electronically, they must assume the accompanying risk. In addition, Sections 370.46 and 47 emphasize the fluid nature of the electronic world. Section 370.46 states that the Bureau of Pubic Debt may waive all the provisions in Part 370 at its discretion. Section370.47 states that any aspect of these regulations can be changed at any time without notice. It specifically provides that investors assume the risk of change without notice and in particular that it may terminate a provision that was favorable to investors and that nothing in this part creates vested rights for investors in their favor.

<u>Part 210</u> establishes regulations for federal government participation in ACH transactions. It provides definitions, identifies agencies involved in ACH payments and their liabilities, and defines rules governing authorizations. This part also sets out rules for paper-check conversion. Federal Reserve <u>ACH Operating Circular 4</u> and its appendixes govern the clearing and settlement of commercial ACH credit and debit items by Federal Reserve banks, sending banks, and receiving banks. Government ACH items are included in appendix D of the circular. The circular also discusses the National Automated Clearing House Association, which governs interbank clearing of electronic entries for participating financial institutions.

Part 210 also addresses issues relating to electronic signatures. To facilitate the consistent use and acceptance of e-signatures by executive agencies, Part 210 adopts the definition of e-signatures set out in the 1998 Government Paperwork Elimination Act. Thus it defines an e-signature as a signature of an electronic message that identifies and authenticates a particular person as the source of the message and that indicates that person's approval of the information contained in the message.

# **Crucial issues for e-security**

Although technological advances offer many advantages for the financial services industry, they also herald a world that is shifting from person-to-person interactions and paper transactions toward fully digital, remote access transactions. Moreover, the same technological advances that enable new, more efficient ways of doing business are also responsible for a constant increase in reported vulnerabilities. Given these twin developments, it is critical to implement the most robust security measures, policies, and procedures possible.

As system risks are inherent in every network system, proper risk mitigation is integral to maximizing the safety and soundness of U.S. TreasuryDirect. Among the strengths of the new TreasuryDirect system is the use of the Pay.Gov database that relies on several information databases to verify customer identification. However, this might be harder to replicate in emerging markets due to lack of reliable informational databases in most of these countries.

The TreasuryDirect’s network system relies on five key security mechanisms: firewalls, intrusion detection systems (IDS), password authentication, Secure socket layer (SSL), and the annual GAO e-security audits. It is important to understand the strengths and weaknesses of each of these mechanisms.

Glaessner, Nevin and Kellermann (2002) developed a risk management framework for understanding the trade-offs and risks inherent in electronic security infrastructures. A main conclusion is that the efforts to mitigate e-security risks should not be overly reliant on any single security mechanism. Instead, layered security systems should be used.

12