Source: http://www.thecommunitybanker.com/IBN/internet_banking_news_06-06-04.htm
Timestamp: 2019-05-20 06:34:37
Document Index: 281451622

Matched Legal Cases: ['§4', '§7', '§8', '§13', '§14', '§14', '§14']

FYI - Online Crime Costs Rising - Online criminals are attacking corporate and government networks more frequently, costing businesses an estimated $666 million in 2003, according to a survey of computer security executives released today. http://www.securityfocus.com/printable/news/8767
FYI - FDIC faulted for weak security - The federal agency that insures U.S. bank deposits suffers from network security holes that make it vulnerable to cyber thieves and saboteurs, a report by congressional investigators concluded Friday.
News story: http://www.securityfocus.com/printable/news/8796
GAO report: http://www.gao.gov/new.items/d04630.pdf
FYI - Group wants input on vulnerability reporting guidelines - The Organization for Internet Safety is soliciting comments on its guidelines for reporting and responding to software security vulnerabilities.
http://www.gcn.com/cgi-bin/udt/im.display.printable?client.id=gcndaily2&story.id=26045
FYI - GAO Technology Assessment: Cybersecurity for Critical Infrastructure Protection.
GAO Report: http://www.gao.gov/new.items/d04321.pdf
Highlights: http://www.gao.gov/highlights/d04321high.pdf
FYI - GAO Information Security: Agencies Face Challenges in Implementing Effective Software Patch Management Processes.
GAO Report: http://www.gao.gov/new.items/d04816t.pdf
Highlights: http://www.gao.gov/highlights/d04816thigh.pdf
INTERNET COMPLIANCE - We begin this week reviewing the FFIEC interagency statement on "Weblinking: Identifying Risks and Risk Management Techniques" issued in April 2003.
Malicious code is any program that acts in unexpected and potentially damaging ways. Common types of malicious code are viruses, worms, and Trojan horses. The functions of each were once mutually exclusive; however, developers combined functions to create more powerful malicious code. Currently malicious code can replicate itself within a computer and transmit itself between computers. Malicious code also can change, delete, or insert data, transmit data outside the institution, and insert backdoors into institution systems. Malicious code can attack institutions at either the server or the client level. It can also attack routers, switches, and other parts of the institution infrastructure. Malicious code can also monitor users in many ways, such as logging keystrokes, and transmitting screenshots to the attacker.
Typically malicious code is mobile, using e - mail, Instant Messenger, and other peer-to-peer (P2P) applications, or active content attached to Web pages as transmission mechanisms. The code also can be hidden in programs that are downloaded from the Internet or brought into the institution on diskette. At times, the malicious code can be created on the institution's systems either by intruders or by authorized users. The code can also be introduced to a Web server in numerous ways, such as entering the code in a response form on a Web page.
Malicious code does not have to be targeted at the institution to damage the institution's systems or steal the institution's data. Most malicious code is general in application, potentially affecting all Internet users with whatever operating system or application the code needs to function.
3. Determine if the institution requires personnel with authority to access customer information and confidential institution information to sign and abide by confidentiality agreements.
48. If the institution discloses nonpublic personal information to nonaffiliated third parties, do the requirements for initial notice in §4(a)(2), opt out in §§7 and 10, revised notice in §8, and for service providers and joint marketing in §13, not apply because the information is disclosed as necessary to effect, administer, or enforce a transaction that the consumer requests or authorizes, or in connection with:
a. servicing or processing a financial product or service requested or authorized by the consumer; [§14(a)(1)]
b. maintaining or servicing the consumer's account with the institution or with another entity as part of a private label credit card program or other credit extension on behalf of the entity; or [§14(a)(2)]
c. a proposed or actual securitization, secondary market sale (including sale of servicing rights) or other similar transaction related to a transaction of the consumer? [§14(a)(3)]
IN CLOSING - Did you know that R. Kinney Williams & Associates performs intranet-internal penetration testing in addition to its popular external-Internet testing? To keep your cost affordable, we install our pre-programmed scanner box on your network. To maintain the independent testing required by the examiners, we control the scanner box programming and testing procedures. For more information, please visit http://www.internetbankingaudits.com/internal_testing.htm or email Kinney Williams at examiner@yennik.com.