Commercial Internet Banking Risk Assessment and Controls Evaluation

Risk Assessment Questions

For each question, select the answer that best represents your environment. Following the assessment, use the “Control Evaluation – Tips” to evaluate your environment.

Personnel Security:

1. Are employees required to sign an Acceptable Use Policy (AUP)?

   Yes, at least annually or more frequently, as needed

   Yes, but only at hire

   No

2. Does each employee using internet banking go through security awareness training?

   Yes, at least annually or more frequently, as needed

   Yes, but only at hire

   No

3. Do you complete background checks on employees prior to hire?

   Yes, for all employees

   Yes, but only based on position

   No

System Security:

1. Is a dedicated system used for internet banking activities?
   

   Yes, the system is dedicated to only internet banking activities

   No, the system is used for other business purposes

2. Do systems have up-to-date antivirus software?

   Yes, all systems

   Yes, but only critical systems

   No

3. Is there a process in place to ensure software updates and patches are applied (e.g., Microsoft, web browser, Adobe products, etc.)?

   Yes, a formal process where updates are applied on a regular basis

   Yes, but only as needed

   No

4. Do users run as local administrators on their computer systems?

   No

   Yes, but only those who require it

   Yes

5. Does a firewall protect the network?

   Yes

   No

6. Do you have an Intrusion Detection/Prevention System (IDS/IPS) in place to monitor and protect the network?

   Yes

   No

7. Is internet content filtering being used?

   Yes, internet traffic on the system used for “high risk” internet banking activities is restricted to approved sites, needed for business functions

   Yes, we have internet content filtering

   No

8. Is email filtering being used?

   Yes

   No

9. Are users of the internet banking system trained to manually lock their workstations when they leave them?

   Yes, and the systems are set to timeout after a period of inactivity

   Yes, but timeout is not enabled

   No

10. Is wireless technology used on the network with the internet banking system?

    No

    Yes, but wireless traffic uses industry-approved encryption

    Yes, but wireless uses weak encryption

    Yes, and wireless traffic is not encrypted

Physical Security:

1. Are critical systems (including systems used to access internet banking) located in a secure area?

   Yes, behind a locked door

   Yes, in a restricted area

   No, in a public area

2. How are passwords protected?

   Passwords are securely stored

   Passwords are not securely stored (e.g., written on paper or sticky notes)

Previous Experience:

1. Have you experienced fraud through internet banking in the past?
   

   No

   Yes, attempted fraud, but it was detected and stopped

   Yes

2. Has malware been discovered on systems used for internet banking activities in the past?
   

   No

   Yes

Risk Rating

Note: this risk rating is designed to give a general idea of your risk posture based only on the answers in this questionnaire. Additional factors could either increase or decrease the risk.

Control Evaluation – Tips

Your answers indicate you have implemented this assessment’s recommended controls.

1. Create an Acceptable Use Policy (AUP), if you don’t already have one, and require your employees sign it at least annually.
   An Acceptable Use Policy (AUP) details the permitted user activities and consequences of noncompliance. Examples of elements included in an AUP are: purpose and scope of network activity; devices that can be used to access the network, bans on attempting to break into accounts, crack passwords, circumvent controls or disrupt services; expected user behavior; and consequences of noncompliance.
2. Require each employee who uses internet banking to go through security awareness training at least annually.
   Security Awareness Training (SAT) for internet banking users, at a minimum, should include a review of the acceptable use policy, desktop security, log-on requirements, password administration guidelines, social engineering tactics, etc.
3. Run background checks on all employees prior to hire.
   Companies should have a process to verify job application information on all new employees. The sensitivity of a particular position or job junction may warrant additional background and credit checks. After employment, companies should remain alert to changes in employees’ circumstances that could increase incentives for abuse or fraud.
4. Dedicate a system to only internet banking activities.
   It is best to have a dedicated system for high-risk internet banking activities.
5. Ensure all computer systems have up-to-date antivirus software.
   Companies should maintain active and up-to-date antivirus protection provided by a reputable vendor. Schedule regular scans of your computer in addition to real-time scanning.
6. Implement a process to ensure software updates and patches are applied frequently.
   This includes a computer’s operating system and other installed software (e.g., web browsers, Adobe products, Microsoft Office, etc.). In many cases, it is best to automate software updates when the software supports it.
7. Limit local administrator privilege on computer systems where possible.
8. Use firewalls on your local network to add another layer of protection for all the devices that connect through the firewall (e.g., workstations, smart-phones, tablets, etc.).
9. Implement an Intrusion Detection/Prevention System (IDS/IPS) to protect your network.
   An IDS/IPS is used to monitor network/internet traffic and report or respond to potential attacks.
10. Restrict internet traffic on the systems used for internet banking activities.
    Filter web traffic to restrict potentially harmful or unwanted internet sites from being accessed by computer systems. For “high risk” systems, it is best to limit internet sites to only business sites that are required.
11. Implement an email filter to help eliminate potentially harmful or unwanted email messages from making it to end users’ inboxes.
12. Configure workstations to timeout after a period of inactivity and train users to manually lock their work stations when they leave them.
    Systems should be locked (requiring a password to reconnect) when users walk away from their desks to prevent unauthorized access to the system.
13. Secure wireless traffic using industry-approved encryption.
    Wireless networks are considered public networks because they use radio waves to communicate. Radio waves are not confined to specific areas and are easily intercepted by unauthorized individuals. Therefore, if wireless is used, security controls such as encryption, authentication, and segregation are necessary to ensure confidentiality and integrity.
14. Locate critical systems (including systems used to access internet banking) in a secure area.
    Only allow approved employees access to the critical systems.
15. Ensure passwords are securely stored and kept confidential.
    Passwords should never be left out for unauthorized individuals to gain access.
16. Review previous fraud experiences and implement security measures to reduce
    the risk of similar incidents.
17. Ensure the system is clean of all malware.
    It is best to do this by rebuilding the system.