Banking Regulations

FFIEC - Federal Financial Institutions Examination Council

FFIEC Safeguard Standards

Implements Safeguard provisions for Section 501 of the GLBA. Requires banks to protect against unauthorized access and anticipated threats or hazards to security or integrity and unauthorized access or use that could result in harm or inconvenience.

Requirements defined in the Information Security IT Examiners Handbook include:

FFIEC E-Banking

Places Board and Senior Management responsible for developing the institution’s e-banking business strategy, including; cost-benefit analysis, risk assessment, due diligence process and third party oversight and Information Security Program.

Information Security Program must address the following:

• Ensure compliance with section 501(b) of the GLBA
• Information Security Controls
• Authenticating Customers
• Administrative Controls
• Legal and Compliance

Regulations defined in the E-Banking IT Examiners Handbook (August 2003) include:

• Information Security Controls

  • Ongoing knowledge of attack sources, scenarios, and techniques
  • Rapid response capability to react to newly discovered vulnerabilities
  • Network access controls over external connections
  • System hardening
  • Controls to prevent malicious code
  • Physical security of computing devices
  • User enrollment, change, and termination procedures
  • Authorized use policy
  • Security Training Program
  • Independent testing

• Internal Controls

  • Segregation of duties
  • Dual controls on sensitive transactions
  • Reconcilements, daily
  • Suspicious activity
  • Similar website names checking
  • Error checks
  • Alternate channel confirmations on sensitive transactions

• Business Continuity Controls

  • Redundancy into critical network components
  • Periodically testing business resumption capabilities

Breach Disclosure for Financial Institutions

Requires public notification and reporting cyber security breaches that may have compromised confidential information.

Interagency Guidance on Notification for Unauthorized Access to Customer Information applies to FDIC, OCC, OTS, FRB, CNUA. Goes into effect early 2004 and is based on CA Disclosure Law.

FDIC - Federal Deposit Insurance Corporation

Institutional Letters Relating to Information Security

• FIL-84-2004 - Guidance on Instant Messaging
• FIL-30-2003 - Guidance on Weblinking
• FIL-08-2002 - Wireless Networks And Customer Access
• FIL-69-2001 - Authentication In An Electronic Banking Environment
• FIL-68-2001 - GLBA 501(b) Examination Guidance
• FIL-50-2001 - Bank Technology Bulletin on Outsourcing
• FIL-46-2001 - Privacy Of Consumer Financial Information
• FIL-22-2001 - Security Standards for Customer Information
• FIL-67-2000 - Security Monitoring of Computer Networks
• FIL-68-99 - Risk Assessment Tools And Practices For Information System Security

FIL-84-2004 - Guidance on Instant Messaging

The FDIC is providing guidance to financial institutions on the risks associated with publicly available instant messaging and network file-sharing. This guidance includes background information on the risks and how they can be mitigated through an effective management program.

The Federal Deposit Insurance Corporation (FDIC) has prepared the attached guidance to assist financial institutions in protecting themselves against the vulnerabilities of instant messaging (IM) and establishing policies and procedures concerning its usage.

Institutions should assess the risks and the business needs for IM and establish policies to allow, restrict or deny IM usage based on these risk assessments and business needs.

Customer information security guidelines require that periodic risk assessments and status reports be submitted to the board of directors. These periodic assessments and reports should include the institution’s position on IM. Any control weaknesses should be identified and addressed during the normal course of business.

See Guidance: http://www.fdic.gov/news/news/financial/2004/fil8404a.html

FIL-30-2003 - Guidance on Weblinking

Federal Bank and Credit Union Regulatory Agencies Jointly Issue Guidance on the Risks Associated With Weblinking. Provides guidance for controlling risk to reputation or misleading consumer on who is providing the information.

See Attachment: Weblinking: Identifying Risks And Risk Management Techniques

FIL-08-2002 - Wireless Networks And Customer Access

Many of the risks that financial institutions face when implementing wireless technology are risks that exist in any networked environment (see FIL-67-2000, "Security Monitoring of Computer Networks," dated October 3, 2000, and the 1996 FFIEC Information Systems Examination Handbook, Volume 1, Chapter 15). However, wireless technology carries additional risks that financial institutions should consider when designing, implementing and operating a wireless network.

Security should not be compromised when offering wireless financial services to customers or deploying wireless internal networks. Steps that can be taken immediately in wireless implementation include:

• Establishing a minimum set of security requirements for wireless networks and applications;
• Adopting proven security policies and procedures to address the security weaknesses of the wireless environment;
• Adopting strong encryption methods that encompass end-to-end encryption of information as it passes throughout the wireless network;
• Adopting authentication protocols for customers using wireless applications that are separate and distinct from those provided by the wireless network operator;
• Ensuring that the wireless software includes appropriate audit capabilities (for such things as recording dropped transactions);
• Providing appropriate training to IT personnel on network, application and security controls so that they understand and can respond to potential risks; and
• Performing independent security testing of wireless network and application implementations.

See Attachment: http://www.fdic.gov/news/news/financial/2002/fil0208a.html

FIL-69-2001 - Authentication In An Electronic Banking Environment

This guidance focuses on the risk-management controls necessary to authenticate the identity of customers accessing electronic financial services. It also addresses the verification of new customers and the authentication of existing customers. The guidance applies to both retail and commercial customers.

The Federal Deposit Insurance Corporation (FDIC) believes that an effective authentication program should be implemented on an enterprise-wide basis and that the level of authentication used by a financial institution in a particular application should be appropriate to the level of risk in that application.

In this guidance, the FDIC does not endorse any particular technology or method of authentication.

See Attachment: http://www.fdic.gov/news/news/financial/2001/fil0169a.html

FIL-68-2001 - GLBA 501(b) Examination Guidance

Section 501(b) of the Gramm-Leach-Bliley Act (GLBA) required the Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision to establish financial institution standards for protecting the security and confidentiality of financial institution customers' non-public personal information. The effective date of the Section 501(b) provisions was July 1, 2001. (Refer to FIL-22-2001, dated March 14, 2001, for the interagency guidelines establishing standards for safeguarding customer information.)

The standards' objectives are to:

• ensure the security and confidentiality of customer information;
• protect against any anticipated threats or hazards to the security or integrity of such information; and
• protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer.

The attached examination procedures have been developed to assist examiners in evaluating an institution's compliance with the customer safeguards and to ensure that the established standards are applied consistently.

See Attachment: Examination Procedures to Evaluate Compliance with the Guidelines to Safeguard Customer Information

FIL-50-2001 - Bank Technology Bulletin on Outsourcing

Introduces three short documents containing practical ideas for banks to consider when they engage in technology outsourcing. They are for informational purposes only and should not be considered examination procedures or official guidance.

Because community banks may face particular challenges in engaging and supervising their technology providers, the FDIC has talked with bankers and other experts to identify areas where assistance might be useful. Three informational documents were produced as a result of those discussions:

• Effective Practices for Selecting a Service Provider
• Tools to Manage Technology Providers' Performance Risk: Service Level Agreements
• Techniques for Managing Multiple Service Providers

See Attachment: Bank Technology Bulletin

FIL-46-2001 - Privacy Of Consumer Financial Information

The FDIC has developed and approved the attached examination procedures to review supervised financial institutions for compliance with the agencies' regulation on "Privacy of Consumer Financial Information."

The examination procedures are tailored to institutions' information-sharing practices. For example, institutions that do not share nonpublic personal information outside of the exceptions in §§ 332.14 or 332.15 will not require a review of the regulation's "opt out" requirements. Institutions that do not receive information from other financial institutions outside of the exceptions in §§ 332.14 or 332.15 will undergo a less extensive review under the "reuse or redisclosure" provisions than those institutions that do receive information outside of those exceptions.

See Attachment: Privacy of Consumer Financial Information (pdf)

FIL-22-2001 - Security Standards for Customer Information

The FDIC has approved and issued the attached guidelines establishing standards for safeguarding customer information as required by the Gramm-Leach-Bliley Act (GLBA).

GLBA requires the banking agencies to establish appropriate standards for financial institutions relating to the administrative, technical and physical safeguards of customer records and information. The standards' objectives are to:

• ensure the security and confidentiality of customer information;
• protect against any anticipated threats or hazards to the security or integrity of such information; and
• protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer.

See Attachment: Federal Register, pages 8616-8641

FIL-67-2000 - Security Monitoring of Computer Networks

Guidelines defining the imperative requirement that appropriate personnel activate security log and review them frequently. Required whether Internet or core banking functions exist in-house or are outsourced, management is responsible for ensuring that financial institution and customer data are protected.

Additional guidance is defined for tracking and managing vulnerability threat information. Several Internet sites provide notification of systems and application vulnerabilities focused on the most common network operating systems used by most financial institutions. Crackers/hackers routinely monitor the Web sites to learn of new weaknesses that have been found. Financial institutions that do not subscribe to such [vulnerability intelligence] services and do not keep operating system patches current are very vulnerable to attacks. The FDIC recommends that financial institutions use these services to augment system security.

FIL-68-99 - Risk Assessment Tools And Practices For Information System Security

Bank management is responsible for ensuring that systems and data are protected against risks associated with emerging technology and computer networks. The attached paper emphasizes three primary components of a sound information security program: prevention, detection, and response. The extent of an institution's information security program will depend on the nature of its activities and should be based on a comprehensive risk assessment.

See Attachment: Risk Assessment Tools and Practices for Information System Security

NCUA - National Credit Union Administration

NCUA Letter 01-CU-11 - Electronic Data Security Overview

Ensure the security and confidentiality of member records, protect against anticipated threats or hazards to the security or integrity of such records, and protect against unauthorized access to or use of such records that could result in substantial harm or serious inconvenience to a member.

In response to GLBA compliance requirements NCUA released Guidelines for Safeguarding Member Information. The guide specifies that detail requirements when developing your policies and procedures that should be addressed:

• Identify the services provided and systems (hardware and software) used.
• Identify the risks and threats associated with each system and service.
• Determine the likelihood the risk/threat could occur.
• Identify and evaluate methodologies to mitigate the risks/threats.
• Develop the policies and procedures to address the risks/threats.
• Monitor and adjust, if necessary, the policies and procedures to achieve the desired results.
• Review policies and procedures at least annually.
• Train and educate staff.