A strong information security program includes active board and management oversight, policies and procedures, measurement and monitoring systems and ongoing internal controls. Boards of directors and senior management are responsible for ensuring that spending on information security is appropriate to the magnitude and nature of the risks. Internal network security issues need special attention. The vulnerabilities of internal networks may be less obvious to banking organizations than networks connected to the Internet, yet these internal systems are vulnerable to a wide variety of intrusion tactics. Internal attacks are potentially the most damaging because an institution's personnel, which can include consultants as well as employees, may have authorized access to critical computing resources.
Confidential information needs to be encrypted.
The confidentiality of data transmitted over public networks is vulnerable to risks in addition to those identified for internal networks. These lines use the infrastructure of public networks and therefore are vulnerable to the same attacks as the public networks themselves. Internet connections need to be carefully constructed. An institution's Internet site is exposed to worldwide attack. As more products and services are offered via the Internet, the opportunities for attack increase.