes and practices, including internal controls,are the bank’s short and long term strategies for Internet bankingproducts and services through discussion with management and reviewof technology plans. Consider the following in assessing the bank’splanning process:CWhether Internet banking is consistent with the bank’s overallmission, strategic goals, and operating level of oversight provided by the board of directors andsenior ’s understanding of industry standards to ensurecompatibility and interoperability of cost and benefit analyses of Internet banking activitiesconsider start-up, operating, upgrade, customer support, andmaintenance ’s evaluation of security risks, threats, institution’s internal expertise and technical trainingrequirements. CThe status of Y2K compliance issues as they relate to Internetbanking ’s attention to system security monitoring and testingand performance ’s knowledge of and adherence to federal and statelaws, regulations, and interpretations as they pertain to Internetbanking technology and electronic commerce. whether management has an adequate process to periodicallyevaluate its Internet banking product mix and marketing successes, andlinks those findings to its strategic planning the adequacy of the bank’s process for performing security risk assessments including whether it:Comptroller’s Handbook 31 InternetBanking
CIdentifies threats and vulnerabilities associated with critical applications or required security controls. CConsiders internal expertise and the need for external consultationor support. the process the bank employs to ensure reliable and accuratenetwork and data access control. Vendor management’s due diligence activities prior to vendor whether:CStrategic and business plans are consistent with management and the board of directors are involved inoutsourcing decisions and vendor information was gathered and analyzed prior to whether management considers:-Vendor reputation.-Financial condition.-Costs for development, maintenance, and support.-Internal controls and recovery processes-Service level agreements.-Vendor and bank management whether the bank has reviews vendor contracts to ensure thatthe responsibilities of each party are appropriately whether contracts address topics in the “Contracts” section ofthe FFIEC Information Systems Examination Handbook. Note whethervendor contracts provide or consider:CDescription of the work to be performed or service for costs and description of additional communications and availability, transmission security,and transaction Banking 32 Comptroller’sHandbook
CAudit rights and plans for service recovery and data backup andprotection for data and confidential treatment of and software upgrades and price of financial and problem penalty and cancellation of contract . Determine whether the bank obtains and reviews internal or externalaudit reports evaluating vendor management processes or specificvendor relationships as they relate to information systems whether management designates personnel responsible forvendor management. Note management’s responsibilities and whetherthey are held accountable for monitoring activities and the institution is a provider of Internet banking software products,determine whether management has an adequate process to determinewho maintains the program source code. the institution obtains software products from a vendor, determinewhether the bank has an adequate process to ensure that softwaremaintained by the vendor is under a software escrow agreement and thatthe file is confirmed as being current on a regular the vendor has dial-in capability to the bank’s systems for diagnosticor maintenances purposes, determine whether the bank has an adequateprocess to ensure that the vendor’s activities are well controlled andwhether fidelity insurance extends to the vendor’s the adequacy of the process for password administration forInternet banking systems. Consider the following:Comptroller’s Handbook 33 InternetBanking
CThe adequacy of control and security over the bank’s process forissuing passwords to customers. CWhether alphanumeric passwords are required length of passwords. CWhether passwords have an automatic expiration. CIf adequate procedures are in place for resetting automatic log-off controls exist for user excessive failed access attempts by the user the adequacy of the process used to select how passwords areemployed to authenticate users including whether:CControls combine passwords with other -only log-in is used for access control andauthentication. CPassword-only log-in is used for public network (Internet) access. If so, determine whether the institution has compensating controlsto authenticate the process management uses to determine the appropriate typeof Web site (informational, communicative, or transactional) for thebank’s Internet-based banking whether the institution has a sound process to ensureadequate control over the path between the Web site and theinstitution’s internal networks or computer the process management employs to ensure that the firewall,if used, prevents unauthorized access to internal networks and computersystems. the firewall was commercially purchased, determine whetherthe bank has an adequate process to ensure that theresponsibilities of the bank and vendor are well defined. Internet Banking 34 Comptroller’sHandbook
the adequacy of the administration of the bank’s firewallconfiguration and whether it ensures that: CSoftware change control procedures are provide timely fixes or upgrades and whethermanagement implements them in a timely in firewall configuration are tested prior system control features have been system software default settings are adequate. whether the bank has an adequate process for:CConducting penetration testing and the qualifications of the company/person performingthe whether the bank has an effective process to assess theadequacy of physical controls in place to restrict access to firewallservers and whether the institution has an adequate process to identifyany remote access, other than through a firewall, and how managementmonitors and controls that the adequacy of the institution’s process to restrict access tofirewall configuration documentation. Physical whether the bank has an adequate process to address physicalsecurity for hardware, software, and data communications equipmentassociated with the Internet banking system including:CWhether the network servers are the institution prevents unauthorized physical access the bank secures vendor owned proper physical controls are in place for the data center or otherlocation housing equipment and documentation. Comptroller’s Handbook 35 InternetBanking
Transaction Verification whether the bank has an adequate process to verifytransactions to avoid claims of repudiation by bank and whether the bank has an adequate process to selectencryption appropriate for its environment and whether the encryptionselected is structured upon public, private, or a hybrid encryptionsystem. Note the following:CThe type of algorithm used and what it is used bank uses a proprietary or unknown key length used for encryption, ., encryption is used to secure passwords duringtransmission or encryption is used to protect sensitive stored the bank engages in international banking activity, determine whetherthe bank is aware of . government exportation policies and relatedrestrictions controlling the exportation and use of encryption whether the bank has an adequate process regarding thecollection and use of personal information necessary to protect customerprivacy (see AL 99-6).Virus Detection and whether the bank has an adequate process regarding virusdetection and prevention associated with the Internet banking systems. Consider whether: CUser awareness efforts address last risk assessment and/or audit reports identified anydeficiencies in virus controls. CThe frequency with which anti-virus products and definitions areupdated and whether the most current version/release is Banking 36 Comptroller’sHandbook
whether the bank has an adequate process regarding virus detection and prevention. Consider whether:CVirus detection software distribution is made through downloadsfrom the bank’s bank’s software distribution process provides for virusdetection/prevention. Business Resumption and Contingency Planning whether there is an adequate process to develop and reviewthe bank’s business impact analysis. Consider whether:CInternet banking is viewed as a critical business or product line. CManagement has reviewed the impact to the bank’s reputation ifits Internet banking products and services are not whether the bank has an adequate process to develop and testthe contingency and business resumption plans for Internet bankingproducts and services including whether:CThe contingency and business resumption plans provideadequately for and business resumption plans are appropriatelytested on a regular basis. 3. Determine whether the bank has an adequate process in place forInternet banking recovery including whether:CInternet banking contingency and business resumption plans arereviewed and updated personnel and staff are responsible for initiating andmanaging Internet banking recovery plan ensures that single points of failure for critical networkpoints are adequately plan establishes strategies to recover hardware, software,communication links, and data ’s Handbook 37 InternetBanking
CAdequate back up agreements and contracts are in place forexternal vendors or critical suppliers and if these backuparrangements are tested response process assures that senior management and theboard of directors are made aware of adverse events as dictatedby the severity of damage and monetary loss. COutreach strategies are adequate to inform the media andcustomers of corrective liability issues are contemplated and addressed as part ofresponse are in place to bring security breaches to the attentionof appropriate management and external entities (., ComputerEmergency Response Team (CERT), FBI, OCC, etc.). 4. Determine whether the bank has an adequate process to review theresults of the most recent contingency and recovery plan testingincluding whether management: CRequires annual testing of recovery processes and adverse test results in a timely the board or executive management of test : Given the size and complexity of the bank, determine whether bankmanagement and personnel display acceptable knowledge and technical skillsto manage Internet discussions with management, determine their level oftechnical knowledge and assess the adequacy of that knowledge for thesize and scope of the bank’s Internet banking technology related training programs and security awarenessefforts including whether: CManagement provides timely technical training opportunities. CManagement measures the effectiveness of security staff and Internet banking users are aware of securityresponsibilities and bank Banking 38 Comptroller’sHandbook
CManagement relies, solely or in part, on external vendors fortechnical expertise. Comptroller’s Handbook 39 InternetBanking
ControlsObjective: Determine whether management has instituted controls that areappropriate to the type and level of risks arising from Internet Signatures and Certificate Authorities (CA) whether management requires use of digital signatures toauthenticate the bank, users, and . Determine whether digital signatures are issued, managed, and/orcertified by an external the bank is acting as its own certificate authority note:CWhether the digital signature system is open or the bank has written policies and procedures forissuance, renewal, and revocation of the institution establishes and verifies credentials administrative reporting systems are adequate to providefor directory lookup and auditing (., time stamping).CWhether the CA facility or area is adequately secured includingwhether:-Controls are in place to protect servers housing CAinformation and directories.-Contingency plans accommodate customer needs in case ofsystem failure or disaster.-The bank has addressed the legal implications of providinga CA function.-The CA conforms to established standards (., NIST orIETF).-An audit process is in place. CWhether limitations have been established for certificates such as:- The number of transactions.- The type of transactions.- Expiration the CA establishes classes of certificates based onmessage or transaction the bank is staying current on applicable Banking 40 Comptroller’sHandbook
CWhether the bank periodically performs a cost/benefit analysis ofthe whether the institution uses biometric devices forauthentication whether a risk assessment, audit, or cost/benefit analysis hasbeen performed of biometric devices used for authentication whether acceptable biometric tolerances and policies havebeen established for authenticating the transaction to be processed. and review management reports that address statisticalperformance of the biometric authentication devices in . Discuss with management the techniques used to monitor the security ofInternet banking systems. Obtain and review sample reports such as:CPenetration test scope and violation -Real-time intrusion detection reports. CReports depicting security breaches or system whether security analysis software is used and note whether management conducts or has employed outsidevendors to conduct penetration testing. Assess whether:CAn objective party performs penetration performing the tests are appropriately testing is performed at least annually or at anacceptable frequency based on management’s risk analysis andrisk information and documentation is strictly ’s Handbook 41 InternetBanking
how management monitors and detects internal or external network intrusion including whether:CMonitoring software is used to track real-time network qualified individual is responsible for regularly monitoringnetwork logs are maintained and reviewed on a regular detection techniques allow for immediate notification ofnetwork administrators or security policies define reportable are incorporated to assure appropriate levels ofmanagement, directors, and external authorities are through review of reports or inquiries of managementwhether the bank has experienced any of the following occurrences. Ifso, document in work papers:CAny alteration of the bank’s home unauthorized access from external or internal damage incurred as a result of any unauthorizedintrusion. If losses have been sustained, determine if the bankfiled a suspicious activity report per OCC Advisory Letter 97-9,“Reporting Computer-Related Crimes.” whether management has emergency response proceduresand evaluate whether they are effective in handling an unauthorizedintrusion. Discuss and document controls for remote access includingwhether:CSecurity policies address remote is aware of policies and adherence is logs are maintained to monitor remote how management monitors system performance (.,transaction volume, response times, availability/downtime, capacityreports, and customer service logs and complaint summaries).Internet Banking 42 Comptroller’sHandbook
how management projects future systems needs to ensurecontinued availability of the network to meet customer Support1. Evaluate the role and quality of customer service and support for Internetbanking products and services. the organization and responsibilities of the customer whether the customer support service is outsourced. If so,note the responsibilities of the vendor and determine how managementmonitors customer problems, demands, or complaints. whether customer service levels have been established. If so,determine how management monitors adherence to service how management assesses the adequacy of customer reviews of problem logs or customer service reports anddiscussion with management, determine whether deficiencies exist inthe whether customer service is considered in Internet bankinggrowth projections and resource planning. Software whether program change controls exist and whether they areadequate to prevent unauthorized software alterations including whether:CApproval procedures exist to initiate program changes andwhether they are at critical points throughout the are followed for emergency and temporary softwarefixes, and new control documentation provides adequate audit trails andsupport for software changes. Comptroller’s Handbook 43 InternetBanking
2. Evaluate version control and software distribution procedures associatedwith Internet banking applications including: CThe adequacy of software distribution (automatic download, userinitiated download, or manual delivery).CWhether adequate controls are in place to guard against virusinfection during distribution and to ensure the integrity ofsoftware. CWhether software testing is performed prior to distribution. Audit whether the scope of internal or external audit coverageincludes Internet whether a risk assessment or audit has been performed onkey management practices. Review applicable reports. whether internal audit is or was involved in planning andimplementing the Internet banking available, obtain internal or external audit reports (including Type IISAS 70 reviews) that evaluate vendor management processes or specificvendor relationships as they relate to information systems management reports or conduct interviews with management to determine whether vendor controls have been evaluated. Determine whether management has considered the adequacy of:CSecurity controls and reporting including whether managementunderstands and has evaluated security for access control, userauthentication, and data monitoring activity including whether the vendorperforms real-time intrusion detection and penetration testing ofoffsite or in-house levels and the vendor’s ability to meet Banking 44 Comptroller’sHandbook
CTesting activity by the vendor prior to product distribution. CVirus detection planning and business resumption the bank outsources its Internet banking processing, determine thename of the vendor(s) employed and whether the bank has obtained andreviewed the regulatory agency examination report of the vendor. whether the audit function reviews the consistency betweenthe bank’s disclosed security and privacy standards and actual Service Providers (ISP) whether the bank relies on a third party Internet serviceprovider (ISP) to support access to Internet banking services. If so, notewhether management’s supervision of the vendor includes: CDetermining whether performance meets service levelagreements. CRequiring the ISP to monitor bank Internet links and report tothem when these links are down or the ISP’s contingency planning and business whether the ISP has adequate support whether the bank is subject to differing serviceaccess types that may cause less than acceptable support. CDetermining whether the ISP provides bank-defined filtering orestablishes its own firewall-filtering whether the ISP has sound controls over changes tothe bank’s Internet the soundness of the ISP’s financial the ISP’s security standards and whether the bank has alternate data communications paths inthe event the primary ISP is unable to handle the bank’s Internet trafficdue to a malfunction or inadequate ’s Handbook 45 InternetBanking
Conclusion ProceduresObjective: Communicate findings and initiate corrective action on violations andother a summary memorandum detailing the results of the Internetbanking examination. Draft conclusions on:CThe quantity of quality of risk direction of extent to which risk management practices affect address in the summary memorandum:CAppropriateness of strategic and business and adherence to of with applicable laws, rules, and of internal corrective action regarding deficient policies,procedures, practices, or other institution’s Internet banking matters of examination findings and conclusions with the EIC. Ifnecessary, compose “Matters Requiring Board Attention” (MRBA). MRBAs should cover practices that: CDeviate from sound fundamental principles and are likely to resultin financial deterioration if not in substantive noncompliance with laws or should discuss:CCauses of the of Banking 46 Comptroller’sHandbook
CManagement’s commitment to corrective time frame and person(s) responsible for corrective findings with management including conclusions regardingapplicable risks. If necessary, obtain commitments for corrective appropriate, prepare a Internet banking comment for inclusion in thereport of a memorandum specifically stating what the OCC should do inthe future to effectively supervise Internet banking in this bank. Includesupervisory objectives, time frames, staffing, and workdays the electronic information system and any applicable report ofexamination schedules or the examination work papers in accordance with OCC ’s Handbook 47 InternetBanking
Internet Banking Appendix A Firewalls and Associated ControlsThe purpose of this appendix is to provide background material on thefundamentals of firewalls and their use in banking and electronic and other readers of this section should familiarize themselves withthe FFIEC Information Systems Examination Handbook (IS Handbook) chapterson Security and Networking. This discussion assumes a knowledge of thecontent of the IS Handbook, specifically the section dealing with needs to understand the capabilities and functionality of thefirewall and make sure that their systems are configured appropriately for thebank’s business needs. Ongoing monitoring of the firewall ensures that theappropriate functions and utilities are activated to protect the institution andprevent attacks against known system weaknesses. Institutions that do not havethe expertise to design, install, and test firewalls should seriously considerengaging professionals to perform this function. Due care should be exercisedwhen selecting the vendors to perform these functions and sound internalcontrols should be in place along with audits to verify the vendor’s activitieswith the firewall. The institution should periodically engage an independentsource to test the firewall for weaknesses. This includes annual, or morefrequently as circumstances warrant, penetration testing to ensure controls areappropriate to the type and level of risk arising from the institution’s Internetbanking products and services. A firewall is hardware and software placed between two networks. The intentis for all network traffic, regardless of the direction of flow, to pass throughthis firewall. The firewall then can check all traffic to make sure it isauthorized and prevent unwanted traffic from entering the system. The firewallalso can check the traffic to determine whether it contains any unauthorizedattachments, such as viruses. Firewalls need to be efficient to catch any trafficthat is unauthorized in order to prevent potential harm to the institution. Network isolation is a function of firewalls. A domain name server convertspublicly known addresses into internal addresses that are not publicly known. This is sometimes referred to as a “bastion host.” The feature preventsintruders from gaining access to internal names and addresses on the bank’sInternet Banking 48 Comptroller’sHandbook
internal network. External devices attempting to access internal addresses aresuspect and should be screened screening is another of the functions of a firewall. This function isused to filter-out messages with inappropriate source addresses. For example,this function would screen out messages with internal system addresses. Messages that have not gone through a domain name server should not haveinternal addresses and would be suspect. Such traffic should not be allowed topass through the screening is a firewall function used to prevent inappropriateinstructions from entering the system or an unauthorized access to theadministrator level of the server. A “proxy server” is a device used to test thesystem’s “rules” to prevent deviations from the established flow inspection or state full inspection is a function of a firewallused to detect inappropriate responses by the system. The system creates adatabase and looks for inappropriate responses by a server to messages orinquiries. For example, if a request asks for account balance information andthe response is to transfer funds, the “state full inspection” will recognize aninappropriate response and terminate the controls normally work in tandem with firewalls. These controlsinclude logical access controls and physical security. The reason thesecontrols are important is that insiders represent the greatest threat to bankcomputer systems and data communications networks. Various studies reflectthat nearly 70 percent of intrusions originate within the organization. Insidershave knowledge of the system or network and may have the opportunity tooriginate an unauthorized transaction either by accident or intent. Access tosystems, networks, and information should be on a “need-to-know” basis. Banks also need to provide protection from employee ignorance such as sharingpasswords and running outside software without virus logical access control includes a user identification and a password. Anindividual’s user ID might be J. Examiner. But each user should also have aunique password composed of at least 6-8 alphanumeric characters; more isbetter. It is important to avoid using passwords that are easily discerned. Names, addresses, or words found in the dictionary, any language, spelledforward or in reverse should be avoided. One option is to use mnemonics —Comptroller’s Handbook 49 InternetBanking
something that is easy to remember but difficult to guess. An example of amnemonic is the following phrase; “Examiners are curious, bright people.” Themnemonic is EACBP. By adding some numbers and/or special characters, apassword can be created that is easy to remember but difficult to discern. SeeOCC Bulletin 98-38 “Technology Risk Management: Internet Banking” and theIS Handbook for a more complete discussion of logical access security andcontrols. Physical security also is an important control function in protecting a bank’sdata communications networks and internal accounting systems. Networkhardware should be stored in secure locations so that it is accessible only toauthorized personnel. This is a preventive control to protect the bank’s assetsand protect the institution from transaction, reputation, and strategic computers connected to a network should have sound logical accesscontrols. This includes a password feature to access the network and time-outpassword controls to protect the network when a particular PC is unattended,even for brief periods of should consider the feasibility of centrally controlled modem pools. Controlling the placement and access to modems attached to a bank’s networkwill help the bank limit access to only authorized individuals. Banks shouldspecifically guard against unauthorized modems that employees may attach totheir PCs which are connected to the bank’s data communication network. These unauthorized modems can be targets of “random dialing” efforts and canbe a vulnerable entry point into the bank’s of day controls can be used to restrict access to a bank’s network tocertain, preauthorized times. The objective is to limit the opportunity for after-hours access except as authorized by the network administrator. Decisions onthis type of control will be based on the types of business the bank is engagedin and the need for access to its internal networks. Well-defined policies will help a bank develop a sound system of controls andultimately reduce the vulnerability to penetration. Well-defined controlobjectives will help the systems administrator or vendors to properly configurethe firewall. Such policies also will give auditors a standard to measureagainst when performing tests. Some considerations for bank firewall policiesinclude:Internet Banking 50 Comptroller’sHandbook
CCommunicating the bank’s policy with respect to monitoring employeeuse of data communications networks, including electronic mail and virus checking for all diskettes or downloads from other thanauthorized sources. Even diskettes received from other employees canbe contaminated with a virus and should be scanned before use,especially on a PC connected to the bank’s the bank’s policy for the access to PCs and the bank’snetwork after hours for uses that are not related to employees of the consequences of violating the institution’snetwork usage access to and use of administrator level capabilities of thefirewall hardware and periodic review of the vulnerabilities of the bank’s firewallsfrom known threats including, penetration logging and reviewing all auditing techniques are appropriate to determine whethereffective policies are in place and whether the system of controls over thebank’s networks are working as intended. The controls and audits of firewallsneed to be performed on a regular basis. Firewall systems are dynamic andneed regular reviews to ensure protection from newly identified vulnerabilitiesand system weaknesses. Once the internal or external auditor gains a sound understanding of the bank’snetwork configuration and types of business, he or she may decide to performvarious tests to ensure the soundness of logical access controls. This mightinclude testing default settings to determine whether only authorized firewallfunctions are permitted. The auditors might use audit software to scan theactivity logs looking for anomalies or unusual activity. They might review thescreening of employees who developed or installed the network. The auditorsComptroller’s Handbook 51 InternetBanking
might also review the frequency of password changes for employees authorizedaccess to a bank’s data communications network. Depending on the level of Internet banking employed, the bank will want toconsider engaging outside experts to review their security measures and offerrecommendations for enhancements. This type of review should be consideredat least annually for transaction systems and somewhat less frequently forcommunicative and informational will find a more complete discussion of these issues in the Banking 52 Comptroller’sHandbook
Internet Banking Appendix B CryptographyThis appendix provides background material on the fundamentals ofcryptography and the uses of encryption in banking and electronic , including banking, is shifting from paper based or physical processesto electronic based or digital processes. This includes retail delivery ofproducts and services, electronic data interchange, wholesale funds transfer,clearing, settlement, and Internet banking. Bank managers will need to engineersound controls into these new business models to manage risk. While all ofthis is taking place, the basic needs for data privacy, trust, and verification willcontinue in the digital world as it has in the physical world. Encryption offerspossible Kinds of EncryptionTwo different kinds of encryption exist with two separate purposes. Onepurpose is to keep information private. The other is to verify the identity ofparties in a transaction. Both kinds of encryption are typically used together toboth protect messages and validate the parties involved. Each is governed byindustry standards. Vendors provide the encryption technology as softwareproducts or as part of specific hardware devices. These two fundamental typesof encryption are symmetric and , also known as secret key cryptography, requires both the sender andreceiver to have the same key (the integers that drive the encryption algorithm). The diagram on the following page shows how the process works. The sender encrypts the message and the receiver decrypts the message using the same key. One of the most commonly used systems of this type is the Data EncryptionStandard, or DES. The . Government adopted this IBM- developedtechnology in 1977. It is widely used and operates on a minimum 56 bit (binarydigit) base key. Some institutions will use Triple-DES where the message isencrypted three times to enhance its resistance to ’s Handbook 53 InternetBanking
Sender Receiver Encrypt Decrypt+))))))))))))))))))), +)))))))))))))))), +))))))))))))))))) , Unencrypted Text ))))=<)))))) Encrypted Text )))))))=<))))) Unencrypted Text .)))))))))))))))))))- .))))))))))))))))- .))))))))))))))))) - DES Encryption Key DES Encryption KeyThe advantages of secret key cryptography are that it is secure, widely used, andfast. The disadvantages are that key administration is complex, requiring bothparties to maintain absolute control over exchanging keys, it does not include aseparate authentication mechanism, and there is no non repudiation (undeniableproof of participation of the sender and receiver). In addition, somecryptographic systems are subject to export restrictions from the . Asymmetric, also known as public/private key cryptography, employs two keys. As noted in the following diagram, in order to secure a message the senderperforms the encryption using the recipient’s public key. However, the receivercan only read the information using their private key. Often the literature refersto this technology as two key cryptography. A popular public key technology isRSA. Ron Rivest, Adi Shamir, and Leonard Adleman developed RSA in 1977. The primary use of RSA is for authentication and the secure exchange ofencryption keys and digital signatures. Key length can vary from 40 to 1,024bits. Sender Receiver Encrypt Decrypt+)))))))))))))))))), +))))))))))))))), +)))))))))))))))))), Unencrypted Data )))=<))) Encrypted Data )))))))=<))))) Unencrypted Data .))))))))))))))))))- .)))))))))))))))- .))))))))))))))))))- RSA Public Key RSA Private Key Internet Banking 54 Comptroller’sHandbook
Some of the advantages of public key cryptography over private key cryptographyare that it simplifies key administration. For example, there is no requirementfor a prior relationship between the sending and receiving parties. In addition,the key lengths can be much longer than DES. According to the vendors, thismakes public key cryptography stronger. It also provides for non repudiation. The major disadvantage is that public key is much slower than private keycryptography. Thus, it is used primarily to authenticate messages rather thanencrypt an entire message. How Encryption Works in PracticeEncryption may be used to both secure the message and authenticate the sender. The normal approach is to use the asymmetric and symmetric encryptiontechnologies in tandem. Symmetric encryption is typically used for encryptinglarge volumes of information and asymmetric encryption is for authentication. This is because the symmetric technology is up to 10,000 times faster than theasymmetric technology. The following is an example of how this works:If FNB wants to send a secure message to its correspondent, FNB needs todo two things. First, FNB needs to make sure the message is secure. FNBmight do this by using DES or Triple DES (symmetric or secret key) toencrypt the message.+))))))))))))))))), +)))))))))))))))), Unencrypted Text )))))))))=<))))))))) Encrypted Text .)))))))))))))))))- .))))))))))))))))- DES Encryption Second, FNB will authenticate themselves thus providing an assurance to thecorrespondent that the message came from FNB. FNB does this by using a hashfunction (a mathematical function derived from the message) to create a messagedigest from the text. Using RSA (asymmetric or public/private key), FNB thenencrypts the message digest using its RSA private key. The correspondent canonly read the encrypted message digest using FNB’s public key. Thus, therecipient knows the message came from ’s Handbook 55 InternetBanking
+)))))))))))))))), +))))))))), +)))))))))), +)))))))))))), Encrypted Text ))))))) Hash )))) Digest )))))=<))))) Signature .))))))))))))))))- .)))))))))- .))))))))))- .))))))))))))- Encrypted Text Hash Function Message Digest RSA Encryption Digital SignatureWhen the correspondent receives the message, the correspondent then usesFNB’s public RSA key to decrypt the message digest. The correspondentcompares the decrypted hash total to one they have independently calculatedfrom the message. If the hash totals agree, the correspondent has a high level ofassurance that the message came from FNB and that nothing was lost ortampered with during transmission. The correspondent can then use the DES keyto decrypt the text of the every message needs the security or privacy provided through encryption. In addition, some countries will not allow encrypted messages to travel acrosstheir borders. Message authentication can be used in these situations. Messageauthentication is a technique used to attach a digital signature to a the example below, if the correspondent wants to send a message to FNB butthe correspondent is located in a country that does not permit messageencryption, the correspondent can use message authentication to assure FNB thatthe message came from them. From the text of the message, the correspondentwill first use a hash function to create a message digest. Next, thecorrespondent will use their private key to encrypt the message digest to create adigital signature. The encrypted message digest can only be read using thecorrespondent’s public key. Accordingly, FNB will use the correspondent’spublic key to decrypt the message digest and compare the hash total to one theyhave independently calculated. If they agree, FNB has a high level of assurancethat the message came from the correspondent and that, even though themessage was sent in clear text, nothing was lost or tampered with duringtransmission.+)))))))))))))))))), +))))))))), +)))))))))), +)))))))))))), Unencrypted Text )))))) Hash )))) Digest )))))))=<)))))) Signature .))))))))))))))))))- .)))))))))- .))))))))))- .))))))))))))- Unencrypted Text Hash Function Message Digest RSA Encryption Digital SignatureThis is the same process for adding the digital signature for the encrypted DESmessage above. However, when used with an unencrypted or clear textInternet Banking 56 Comptroller’sHandbook
message, the process is called message authentication. This process issometimes referred to as a digital envelope, a digital message protected by adigital ’s Handbook 57 InternetBanking
Internet Banking Appendix CTypes of Online AttacksBanks and service providers need to guard against various types of onlineattacks. The object of an attack may vary. Attackers may try to exploit knowvulnerabilities in particular operating systems. They also may try repeatedly tomake an unauthorized entry into a Web site during a short time frame thusdenying service to other of attacks may include:CSniffers — Also known as network monitors, this is software used tocapture keystrokes from a particular PC. This software could capture log-on IDs and Passwords — Using software to test all possible combinationsto gain entry into a Force — A technique to capture encrypted messages then usingsoftware to break the code and gain access to messages, user ID’s, Dialing — This technique is used to dial every number on aknown bank telephone exchange. The objective is to find a modemconnected to the network. This could then be used as a point of Engineering — An attacker calls the bank’s help desk impersonatingan authorized user to gain information about the system includingchanging Horse — A programmer can embed code into a system that willallow the programmer or another person unauthorized entrance into thesystem or — Intercepting transmissions then attempting to deduceInternet Banking 58 Comptroller’sHandbook
information from them. Internet traffic is particularly vulnerable to ’s Handbook 59 InternetBanking
Internet Banking Appendix D Discussion PointsThere are several topics examiners can discuss with bankers who are consideringengaging in Internet banking for the first time. These talking points will help theexaminer determine if fundamental risk issues are under Plans — The proposed Internet banking business should be agood fit with the institution’s strategic business direction and — One of the major decisions a national bank will have to makeis whether to host the service in-house or through an — A needs analysis can help the bank determine whatproducts and services should be a part of the new Internet bankingbusiness. This should be an on-going process to ensure the bank remainscurrent with Internet banking technology, products, and Department — The bank’s user departments should be involved inthe outsourcing vendor or software vendor selection process as theseindividuals will have to work with the system on a daily basis once it isoperational. CImpact on Earnings and Capital — Bank management should have aprojection of the expected impact on earnings and capital of the newInternet banking — Bank management needs to understand security issuesassociated with Internet banking products and services. Security issuesInternet Banking 60 Comptroller’sHandbook
include how the bank or its outsourcer will authorize users, prevent datainterception and unauthorized alteration, and deal with intrusions. CInternal Controls and Audit — Management should determine whether thecontrols and audit processes are adequate to enable the identification,measurement, and monitoring of risk associated with the Internet Requirements — Various legal requirements, including complianceissues, need to be understood before initiating an Internet bankingbusiness. Since many legal issues are undecided, management will needto monitor Management — If the bank is researching outsourcers, theanalysis should include consideration of potential vendors’ financialcondition, years in the business, and future planning — Whether provided by the bank or outsourcer,management should have an understanding of contingency planning aspart of the due diligence — A review of insurance coverage may be in order especially ifthe hosting of the Web site has been — The bank should ensure they have the proper level ofexpertise to make this business decision. The board and seniormanagement may need to enhance their understanding of technologyissues. If the expertise is not available in-house, the bank should considerengaging outside these are dynamic discussion points, examiners should periodicallyreference the Bank Technology Division Intranet site for ’s Handbook 61 InternetBanking
Internet Banking Glossary Access Control Entry (ACE)Each access control list has an associatedACE, which lists the permissions that havebeen granted or denied to the users or groupslisted in the Control List (ACL)List of security identifiers that allow onlycertain processes to be activated. Access ProductsProducts that allow consumers to accesstraditional payment instrumentselectronically, generally from TokensObjects containing the security identifier of arunning process. The access token is checkedagainst each object’s ACL to determinewhether or not appropriate permissions Clearing HouseAn automated clearing and settlement system(ACH)for recurring payments. Most ACH systemsare operated by the Federal Reserve AlertsWhen a computer generates an alert, themessage is sent to a predefined list of users. These messages relate to server and resourceuse; they warn about problems in areas suchas security and access, user sessions, servershutdown because of power loss (with UPS),directory replication, ServiceNotifies selected users and computers ofadministrative alerts that occur on acomputer. Internet Banking 62 Comptroller’sHandbook
AlgorithmsMathematical formulas used to encrypt anddecrypt messages. These encryption formulascan reside in software or specializedhardware TestThe first stage of testing a new softwareproduct, carried out by the manufacturer’stechnical Payment SystemsPayment systems such as those based onstored value cards, electronic currency, anddebit or credit cards. These are alternativeavenues to deliver traditional banking andrelated products and NationalA standard-setting organization; it is the Institute (ANSI) representative to the International Standards Organization (ISO).American Standard CodeA standard code for representing characters asnumbers that for Information Interchange isused on most microcomputers, computerterminals, and A small application program that is designedto do a small, specific computer program or set of programs thatperform the processing of records for aspecific CryptographyIs also known as public/private keycryptography. A private key encrypts the dataand a public key decrypts the information. Asymmetric cryptography is slower thansymmetric technology and is used primarilyfor message authentication ’s Handbook 63 InternetBanking
Asynchronous Transfer ModeMethod of transmitting bits of data one afteranother with a start bit and a stop bit to markthe beginning and end of each data degree to which transactions can betraced and audited through a PolicyDefines the type of security events that arelogged for a domain or for individualcomputers; determines what the operatingsystem will do when the security log becomesfull. Audit policy can track the success orfailure of specified security ) The process which assures the receiver ofa digital message of the identity of the sender. It also is used to validate the integrity of ) The process of proving the claimedidentity of an individual user, machine,software component or any other Software Software used to produce multimedia orhypertext presentations by linking sounds,music, visuals, and process of determining what types ofactivities are permitted. Usually,authorization is in the context ofauthentication: once you have authenticated auser, he or she may be authorized differenttypes of access or hole or access point left, by design, in theprogram by the original programmer ordeveloper. Usually used by programmers tosimplify the program-testing procedures;however, on occasion, programmers forget toInternet Banking 64 Comptroller’sHandbook
close these holes or are not aware of otherholes created by the original The transmission capacity of a computerchannel or communications HostA firewall system that has been designed toresist attack, and which is installed on anetwork in such a way that it is expected topotentially come under attack. Bastion hostsare often components of firewalls, or may be“outside” web servers or public accesssystems. Baud RateMeasurement of data transfer TestThe second stage of a new software productthat is almost ready for market, typicallycarried out by volunteers in a wide variety ofsettings such as those in which the finishedproduct will be method of verifying an person’s identity byanalyzing a unique physical binary digit (0 or 1) used in therepresentation of a number, letter, or local area networks, a device that enablestwo networks, even ones dissimilar intopology, wiring, or communicationsprotocols, to exchange computer program that enables the user toretrieve information that has been madepublicly available on the Internet; also thatpermits multimedia (graphics) applications onthe World Wide ’s Handbook 65 InternetBanking
Bundled SoftwareSoftware that is sold in combination withhardware. CERTSee Computer Emergency Response TeamCertifying AuthorityA trusted third party that confirms a person’sidentity by certifying that the transactionbelongs to the stated party. The certifyingauthority must be recognized, trusted, andprotected from fraud and abuse. A certifyingauthority issues a digital certificate signed bytheir private key. It can be verified bydecrypting the certificate using the authority’spublic An electronic device consisting of circuitelements on a single silicon chip. The mostcomplex circuits are microprocessors, whichare single chips that contain the completearithmetic and logic units of CardAlso known as an integrated circuit (IC) card. A card containing one or more computerchips or integrated circuits for identification,data storage, or special-purpose processingused to validate personal identificationnumbers, authorize purchases, verify accountbalances, and store personal TextAn encrypted message that outsiders process of transmitting, reconciling, and,in some cases, confirming payment ordersprior to settlement, possibly including nettingof instructions and the establishment of finalpositions for Banking 66 Comptroller’sHandbook
Clearing HouseA central location or central processingmechanism through which financialinstitutions agree to exchange paymentinstructions. The institutions settle for itemsexchanged at a designated time, based on therules and procedures of the clearing SystemA set of procedures whereby financialinstitutions present and exchange data and/ordocuments relating to funds or securitiestransfers to other financial -server NetworkA network that dedicates certain computerscalled servers to act as service providers tocomputers called Network A data communications network that is usedfor a specific purpose, such as a paymentsystem, and to which access is restricted (alsoreferred to as a private network).CodeComputer programs, written in machinelanguage (object code) or programminglanguage (source code).Computer EmergencyLocated at Carnegie-Mellon University, thisResponse Team (CERT)incident response team offers advisories thatcontain useful, specific security information. Cyber MallA set of electronic or digital storefronts linkedthrough a common Web A popularized term that refers to the part ofsociety and culture that exists in networkedcomputer systems rather than in anyparticular physical art/science of keeping messages secretfrom ’s Handbook 67 InternetBanking
Data Encryption StandardDES is a well-known symmetric encryption standardthat the . Government endorsed in 1977. Developed by IBM, it operates off of a 56-bit basekey. Data IntegrityThe property that data meet with a priorityexpectation of quality and that the data can berelied to only one SharesResources shared by default when theoperating system is - of- Service AttackAn attempt to overwhelm a server with requests sothat it cannot respond to legitimate PhaseThe phase of systems development duringwhich the problem solution that was selectedin the Study Phase is designed. The designincludes the allocation of system functions;the design of inputs, outputs, and files; andthe identification of system and Specification A baseline specification that defines how toconstruct a computer-based business Phase The phase in which the computer-basedsystem is constructed from the “blueprint”prepared in the Design Phase. Equipment isacquired and installed. All necessaryprocedures, manuals, and otherdocumentation are completed. Personnel aretrained, and the complete system is tested foroperational -upThe ability of a remote user to access asystem by using private or common carriertelephone Banking 68 Comptroller’sHandbook
Dial-up ClientA computer with a temporary connection tothe to communications processors,techniques, and equipment where informationis encoded as a binary “1”or “0”.Digital CertificationA process to authenticate (or certify) a party’sdigital signature; carried out by trusted EnvelopeA digital message protected by a Signature 1) A mathematical encryption technique thatassociates a specific person with a givencomputer file and indicates that the file hasnot been altered since that person signed it;should not be confused with making anelectronic representation of a ) A message digest encrypted usingasymmetric cryptography. This is used toverify that a message came from the expectedsender. DomainA group of computers and devices on anetwork that are administered as a unit withcommon rules and ControllerThe server that authenticates domain logins andmaintains the security NameAn alphanumeric name for a Web site thatincludes both the online address and Name ServiceA network service that translatesComptroller’s Handbook 69 InternetBanking
(DNS)external Internet addresses into numericalInternet network addresses. DownloadTo transmit a file or program from a centralcomputer to a smaller computer or to aremote Host ConfigurationMethod of automatically assigning addressesto client computers on a BenefitsThe electronic delivery of governmentTransfer (EBT) benefits using plastic Data InterchangeThe transfer of information between(EDI) organizations in machine readable DocumentThe digital or computer equivalent of MoneyMonetary value measured in currency unitsstored in electronic form on an electronicdevice in the consumer’s possession. Thiselectronic value can be purchased and held onthe device until reduced through purchase ortransfer. Electronic PurseA stored value device that can be used tomake purchases from more than one Analysis The process of determining the likelihood thata proposal will fulfill specified Transfer ProtocolA standard way of transferring files from one(FTP)computer to another on the A system or combination of hardware andsoftware solutions that enforces a boundarybetween two or more Banking 70 Comptroller’sHandbook
Gamma Test The third stage of software testing completedbefore 1) A computer that performs protocolconversion between different types ofnetworks or ) A computer that serves as a router, aformat translator, or a security filter for anentire A computer program, and an accompanyingdata transfer protocol, for reading informationthat has been made available to users on User InterfaceA way of communicating with a computer by(GUI)manipulating icons and windows with a“mouse.”Group IdentifiersSecurity identifiers that contain a set ofpermissions given to a given group of users. All of the users in that group have thepermissions granted to that identifiers to which users can beassigned membership for the purpose ofapplying a broad set of group permissions tothe user. This allows for better managementand control over large security Software that allows a group of users to workon the same data through a network byfacilitating file sharing and other forms A computer operator who breaks into acomputer without authorization, for maliciousreasons, just to prove it can be done, or otherpersonal ’s Handbook 71 InternetBanking
Hardware CompatibilityA listing of all hardware devices supported bythe operating system. Hash FunctionUsed to create a message digest. The senderof a message uses a hash function to derive acalculation from a particular NetworksNetworks consisting of a variety of computersystems. Typically, these types use the TCP/IP(transmission control protocol/Internet protocol)network communication protocol to get thesesystems operating together. Managing aheterogeneous network is difficult since eachoperating system has its own security system. Howthese operating systems interact as a whole willdetermine the effectiveness of the security BankingBanking services that allow a customer tointeract with a financial institution from aremote location by using a telephone,television set, terminal, personal computer, orother device to access a telecommunicationsystem which links to the institution’scomputer Page A screen of information made available tousers through the Internet or a privateIntranet; it is the “main page” that users areexpected to read first in order to access theother pages that comprise the Web Also known as a host computer that is theprimary or controlling computer in acomputer network, generally involving datacommunications or a local area Electronic documents that present informationthat can be connected together in manydifferent ways, instead of Banking 72 Comptroller’sHandbook
Hypertext Markup A set of codes that can be inserted into text files toindicate special Language (HTML) typefaces, insertedimages, formatting, and links to create Web pages. Hypertext Transfer ProtocolHTTP is a standard method of publishinginformation as hypertext in HTML format onthe Internet. Icon A small picture on a computer screen thatrepresents a particular object, operation, orgroup of Data Encryption Engineering Task Force: a standards-setting Response TeamA team of computer experts (internal orexternal) organized to protect anorganization’s data, systems, and other assetsfrom attack by hackers, viruses, or Circuit CardA plastic card in which one or moreintegrated circuits are embedded (also calleda chip card).ISDNIntegrated Services Digital Network. A type ofall-digital telephone service that can transmitdigital data as well as voice, without international standard-setting organization. ANSI is the . A worldwide network of computer networks(commonly referred to as the InformationSuperhighway).Comptroller’s Handbook 73 InternetBanking
Internet InformationSoftware used to serve higher-level InternetServerprotocols, like HTTP and FTP for clients usingWeb browsers. Internet Service ProviderAn entity that provides access and/or services(ISP)related to the Internet, generally for a The compatibility of distinct applications,networks, or systems. Intranet A private network that uses the infrastructureand standards of the Internet and World WideWeb, but is cordoned off from the publicInternet through firewall core process of a preemptive operatingsystem, generally consisting of a multitaskingscheduler and the basic security ) The integers that drive the ) A secret value or code used in anencrypting algorithm known by one or both ofthe communicating parties. Local Area Network (LAN) A network that connects several computersthat are located nearby (in the same room orbuilding), allowing them to share files anddevices such as and Key ProtectionA protection system that involves matching akey or password with a specific The storing of information about events thatoccurred on the firewall or ScriptCommand files that automate the logon process byperforming utility functions such as attaching toInternet Banking 74 Comptroller’sHandbook
additional server resources or automatically runningdifferent programs based on the user account thatestablished the File Name (LFN)A filename longer than the MS-DOS allowedeight plus extension. In Windows NT,windows 98/95, OS/2, Unix, and Linux, forexample. Magnetic Stripe Used on debit, credit, and identification cardsto store encoded information read by cardreaders; less secure than computer chip Card An integrated circuit (IC) card capable ofstoring information DigestA value created from a hash function. Thisvalue is known as the message digest. The receiver can verify the value to determinewhether any changes were made to themessage during transmission. MiddlewareFacilitates the client/server connections over anetwork and allows client applications toaccess and update remote databases andmainframe files. Multimedia The combining of different elements of media(., text, graphics, audio, video) for displayand control from a personal computer. MultiprocessingUsing two or more processors simultaneouslyto perform a computing task. Normally ahardware level capacity to perform thisfunction: CAsymmetrically: Certain processors areassigned certain threads independent ofthe load they create. Comptroller’s Handbook 75 InternetBanking
CSymmetrically: Threads are dynamicallyassigned to processors according to anequitable scheduling scheme. MultitaskingThe ability of a processing unit to switchrapidly among threads of execution. Multitasking divides processor time amongthreads as if each thread ran on its ownslower processor. These systems allow twoor more applications to run at the same timeand can provide a greater degree of service toapplications than single-tasking Institute forEstablished within the Department of Standards Technology Commerce to develop technical, management, physical, and administrative standards and guidelines for the cost effectivesecurity and privacy of sensitive informationin federal computer systems. NIST issues theFederal Information Processing Standards(FIPS). National Security AgencyResponsible for government and/or military(NSA)information TelecommunicationsA government agency charged withInformation Administrationsafeguarding personal information on Moving through a complex system of menusor help A group of computers connected by cables orother means and using software that enablesthem to share equipment and exchangeinformation. A system of software andhardware connected in a manner to supportdata Banking 76 Comptroller’sHandbook
New Technology (NT)A Microsoft operating Any device, including servers andworkstations, connected to a network. Also,the point where devices are undeniable proof of participation by boththe sender and the receiver in a transaction. It is the reason public key encryption wasdeveloped, ., to authenticate electronicmessages and later prevent denial orrepudiation by the sender or TransactionsTransactions that cannot be denied after File System (NTFS)A secure, transaction-oriented file systemdeveloped for Windows NT allowingassignment of permissions and shares withaccess limited to properly authenticated self-contained entity that contains its owndata and the functions necessary tomanipulate the data. NT’s security systemcontrols access to objects and the auditsystem logs -line Equipment or devices that are not in directcommunication with the central processor ofa computer system, or connected Equipment or devices that are currentlycapable of communicating with one relevantcomputer system. Online Scrip Debit accounts on the Internet or other majorcomputer Service ProvidersClosed network services that provide accessComptroller’s Handbook 77 InternetBanking
(OSP) to various computer sites or networks for Network A data communications network to whichaccess is not Phase The phase in which changeover from an oldsystem to a new system occurs. The system isthen operated and maintained. Systemperformance is audited, and change to thesystem is System1) A collection of services that form afoundation upon which applications run. Examples include: MS-DOS: A simple I/Oservice provider with a command shell andWindows NT: A sophisticated, preemptive,multitasking, multiprocessing ) A program that controls a computer andmakes it possible for users to enter and runtheir own owner of a file or directory has control ofthat file or directory and can change itspermissions. By default, the user who createsthe file or directory owns Switching A data transmission method that routespackets along the most efficient path andallows a communication channel to be sharedby multiple A unique word or string of characters that aprogrammer, computer operator, or user mustsupply to satisfy security requirements beforegaining access to the system or Banking 78 Comptroller’sHandbook
Password Cracker A software program designed to conduct anautomated brute force attack on the passwordsecurity controls of an information system by“guessing” user Sniffer A software program that is illicitly insertedsomewhere on a network to capture userpasswords as they pass through the System A financial system that establishes the means fortransferring money between suppliers and users offunds, usually by exchanging debits or creditsbetween financial Specification A baseline specification that describes what acomputer-based business system is to do. Itis completed at the conclusion of the TestingUsing automated tools to determine a network’svulnerability to unauthorized A rule associated with an object to regulatewhich users can access the object and in IdentificationA sequence of digits used to verify (PIN)Personal User ProfileA profile created by the administrator andassigned to a user. This records changes theuser makes to their operating system ornetwork environment settings. This is savedwhen the user logs off, and is loaded whenthe user logs Good Privacy data encryption ’s Handbook 79 InternetBanking
PiggybackA means of gaining unauthorized access to asystem through another user’s TextAn unencrypted -to-Point TunnelingSupports a secure, multi-protocol privatenetwork across the Protocol Internet. Makesuse of authentication and encryption to securecommunications. Windows NT supports thisfunction by its remote-access service (RAS). Policies General controls that enhance the security ofan operating environment. For example,policies could affect restrictions on passworduse and rights assignments and determinewhich events will be recorded in the level of execution importance assigned to athread. In combination with other factors, thepriority level determines how often thatthread will get computer time according to ascheduling -Enhanced MailAn Internet standard for secure electronicmail. The standard adds several securityservices to the Internet electronic mailmessages: message origin authentication;message integrity; nonrepudiation of origin;and message Branch ExchangeA computer system that drives the internaltelephone (PBX) system in an PBX is connected to the telephonecompany and possibly other ) A standardized set of rules that define howcomputers communicate with each other. Internet Banking 80 Comptroller’sHandbook
2) An established rule of communicationadhered to by the parties operating under Cards Cards that can be read from a short distance;mainly used for security and Key CryptographyA two-key method of cryptography where anon-public key is used to encode and asecond, publicly available key is used Law 100-235 Computer Security Act of 1987; assigned theNational Institute of Standards andTechnology with the responsibility fordeveloping standards and guidelines forfederal computer systems processingunclassified Time Monitoring The monitoring of activity as it occurs ratherthan storing the data for later database repository for information about acomputers configuration, including thehardware, installed software, environmentsettings, and other AccessLetting off-site users access a central network. Remote Payment A payment carried out through the sending ofpayment orders or payment Procedure Calls A network interprocess communicationmechanism that allows an application to bedistributed among many computers on thesame The denial by one of the parties to atransaction of participation in all or part ofComptroller’s Handbook 81 InternetBanking
that transaction or of the content of for CommentsThe set of standards defining the Internetprotocols by the Internet Engineering TaskForce and available in the public domain onthe Internet. RFCs define the functions andservices provided by each of the manyInternet protocols. Compliance with the RFCssignificantly enhances A computer system in a network that storesand forwards data packets between local areanetworks and wide area public key (asymmetrical) encryptionmethodology. It was invented in 1976 by RonRivest, Adi Shamir, and Leonard Adleman. RSA is used as a supplement to DES. Itprovides for secure key exchanges and digitalsignatures. Key lengths can vary from 40 to1,024 ability of a system to support high-growthenterprise applications. These applicationsare typically large-scale, mission-critical innature. Examples include supporting widelyused online banking activities, hostingpopular Web sites, maintaining large datawarehouses, and administering large The process of mixing the integrated circuit(IC) chip components so that they cannot beanalyzed Engines Software programs that are capable of locatingspecified information or Web sites on Banking 82 Comptroller’sHandbook
Searchware Software used to search through a HypertextProvides secure communication mechanismsbetween an HTTP Transfer Protocol client-server Accounts ManagerThe module of the NT executive thatauthenticates a user name and passwordagainst a database of accounts, generating anaccess token that includes users’ Socket Layer (SSL) A protocol for providing data security duringtransmission using data encryption, serverauthentication, and message Identifiers (SIDs)Unique codes that identify a specific user orgroup to the NT security system. SIDscontain a complete set of permissions for thatuser or PoliciesThe security policy consists of the Account,User Rights, Audit, and Trust Relationshipspolicies, and are managed with UserManagers for ) A computer dedicated to servicing requestsfor resources from other computers on anetwork. Servers typically run networkoperating ) A computer that provides services toanother computer (the client). SETA set of standards jointly developed by Visa,MasterCard, and several technologiescompanies to facilitate secure credit cardtransactions over the Internet. SecureElectronic Transactions is a standarddeveloped by VISA and MasterCard. SET usespublic key cryptography and requiresComptroller’s Handbook 83 InternetBanking
merchants and consumers to haveauthentication keys to conduct onlinetransactions. The purpose is to securetransactions over open networks such as An act that discharges obligations withrespect to funds or securities transfersbetween two or more system A system used to facilitate the settlement oftransfers of Mail Transfer A protocol used to transfer electronic mailbetween computers on the CardA card with a computer chip embedded, onwhich financial, health, educational, andsecurity information can be stored EngineeringPosing as managers, technicians, or otheremployees to gain access to computerresources either directly by corporate or byobtaining access codes or access fromauthorized that contain basic detailed attempt to gain access to a system byposing as an authorized The rules under which analysts, programmers,operators, and other personnel in aninformation service organization Value CardA card that stores prepaid value by magneticstripe or computer Query LanguageA query language used to manipulate largeInternet Banking 84 Comptroller’sHandbook
(SQL) Walk-ThroughA technical review performed to assist thetechnical people working on a project. It isone of a series of reviews that should be aplanned part of system design anddevelopment PhaseThe phase during which a problem isidentified, possible solutions are studied, andrecommendations are made with regard tocommitting the resources required to design asystem. Subnet MaskA number mathematically applied to addresses to determine which addresses are apart of the same subnetwork as the computerapplying the subnet A type of bridge that can move several packetsat the same private or secret key cryptography methodologythat uses the same key to both encrypt and decryptmessages. DES is an example of this type oftechnology. Systems AnalysisThe performance, management, anddocumentation of the four phases of the lifecycle of a business system: study, design,development, and Flowchart A flowchart diagraming the flow of work,documents, and operations in a dataprocessing Integrity The quality that a system has when itperforms its intended function in anComptroller’s Handbook 85 InternetBanking
unimpaired manner, free from deliberate orinadvertent manipulation of the PolicyA policy used to control what a user can doand the environment of that user. Systempolicies can be in Windows NT, applied to aspecific user, group, computer, or all users. System policies work by overwriting currentsettings in the registry with the system Specification A baseline specification containing all theessential computer-based business systemdocumentation. It is completed at the end ofthe Development Risk The risk that the failure of one participant in afunds transfer system, or in financial markets,to meet its required obligations will causeother participants or financial institutions tobe unable to meet their obligations when -evident The capacity of devices to show evidence ofphysical -proof The proven capacity of devices to resistant The capacity of devices to resist physicalattack up to a certain transmission between a computingsystem and remotely located devices bytelephone lines, cable, or wireless A protocol that permits users to access aremote terminal or another computer througha network; widely used on the Banking 86 Comptroller’sHandbook
ThreadA list of instructions running in a computer toperform a certain task. Each thread runs inthe context of a process, which embodies theprotected memory space and the environmentof the threads. Multi-threaded processes canperform more than one task at the same MonitoringThe analysis, assessment, and review of audittrails and other data collected for the purposeof searching out system events that mayconstitute violations or attempted violationsof system The total amount of useful work performed bya data processing system during a givenperiod of arrangement of nodes usually forming astar, ring, tree, or bus The degree to which transactions can betraced to the originator or recipient (alsoreferred to as auditability).Transport Control ProtocolAlso Internet protocol (TCP/IP). A standardformat for transmitting data in packets fromone computer to another, on the Internet andwithin other networks. TCP deals with theconstruction of the data packets, while IProutes them from machine to Door A concealed and unauthorized entrance into acomputer operating system, designed by Horse A program that appears to perform a usefulfunction and sometimes does so quite wellbut also includes an unadvertised feature,which is usually malicious in ’s Handbook 87 InternetBanking
Truncation Dropping off part of a character string eitherto conserve space or because of limited Computer SystemA system that employs sufficient assurance measuresto allow its use for simultaneous processing of arange of sensitive or classified RelationshipLinks between domains that enable pass-through validation, in which a user has onlyone user account in one domain, yet canaccess the entire network. A trusting domainhonors the log in validation of another key weakness with these systems is that ahacker may try to gain access to a lessersecured system to take advantage of its trustrelationship with other Third Party A reputable entity that authenticates one ormore parties to an electronic transaction. Theauthentication process generally involves theissuance and administration of digitalcertificates. Uninterruptible Power Provides power to a system in case of aSupply (UPS) power multitasking, kernel-based operating systemdeveloped by AT&T in the early 1970s andprovided, originally, free to universities as aresearch operating system. Because of itsavailability and ability to scale down tomicroprocessor-based computers, UNIXbecame the standard operating system of theInternet and its attendant network protocolsand is the closest approximation to auniversal operating system that exists. Mostcomputers can run some variant of the UNIXoperating Banking 88 Comptroller’sHandbook
Uniform Resource Locator A way of specifying the location of availableor Universal Resourceinformation on the (URL)UploadTo transmit a file to a central computer from asmaller computer or a remote A set of many news groups distributed by Manager for DomainsA tool used to manage security for a domainor an individual computer. Administers useraccounts, groups, and security Corporations Corporations that have no official physicalsite presence, and are made up of diversegeographically dispersed or A program with the ability to reproduceby modifying other programs to includea copy of itself. It may containdestructive code that can move intomultiple programs, data files, ordevices on a system and spread throughmultiple systems in a A weakness in system security procedures,system design, implementation, internalcontrols, etc., that could be exploited toviolate system -DialingDialing every number on an institution’stelephone exchange looking for the existenceof authorized or unauthorized modems onwhich to launch an attack. Web Page Information presented through a Web browserin a single ’s Handbook 89 InternetBanking
Web SiteA Web page or set of Web pages designed,presented, and linked together to form alogical information resource and/ortransaction initiation function. Wide Area Network (WAN) A communications network that covers a widegeographic area, such as state or country,using high speed long distance lines orsatellites provided by a common 16The set of application services provided by the16-bit versions of Windows and Windowsfor Workgroups 32The set of applications services provided bythe 32-bit versions of Windows 95 and NTThe portable, secure, 32-bit, preemptivemultitasking member of the Windowsoperating system family. This systemincludes peer networking services, servernetworking services, Internet client and serverservices, and a broad range of NT ServerThe Windows NT Server provides centralizedmanagement and security, advanced faulttolerance, and additional 95A 32-bit version Windows for medium-range,Intel-based computers. This system includespeer networking services, Internet support,and strong support for older DOS applicationsand collection of computers that are grouped forviewing purposes. Each workgroup isidentified by a unique powerful personal Banking 90 Comptroller’sHandbook
World Wide WebA subnetwork of the Internet through which(Web, WWW)information is exchanged by text, graphics,audio, and A program that scans a system or an entirenetwork for available, unused space in whichto run. Worms tend to tie up all computingresources in a system or on a network andeffectively shut it ’s Handbook 91 InternetBanking
Internet Banking References Laws, Regulations, and RulingsBank Service Corporation Act12 USC 1861-1867 Computer-Related Fraud18 USC 1030 FDIC Advertisement of Membership12 CFR 328 OCC Interpretive Letter No. 742OCC Conditional Approval No. 253OCC Conditional Approval No. 312OCC Conditional Approval No. 313IssuancesAL 97-9, “Reporting Computer-Related Crimes”AL 99-6, “Guidance to National Banks on Web Site Privacy Statements”OCC 94-13, “Nondeposit Investment Sales Examination Procedures”OCC 97-9, “Reporting Computer-Related Crimes”OCC 98-2, “Interagency Statement on Branch Names”OCC 98-3, “Technology Risk Management”Internet Banking 92 Comptroller’sHandbook
OCC 98-31,“Guidance on Electronic Financial Services and ConsumerCompliance”OCC 98-38,“Technology Risk Management: Internet Banking”OCC 99-9, “Infrastructure Threats from Cyber-Terrorists”OCC 99-20, “Certificate Authority Systems”Other FFIEC Information Systems Examination HandbookComptroller’s Handbook 93 InternetBanking
