 |
 |
 |
 |
 |
|
National Credit Union Administration (NCUA) Vice Chairman Rodney E. Hood participated in a Small Credit Union Workshop hosted by the National Credit Union Administration’s Office of Small Credit Union Initiatives in Charlotte, NC. This forum served as an opportunity for a frank discussion about current issues and challenges facing small credit unions and the impact of credit unions on the communities they serve.
The Office of Thrift Supervision (OTS) today urged thrifts in areas affected by Southern California wildfires to consider all reasonable steps to meet customers’ financial needs. OTS will work with thrifts to identify ways to assist in the recovery efforts of their customers and communities. To facilitate recovery efforts while maintaining standards of safety and soundness, OTS encourages all thrifts in affected areas
This GAO announcement has highlights of GAO-08-36, a report to congressional requesters. An outbreak of pandemic flu would require close cooperation between the public and private sectors to ensure the protection of our nation’s critical infrastructure, such as drinking water and electricity. Because over 85 percent of the nation’s critical infrastructure is owned and operated by the private sector, it is vital that both sectors effectively coordinate to successfully protect these assets. The Department of Homeland Security (DHS) is responsible for coordinating a national protection strategy and government and private sector councils have been created as a collaborating tool. GAO was asked to assess how the federal and private sectors are working together at a national level to protect the nation’s critical infrastructure in the event of a pandemic, the challenges they face, and opportunities for addressing these challenges. GAO reviewed 5 of the 17 critical infrastructure sectors. These 5 sectors are energy (electricity), food and agriculture, telecommunications, transportation (highway and motor carrier), and water.
The federal financial institution regulatory agencies and the Federal Trade Commission have sent to the Federal Register for publication final rules on identity theft “red flags” and address discrepancies. The final rules implement sections 114 and 315 of the Fair and Accurate Credit Transactions Act of 2003. The final rules require each financial institution and creditor that holds any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft, to develop and implement an Identity Theft Prevention Program (Program) for combating identity theft
The National Credit Union Administration (NCUA) Region V office examiners stationed in California have contacted all credit unions located in the fire damaged areas of Southern California and at noon (Pacific time) today most credit unions have returned to operations as normal.
DRAFT SP 800-39, Managing Risk from Information Systems: An Organizational Perspective NIST announces the release of the initial public draft of Special Publication 800-39, Managing Risk from Information Systems: An Organizational Perspective.
The National Credit Union Administration (NCUA) has activated its disaster relief policy to assist credit unions and their members affected by the wildfires in California. President George W. Bush has declared an emergency exists in the state of California and ordered federal aid to supplement state and local response efforts.
Nearly All Participants Find Critical Gaps in Plans The Treasury Department, the Financial Services Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security, and the Securities Industry and Financial Management Association today released the preliminary results of the industry-wide pandemic flu exercise.
Consumers need to keep five tips in mind for managing their checking accounts and safeguarding their funds from unauthorized transfers by criminals, according to a new Federal Reserve Board publication.
The Office of the Comptroller of the Currency today issued a proclamation allowing national bank offices affected by the wildfires in southern California to close at their discretion.
Interfaces for Personal Identity Verification (4 parts): 1- Card Application Namespace, Data Model & Representation 2- Card Appl. Card Command Interface 3- Client Appl. Programming Interface 4- Transitional Interfaces & Data Model NIST Special Publication 800-73-2, Interfaces for Personal Identity Verification , is now available for a 30 day public comment period.
DRAFT NIST IR 7328: Security Assessment Provider Requirements and Customer Responsibilities: Building a Security Assessment Credentialing Program for Federal Information Systems NIST announces the release of draft NIST Interagency Report 7328, Security Assessment Provider Requirements and Customer Responsibilities: Building a Security Assessment Credentialing Program for Federal Information Systems.
What GAO Found The inherent problems of measuring the costs and benefits of regulation make it difficult to assess the extent to which regulations may be unduly burdensome to U.S. financial services firms, particularly in comparison to firms in other countries.
NIST announces the release of five publications: Draft SP 800-110, Information System Security Reference Model, Special Publication (SP) 800-44 version 2, Guidelines on Securing Public Web Servers, Draft SP 800-55 Revision 1, Performance Measurement Guide for Information Security, Draft SP 800-61 Revision 1, Computer Security Incident Handling Guide, and Draft SP 800-82, Guide to Industrial Control Systems (ICS) Security.
NIST announces the release of five publications: Draft SP 800-82, Guide to Industrial Control Systems (ICS) Security,Special Publication (SP) 800-44 version 2, Guidelines on Securing Public Web Servers, Draft SP 800-55 Revision 1, Performance Measurement Guide for Information Security, Draft SP 800-61 Revision 1, Computer Security Incident Handling Guide, and Draft SP 800-110, Information System Security Reference Model.
NIST announces the release of five publications: Computer Security Incident Handling Guide, Draft SP 800-82,Special Publication (SP) 800-44 version 2, Guidelines on Securing Public Web Servers, Draft SP 800-55 Revision 1, Performance Measurement Guide for Information Security, Draft SP 800-61 Revision 1, Guide to Industrial Control Systems (ICS) Security, and Draft SP 800-110, Information System Security Reference Model.
NIST announces the release of five publications: Draft SP 800-55 Revision 1, Performance Measurement Guide for Information Security, Draft SP 800-61 Revision 1, Computer Security Incident Handling Guide, Draft SP 800-82, Guide to Industrial Control Systems (ICS) Security, Draft SP 800-110, Information System Security Reference Model, and Special Publication (SP) 800-44 version 2, Guidelines on Securing Public Web Servers.
NIST announced the release of five publications: Special Publication (SP) 800-44 version 2, Guidelines on Securing Public Web Servers, Draft SP 800-55 Revision 1, Performance Measurement Guide for Information Security, Draft SP 800-61 Revision 1, Computer Security Incident Handling Guide, Draft SP 800-82, Guide to Industrial Control Systems (ICS) Security, and Draft SP 800-110, Information System Security Reference Model.
The federal bank and thrift agencies issued final rules on Friday expanding the range of small institutions eligible for an extended 18-month on-site examination cycle. The final rules allow well-capitalized and well-managed banks and savings associations with up to $500 million in total assets and a composite CAMELS rating of 1 or 2 to qualify for an 18-month (rather than a 12-month) on-site examination cycle.
Summary: The Federal Deposit Insurance Corporation (FDIC) has announced a series of steps intended to provide regulatory relief to financial institutions and to facilitate recovery in areas of Illinois that suffered major damage from storms and flooding.
Summary: In an update to FIL-75-2007, the Federal Deposit Insurance Corporation (FDIC) has announced a series of steps intended to provide regulatory relief to financial institutions and to facilitate recovery in additional areas of Ohio and Wisconsin that are suffering from storms and flooding.
National Credit Union Administration (NCUA) Board Member Gigi Hyland participated in a podcast this week to address the latest best practices credit unions may consider in order to protect their members from data breaches and security risks.
Enhanced Due Diligence for Correspondent Accounts Maintained by Certain Foreign Banks The Financial Crimes Enforcement Network (FinCEN) announced the issuance of a final rule implementing a key provision of Section 312 of the USA PATRIOT Act, clarifying the risk-based procedures that U.S. financial institutions should use in tailoring their enhanced due diligence to assess the risks of some foreign banking relationships. “As international anti-money laundering standards improve globally, risk assessments for foreign banks should become easier to conduct. Common standards are increasingly protecting both sides of the international relationship,” said FinCEN Director James H. Freis, Jr. “U.S. banks can take comfort in the fidelity of their foreign customers and foreign banks will find it easier to process their U.S. transactions.”
NIST announces that the following draft Special Publications (SP) are now available for public comment: SP 800-113, Guide to SSL VPNs.
NIST announces that the following draft Special Publications (SP) are now available for public comment: SP 800-48 Revision 1, Wireless Network Security for IEEE 802.11a/b/g and Bluetooth.
NIST is pleased to announce the release of Special Publication 800-78-1, Cryptographic Algorithms and Key Sizes for Personal Identity Verification. The document has been modified to enhance interoperability, simplify the development of relying party applications, and enhance alignment with the National Security Agency's Suite B Cryptography.
The U.S. Treasury will sponsor a test of the financial services sector's ability to withstand a bird flu outbreak or other pandemic. The online exercise aims to bring together large and small credit unions and banks, brokers, insurers and other financial services firms to examine contingency plans for a number of areas, including continuity of operations, transportation, telecommunications, human resources and energy.
Computer interconnectivity has produced enormous benefits but has also enabled criminal activity that exploits this interconnectivity for financial gain and other malicious purposes, such as Internet fraud, child exploitation, identity theft, and terrorism. Efforts to address cybercrime include activities associated with protecting networks and information, detecting criminal activity, investigating crime, and prosecuting criminals.
The Federal Reserve, the Office of the Comptroller of the Currency, the Office of Thrift Supervision and the Federal Deposit Insurance Corporation reached an agreement today regarding the implementation of Basel II in the United States. The agreement resolves major outstanding issues and will now lead to finalization of a rule implementing the advanced approaches for computing large banks' risk-based capital requirements.
DHS has issued a national plan aimed at providing a consistent approach to critical infrastructure protection, ensured that all 17 sectors have organized to collaborate on protection efforts, and worked with government and private sector partners to complete all 17 sector-specific plans.Nevertheless, our work has shown that sectors vary in terms of how complete and comprehensive their plans are. Furthermore, DHS recognizes that the sectors, their councils, and their plans must continue to evolve. As they do, and as the plans are updated and annual implementation reports are provided that begin to show the level of protection achieved, it will be important that the plans and reports add value, both to the sectors themselves and to the government as a whole. This is critical because DHS is dependent on these plans and reports to meet its mandate to evaluate whether gaps exist in the protection of the nation’s most critical infrastructure and key resources and, if gaps exist, to work with the sectors to address them.
The following GAO report highlights GAO-07-737, a report to congressional requesters.In recent years, many entities in the private, public, and government sectors have reported the loss or theft of sensitive personal information.
National Credit Union Administration (NCUA) Chairman JoAnn Johnson announced today the availability of a financial education library on the NCUA website.
This letter transmits an exposure draft of Volume III of the Government Accountability Office (GAO) and the President’s Council on Integrity and Efficiency (PCIE) Financial Audit Manual (FAM)
The National Institute of Standards and Technology (NIST) announces the release of Draft Federal Information Processing Standard (FIPS) 180-3 Publication, Secure Hash Standard (SHS)
The National Institute of Standards and Technology (NIST) announces the release of Draft Federal Information Processing Standard (FIPS) 198-1 Publication, The Keyed-Hash Message Authentication Code (HMAC).
The Financial Crimes Enforcement Network issued today the latest edition of the SAR Activity Review – By The Numbers that introduces a number of visual enhancements aimed at providing financial institutions with more information on the geographical dispersion of the Suspicious Activity Report filings.
Federal agencies have recently reported a spate of security incidents that put sensitive data at risk. Personally identifiable information about millions of Americans has been lost, stolen, or improperly disclosed, thereby exposing those individuals to loss of privacy, identity theft, and financial crimes.
National Credit Union Administration (NCUA) Chairman JoAnn Johnson testified on June 7 at a hearing before the U.S. House of Representatives Subcommittee on Financial Institutions and Consumer Credit. Chairman Johnson was invited to share insights regarding the Federal Reserve Board’s proposed revisions to Regulation Z,
Hurricane Preparedness, Safety and Soundness of Credit Unions Discussed with Ranking Member of Financial Services Committee National Credit Union Administration (NCUA) Vice Chairman Rodney E. Hood met with Congressman Spencer Bachus last week on Capitol Hill. Congressman Bachus serves as the ranking member of the House Committee on Financial Services. In recognition of President Bush’s declaration of last week as National Hurricane Preparedness Week, the Vice Chairman and ranking member Bachus discussed the action taken by NCUA in order to prepare the credit union community for hurricanes and other weather related emergencies.
President Bush has declared May 20 through May 26 as National Hurricane Preparedness Week. This week is an opportunity to raise awareness of measures Americans can take to protect their families and finances in the event of these weather related emergencies.
NCUA is continually making strides to strengthen its readiness in the event of a hurricane. Recently, the agency improved its contingency processes for information reporting and communication based upon lessons learned from government-wide exercises, contingency operations, and cross-agency working groups. Additionally, the agency will continue to train its staff to ensure they are prepared, knowledgeable, and ready. NCUA updated its examination program last year to ensure all credit unions are prepared for potential emergencies.
FinCEN has issued a SAR Activity Review report for financial institutions to use. Click to read the ”“SAR Activity Review: Trends, Tips and Issues Update.”
United States Department of the Treasury Financial Crimes Enforcement Network FinCEN Advisory
Subject:Transactions Involving Nigeria
This Advisory is being issued to inform banks and other financial institutions operating in the United States that Financial Crimes Enforcement Network (FinCEN) Advisory Issue 32, regarding the Federal Republic of Nigeria, is hereby withdrawn.
Since the issuance of Advisory 32, and as reflected in its June 23, 2006 decision, the Financial Action Task Force on Money Laundering has removed Nigeria from its list of countries that are non-cooperative in the fight against money laundering, recognizing the progress Nigeria has made in implementing anti-money laundering reforms. Nigeria has enacted significant reforms to its counter-money laundering system, addressing the deficiencies listed in Advisory 32, and has taken concrete steps to bring these reforms into effect. Because of the enactment of new laws and the beginning of effective implementation, the enhanced scrutiny called for in Advisory 32 with respect to transactions invol
The U.S. Departments of Treasury, Justice, and Homeland Security joined together in issuing the 2007 National Money Laundering Strategy, a report detailing continued efforts to dismantle money laundering and terrorist financing networks and bring these criminals to justice. "The 2007 National Money Laundering Strategy is a direct result of close cooperation by the Departments of Justice, Treasury and Homeland Security, along with our foreign counterparts, and signifies our collective commitment to fight money laundering," said Assistant Attorney General Alice S. Fisher of the Justice Department's Criminal Division. "Implementation of this strategy will greatly assist in efforts to seize and forfeit millions in illegal proceeds that flow through the international financial system."
FINANCIAL MARKET PREPAREDNESS Significant Progress Has Been Made, but Pandemic Planning and Other Challenges Remain Highlights of GAO-07-399, a report to congressional requesters This is GAO’s third report since the September 11 terrorist attacks that assesses progress that market participants and regulators have made to ensure the security and resiliency of our securities markets. This report examined (1) actions taken to improve the markets’ capabilities to prevent and recover from attacks; (2) actions taken to improve disaster response and increase telecommunications resiliency; and (3) financial regulators’ efforts to ensure market resiliency. GAO inspected physical and electronic security measures and business continuity capabilities using regulatory, government, and industry-established criteria and discussed improvement efforts with broker dealers, banks, regulators, telecommunications carriers, and trade associations. What GAO Recommends To improve the readiness of the securities markets to withstand potential disease pandemics, securities and banking regulators should consider taking additional actions, including providing formal expectations that market participants’ plans address even severe pandemic outbreaks and setting a date by which such plans should be completed. Banking and securities regulators indicated they believe organizations are adequately addressing this risk, but will consider taking the recommended actions if progress lags. GAO believes that giving greater consideration now would better assure market readiness.
The Financial Crimes Enforcement Network (FinCEN) today filed a Federal Register notice announcing the delayed implementation of certain revised Suspicious Activity Report (SAR) forms that were scheduled to become effective on June 30, 2007. The agency is withdrawing this effective date for the revised SAR forms for depository institutions, casinos and card clubs, insurance companies, and the securities and futures industries. FinCEN will establish new effective and mandatory compliance dates for these revised forms in a future notice. The delay does not impact ongoing suspicious activity reporting, which will continue using the current forms.
President Bush's Identity Theft Task Force today released its strategic plan for combating identity theft, the top consumer fraud reported to the Federal Trade Commission. Treasury Deputy Assistant Secretary for Critical Infrastructure Protection and Compliance Policy D. Scott Parsons, who led the Department's efforts with the taskforce, released the following statement today.
Why GAO Did This Study For many years, GAO has reported that weaknesses in information security are a widespread problem with potentially devastating consequences—such as intrusions by malicious users, compromised networks, and the theft of personally identifiable information. In reports to Congress since 1997, GAO has identified information security as a governmentwide high-risk issue.
NCUA proposes to amend its regulations to address a federally-insured credit union’s obligation to maintain a records preservation program. The proposed rule draws from existing guidance to clarify requirements for preserving vital records and to suggest important items for consideration in restoring vital member services. NCUA believes the revised language and new appendix will facilitate the recovery of essential operations after a catastrophic act resulting in continued member confidence in the credit union system. The agency also proposes to amend its regulations to clarify the meaning of catastrophic act.
Because of the integration of voice and data in a single network, establishing a secure VOIP and data network is a complex process that requires greater effort than that required for data-only networks. In particular, start with these general guidelines, recognizing that practical considerations, such as cost or legal requirements, may require adjustments for the organization: 1. Develop appropriate network architecture. • Separate voice and data on logically different networks if feasible. Different subnets with separate RFC 1918 address blocks should be used for voice and data traffic, with separate DHCP servers for each, to ease the incorporation of intrusion detection and VOIP firewall protection
The government’s interest in using technology to detect terrorism and other threats has led to increased use of data mining. A technique for extracting useful information from large volumes of data, data mining offers potential benefits but also raises privacy concerns when the data include personal information. GAO was asked to review the development by the Department of Homeland Security (DHS) of a data mining tool known as ADVISE (Analysis, Dissemination, Visualization, Insight, and Semantic Enhancement). Specifically, GAO was asked to determine (1) the tool’s planned capabilities, uses, and associated benefits and (2) whether potential privacy issues could arise from using it to process personal information and how DHS has addressed any such issues. GAO reviewed program documentation and discussed these issues with DHS officials.
The Financial Crimes Enforcement Network (FinCEN) and the federal banking agencies announced Thursday that the format for the Suspicious Activity Report by Depository Institutions (SAR-DI) has been revised to support a new joint filing initiative, which will reduce the number of duplicate SARs filed for a single suspicious transaction. The revisions are the result of a joint effort by FinCEN and the federal banking agencies.
Eight federal regulators on Wednesday released a notice of proposed rulemaking (NPR) requesting comment on a model privacy form that financial institutions can use for their privacy notices to consumers required by the Gramm-Leach-Bliley Act (GLB Act). The privacy notices must describe an institution's information sharing practices, and, for certain types of sharing, consumers have the right to opt out. The notices must be provided when a consumer first becomes a customer of a financial institution and then annually for as long as the customer relationship lasts. Last October, President Bush signed into law the Financial Services Regulatory Relief Act of 2006, amending the GLB Act to require the agencies to propose a model form that is succinct and comprehensible to consumers, allows consumers easily to compare privacy practices of financial institutions, and uses easily readable type font.
Kmart Corporation has agreed to settle Federal Trade Commission charges that it engaged in deceptive practices in advertising and selling its Kmart gift card. As part of the settlement, Kmart will implement a refund program and publicize it on its Web site. This is the agency’s first law enforcement action involving gift cards. “Consumers have a right to know when gift cards come with strings attached,” FTC Chairman Deborah Platt Majoras said. “If fees or restrictions apply, gift card issuers must fully and clearly disclose them.”
National Credit Union Administration (NCUA) JoAnn Johnson has issued a Letter to Credit Unions regarding the upcoming change in schedule for Daylight Savings Time (DST), which in the United States will begin three weeks earlier and end one week later than in previous years. Credit unions may be exposed to a variety of risks if they do not prepare their systems to reflect this change. The Letter to Credit Unions recommends that credit union management should consider the following actions to ensure readiness for the new start of DST...
This Letter to Credit Unions reminds credit unions of the upcoming change in the schedule for Daylight Saving Time (DST). DST in the United States will begin three weeks earlier and end one week later than in previous years. Credit unions may be exposed to a variety of risks if they do not prepare their systems to reflect this change. BACKGROUND
Electronic mail (email) is perhaps the most popularly used system for exchanging business information over the Internet (or any other computer network). At the most basic level, the email process can be divided into two principal components: (1) mail servers, which are hosts that deliver, forward, and store email; and (2) mail clients, which interface with users and allow users to read, compose, send, and store email. This document addresses the security issues of mail servers and mail clients, including Web-based access to mail. Mail servers and user workstations running mail clients are frequently targeted by attackers. Because the computing and networking technologies that underlie email are ubiquitous and well-understood by many, attackers are able to develop attack methods to exploit security weaknesses. Mail servers are also targeted because they (and public Web servers) must communicate to some degree with untrusted third parties.
Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. Intrusion detection and prevention systems (IDPS)1 are primarily focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. In addition, organizations use IDPSs for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies. IDPSs have become a necessary addition to the security infrastructure of nearly every organization.
A wireless local area network (WLAN) enables access to computing resources for devices that are not physically connected to a network. WLANs typically operate over a fairly limited range, such as an office building or building campus, and usually are implemented as extensions to existing wired local area networks to enhance user mobility. This guide seeks to assist organizations in better understanding the most commonly used family of standards for WLANs—Institute of Electrical and Electronics Engineers (IEEE) 802.11—focusing on the security enhancements introduced in the IEEE 802.11i amendment. In particular, this guide explains the security features and provides specific recommendations to ensure the security of the operating environment.
The Homeland Security Presidential Directive HSPD-12 called for new standards to be adopted governing the interoperable use of identity credentials to allow physical and logical access to Federal government locations and systems. The Personal Identity Verification (PIV) standard for Federal Employees and Contractors, Federal Information Processing Standard (FIPS 201), was developed to establish standards for identity credentials. This document, Special Publication 800-76 (SP 800-76), is a companion document to FIPS 201. It describes technical acquisition and formatting specifications for the biometric credentials of the PIV system, including the PIV Card1 itself. It enumerates procedures and formats for fingerprints and facial images by restricting values and practices included generically in published biometric standards. The primary design objective behind these particular specifications is high performance universal interoperability. For the preparation of biometric data suitable for the Federal Bureau of Investigation (FBI) background check, SP 800-76 references FBI documentation, including the ANSI/NIST Fingerprint Standard and the Electronic Fingerprint Transmission Specification. This document does not preclude use of other biometric modalities in conjunction with the PIV card.
Hurricanes Katrina and Rita destroyed homes and displaced millions of individuals. While federal and state governments continue to respond to this disaster, GAO has identified significant control weaknesses-specifically in the Federal Emergency Management Agency (FEMA)'s Individuals and Households Program (IHP) and in Department of Homeland Security (DHS)'s purchase card program—resulting in significant fraud, waste, and abuse. In response to the numerous recommendations GAO made, DHS and FEMA have reported on numerous actions taken to address our recommendations. Lessons learned from GAO's prior work can serve as a framework for an effective fraud prevention system for federal and state governments as they consider spending billions more on disaster recovery. These lessons are particularly important because funding that is lost to fraud, waste, and abuse reduces the amount of money that could be delivered to victims in need.
The Federal Reserve Banks today announced plans to conduct another round of studies to determine the current composition of the nation's retail payments market, including checks, credit and debit cards, and automated clearing house (ACH) transactions. These two studies will build on information gained from similar studies published by the Reserve Banks in 2001 and 2004. "As the nation continues its migration from paper-based to electronic payments, we believe these studies will provide additional insight to help industry participants plan for the future," said Richard Oliver, an executive vice president with the Federal Reserve Bank of Atlanta and the Federal Reserve System's product manager for retail payments.
The Federal Reserve Board on Friday approved changes to its Policy on Payments System Risk that revise the Board's expectations for systemically important payments and settlement systems subject to its authority and update and clarify the policy with regard to central counterparties. Under the revised policy, systemically important payments and settlement systems subject to the Board's authority are expected to complete and disclose publicly self-assessments against the principles and minimum standards in the policy. The self-assessment should be reviewed and approved by the system's senior management and board of directors upon completion and made readily available to the public. In addition, a self-assessment should be updated following material changes to the system or its environment and, at a minimum, reviewed by the system every two years.
The National Credit Union Administration and the Financial Crimes Enforcement Network today announced that they will jointly host a seminar over the web "BSA: A Year in Review and Setting the Table for 2007." The seminar, known as a webinar, will take place on Tuesday, February 6, 2007 and will be co-hosted by JoAnn Johnson, Chairman of the National Credit Union Administration (NCUA), and Jamal El-Hindi, Associate Director of the Regulatory Policy and Programs Division at the Financial Crimes Enforcement Network (FinCEN).
As use of the Internet continues to expand, more credit unions are using it to offer products and services or otherwise enhance communications with members. The Internet offers the potential for safe, convenient new ways to shop for financial services and conduct credit union business, any day, any time. However, members need to make good on-line choices—decisions that may help avoid costly surprises or scams.
The Agencies are adopting an Interagency Statement on Sound Practices Concerning Elevated Risk Complex Structured Finance Activities ("Final Statement"). The Final Statement pertains to national banks, state banks, bank holding companies (other than foreign banks), federal and state savings associations, savings and loan holding companies, U.S. branches and agencies of foreign banks, and SEC-registered broker-dealers and investment advisers (collectively, "financial institutions" or ("institutions") engaged in complex structured finance transactions ("CSFTs"). In May 2004, the Agencies issued and requested comment on a proposed interagency statement ("Initial Proposed Statement"). After reviewing the comments received on the Initial Proposed Statement, the Agencies in May 2006 issued and requested comment on a revised proposed interagency statement ("Revised Proposed Statement").
The selection and employment of appropriate security controls for an information system are important tasks that can have major implications on the operations4 and assets of an organization as well as the welfare of individuals. Security controls are the management, operational, and technical safeguards or countermeasures prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. There are several important questions that should be answered by organizational officials when addressing the security considerations for their information systems: • What security controls are needed to adequately protect the information systems that support the operations and assets of the organization in order for that organization to accomplish its assigned mission, protect its assets, fulfill its legal responsibilities, maintain its day-to-day functions, and protect individuals?
At the request of the Federal Trade Commission, a federal court has shut down a payment processing operation that allegedly helped fraudulent telemarketers take millions of dollars from consumers' bank accounts. According to the FTC's complaint, since at least January 2003 the operation has aided at least nine Canada-based, advance-fee credit card schemes that induce consumers to allow an electronic debit of several hundred dollars from their bank account in exchange for an unsecured credit card; but consumers never receive a credit card or, at best, they receive a "benefits package" containing relatively worthless items.
This document is a tool for financial institutions’ use in assessing and mitigating risks associated with implementation of Remote Deposit Image Capture (RDIC). This paper provides successful strategies that financial institutions (FIs) have employed for managing the risks with RDIC. It does not imply that all of these strategies are necessary for a successful program. This paper also does not address the specific technologies used to implement the RDIC process and/or mitigate the risk, as technology used will often be determined by other factors such as the compatibility of the clients’ and FIs’ equipment. This paper identifies potential risks as they pertain to product distribution, equipment and software, information system security, images and image quality, and processes.
Unauthorized access to sensitive customer information threatens to undermine customer confidence and the reputations of both individual financial institutions and the financial services industry. This threat is aggravated by the patchwork of state laws and federal regulations that govern unauthorized access or breach response incidents. Despite these challenges, financial institutions are strengthening data security programs and developing or improving customer notification programs. The “BITS/ABA Key Considerations for Responding to Unauthorized Access to Sensitive Customer Information” is a tool that may assist some financial institutions in developing and executing response programs when sensitive information is accessed and misused by unauthorized individuals.
This BITS Consumer Confidence Toolkit provides information to support consumer confidence in the safety, soundness and security of financial services. Originally published in September 2005, this is a revised and updated edition. This is intended to be an educational resource—whether for use by consumers, policy makers, financial institutions or others with interest in the subject matter. Special attention is placed on information security as well as online financial services transacted through the Internet. Data in support of the safety of online financial transactions is provided. Information about the proactive leadership of the financial services industry is included, as well as a description of the current environment and tips for consumers to help protect their financial security, including in the online environment. Recommendations for government agencies are also provided.
This Regulatory Alert is to inform you about revisions to Part 748 of the NCUA Rules and Regulations. The revised rule describes in greater detail Suspicious Activity Report (SAR) reporting and filing requirements. The rule became effective November 27, 2006. There are six changes to Part 748 which are summarized below. 1. Notification to board of directors
A digital signature is an electronic analogue of a written signature; the digital signature can be used to provide assurance that the claimed signatory signed the information. In addition, a digital signature may be used to detect whether or not the information was modified after it was signed (i.e., to detect the integrity of the signed data). Each signatory has a public and private key and is the owner of that key pair. The private key is used by the owner to generate a digital signature; the public key is used in the signature verification process. Entities participating in the generation or verification of digital signatures depend on the authenticity of the process. This Recommendation specifies methods for obtaining the assurances necessary for valid digital signatures: assurance of domain parameter validity, assurance of public key validity, assurance that the key pair owner actually possesses the private key, and assurance of the identity of the key pair owner.
Computer security incident response has become an important component of information technology (IT) programs. Security-related threats have become not only more numerous and diverse but also more damaging and disruptive. New types of security-related incidents emerge frequently. Preventative activities based on the results of risk assessments can lower the number of incidents, but not all incidents can be prevented. An incident response capability is therefore necessary for rapidly detecting incidents, minimizing loss and destruction, mitigating the weaknesses that were exploited, and restoring computing services. To that end, this publication provides guidelines for incident handling, particularly for analyzing incident-related data and determining the appropriate response to each incident. The guidelines can be followed independently of particular hardware platforms, operating systems, protocols, or applications.
Why GAO Did This Study
Today's testimony will address whether FEMA provided improper and potentially fraudulent (1) rental assistance payments to registrants at the same time it was providing free housing via trailers and apartments; (2) duplicate assistance payments to individuals who claimed damages to the same property for both hurricanes Katrina and Rita; and (3) IHP payments to non-U.S. residents who did not qualify for IHP. This testimony will also discuss (1) the importance of fraud identification and prevention, and (2) the results of our investigation into property FEMA bought using DHS purchase cards.
The Honorable William M. Thomas Chairman, Committee on Ways and Means House of Representatives Dear Mr. Chairman: During recent congressional hearings and in public speeches, statements made by the National Credit Union Administration's (NCUA) Chairman and another board member raised congressional interest in the ability of NCUA to collect and objectively analyze data on credit union membership and executive compensation. More generally, these statements also raised issues about the agency's overall vigilance as a regulator and the independence and objectivity of NCUA's board and senior staff from the industry being regulated.
National Credit Union Administration (NCUA) Executive Director J. Leonard Skiles has selected John E. Kutchey as Director of Risk Management. As Director of Risk Management, Kutchey is responsible for overseeing NCUA's credit union problem resolution program. Kutchey graduated Magna Cum Laude from the University of Baltimore in 1990 with a Bachelor's Degree in Business Administration with an Accounting Concentration. Kutchey joined NCUA in 1990 as an Examiner in Baltimore, MD. During his career with NCUA, Kutchey has served as an Examiner; Problem Case Officer; Supervisory Examiner; and most recently the Director of Supervision in Region II.
Welcome to the seventh issue of The SAR Activity Review – By the Numbers, a compilation of numerical data gathered from Suspicious Activity Reports filed by depository institutions since April 1996, by certain money services businesses since January 2002, by casinos and card clubs since August 1996, and by certain segments of the securities and futures industries since January 2003. By the Numbers serves as a companion piece to The SAR Activity Review - Trends, Tips & Issues, which provides information about the preparation, use, and utility of Suspicious Activity Reports.
Why GAO Did This Study
GAO was asked to evaluate the extent to which agencies have adequately designed and effectively implemented policies for testing and evaluating their information security controls.
Why GAO Did This Study
The Federal Reserve Board announced the appointment of the chairmen and deputy chairmen of the twelve Federal Reserve Banks for 2007. Each Reserve Bank has a nine-member board of directors. The Board of Governors in Washington appoints three of these directors and each year designates one of its appointees as chairman and a second as deputy chairman.
Introduction This Information Security Handbook provides a broad overview of information security program elements to assist managers in understanding how to establish and implement an information security program. Typically, the organization looks to the program for overall responsibility to ensure the selection and implementation of appropriate security controls and to demonstrate the effectiveness of satisfying their stated security requirements. The topics within this document were selected based on the laws and regulations relevant to information security, including the Clinger¬Cohen Act of 1996, the Federal Information Security Management Act (FISMA) of 2002, and Office of Management and Budget (OMB) Circular A-130. The material in this handbook can be referenced for general information on a particular topic or can be used in the decision-making process for developing an information security program. National Institute of Standards and Technology (NISTIR) Interagency Report 7298 provides a summary glossary for the basic security terms used throughout this document. While reading this handbook, please consider that the guidance is not specific to a particular agency. Agencies should tailor this guidance according to their security posture and business requirements.
Research and development (R&D) of cyber security technology is essential to creating a broader range of choices and more robust tools for building secure, networked computer systems in the federal government and in the private sector. The National Strategy to Secure Cyberspace identifies national priorities to secure cyberspace, including a federal R&D agenda. GAO was asked to identify the:
NCUA is issuing a final rule to describe in greater detail the requirements for reporting and filing a Suspicious Activity Report (SAR) and to address prompt notification of the board of directors of SAR filings, the confidentiality of reports, and liability protection. NCUA also is changing the heading for this part so it more accurately describes its scope. NCUA seeks to enhance credit union compliance with SAR reporting requirements by providing greater detail in its rule on the thresholds and procedures for filing a SAR. DATES: This rule is effective [insert date 30 days after published in the FEDERAL REGISTER]. FOR FURTHER INFORMATION CONTACT: Linda K. Dent, Staff Attorney, Office of General Counsel, at (703) 518-6540.
"An ontology is an explicit specification of a conceptualization. The term is borrowed from philosophy, where Ontology is a systematic account of Existence. For Artificial Intelligence (AI) systems, what "exists" is that which can be represented. When the knowledge of a domain is represented in a declarative formalism, the set of objects that can be represented is called the universe of discourse. This set of objects, and the describable relationships among them, are reflected in the representational vocabulary with which a knowledge-based program represents knowledge. Thus, in the context of AI, we can describe the ontology of a program by defining a set of representational terms. In such an ontology, definitions associate the names of entities in the universe of discourse (e.g., classes, relations, functions, or other objects) with human-readable text describing what the names mean, and formal axioms that constrain the interpretation and well-formed use of these terms. Formally, an ontology is the statement of a logical theory. We use common ontologies to describe ontological commitments for a set of agents so that they can communicate about a domain of discourse without necessarily operating on a globally shared theory." [GRUBER]
GAO continues to have concerns about restatements to federal agencies' previously issued financial statements. During fiscal year 2005, at least 7 of the 24 Chief Financial Officers (CFO) Act agencies restated certain of their fiscal year 2004 financial statements to correct misstatements. To study this trend, GAO reviewed the nature and causes of the restatements made by certain CFO Act agencies in fiscal year 2004 to their fiscal year 2003 financial statements. Eleven CFO Act agencies had restatements for fiscal year 2003. Nine of those 11 received unqualified opinions on their originally issued fiscal year 2003 financial statements. GAO’s view is that users of federal agencies' financial statements and the related audit reports need to be provided at least a basic understanding of why a restatement was necessary and its effect on the agencies' previously issued financial statements and related audit reports. This report communicates GAO's observations on the transparency and timeliness of the 9 federal agencies' and their auditors' restatement disclosures.
Minority banks can play an important role in serving the financial needs of historically underserved communities and growing populations of minorities. For this reason, the Financial Institutions, Reform, Recovery, and Enforcement Act of 1989 (FIRREA) established goals that the Federal Deposit Insurance Corporation (FDIC) and the Office of Thrift Supervision (OTS) must work toward to preserve and promote such institutions (support efforts). To evaluate their efforts, as well as those of the Office of the Comptroller of the Currency (OCC) and the Federal Reserve, GAO (1) reviewed the profitability of minority banks, (2) identified the regulators' support and assessment efforts, and (3) obtained the views of minority banks on the regulators' efforts.
Like any new technology, RFID presents new security and privacy risks that must be carefully mitigated through management, operational, and technical controls in order to realize the numerous benefits the technology has to offer. When practitioners adhere to sound security engineering principles, RFID technology can help a wide range of organizations and individuals realize substantial productivity gains and efficiencies. These organizations and individuals include hospitals and patients, retailers and customers, and manufacturers and suppliers throughout the supply chain. This guidance document provides an overview of RFID technology, the associated security and privacy risks, and recommended practices that will enable organizations to realize productivity improvements while safeguarding sensitive information and protecting the privacy of individuals. Radio frequency identification (RFID) is a form of automatic identification and data capture (AIDC) technology that uses electric or magnetic fields at radio frequencies to transmit information. An RFID system can be used to identify many types of objects, such as manufactured goods, animals, and people.
Organizations have information technology (IT) plans in place, such as contingency and computer security incident response plans, so that they can respond to and manage adverse situations involving IT. These plans should be maintained in a state of readiness, which should include having personnel trained to fulfill their roles and responsibilities within a plan, having plans exercised to validate their content, and having systems and system components tested to ensure their operability in an operational environment specified in a plan. These three types of events can be carried out efficiently and effectively through the development and implementation of a test, training, and exercise (TT&E) program. Organizations should consider having such a program in place because tests, training, and exercises are so closely related. For example, exercises and tests offer different ways of identifying deficiencies in IT plans, procedures, and training. This document provides guidance on designing, developing, conducting, and evaluating TT&E events so that organizations can improve their ability to prepare for, respond to, manage, and recover from adverse events that may affect their missions. The scope of this document is limited to TT&E events for single organizations, as opposed to large-scale events involving multiple organizations, involving internal IT operational procedures for emergencies.
A log is a record of the events occurring within an organization’s systems and networks. Logs are composed of log entries; each entry contains information related to a specific event that has occurred within a system or network. Many logs within an organization contain records related to computer security. These computer security logs are generated by many sources, including security software, such as antivirus software, firewalls, and intrusion detection and prevention systems; operating systems on servers, workstations, and networking equipment; and applications. The number, volume, and variety of computer security logs have increased greatly, which has created the need for computer security log management—the process for generating, transmitting, storing, analyzing, and disposing of computer security log data. Log management is essential to ensuring that computer security records are stored in sufficient detail for an appropriate period of time. Routine log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems.
Adequate security of information and information systems is a fundamental management responsibility. Nearly all applications that deal with financial, privacy, safety, or defense include some form of access control. Access control is concerned with determining the allowed activities of legitimate users, mediating every attempt by a user to access a resource in the system. In some systems, complete access is granted after successful authentication of the user, but most systems require more sophisticated and complex control. In addition to the authentication mechanism (such as a password), access control is concerned with how authorizations are structured. In some cases, authorization may mirror the structure of the organization, while in others it may be based on the sensitivity level of various documents and the clearance level of the user accessing those documents. This publication explains some of the commonly used access control services available in information technology systems.
Why GAO Did This Study In the wake of the 2005 hurricanes in the Gulf Region, GAO and the Department of Homeland Security Office of Inspector General (DHS OIG) initiated a number of audits and investigations addressing the federal government's response to those events. On July 19, 2006, GAO testified on the results of its purchase card work. This report summarizes the testimony and provides recommendations. Department of Homeland Security (DHS) cardholders made thousands of transactions related to hurricane relief operations. GAO analyzed transactions between June and November of 2005 to determine if (1) DHS's control environment and management of purchase card usage were effective; (2) DHS's key internal control activities operated effectively and provided reasonable assurance that purchase cards were used appropriately; and (3) potentially fraudulent, improper, and abusive purchase card activity existed at DHS.
Alexandria, VA, September 27, 2006 - National Credit Union Administration (NCUA) Chairman JoAnn Johnson met recently with senior Administration officials to share recommendations with the President's Identity Theft Task Force. Based upon these recommendations, the Task Force will deliver a final strategic plan to President Bush in early November. During a September 19 Task Force meeting, Chairman Johnson joined U.S. Attorney General Alberto Gonzalez; Clay Johnson III, Deputy Director of the White House Office of Management and Budget, Michael Chertoff, Secretary of the Department of Homeland Security, Carlos M. Guiterrez, Secretary of Commerce; and other senior government officials to discuss recommendations to the President in key areas.
Why GAO Did This Study In 2005, Hurricanes Katrina and Rita caused unprecedented damage. FEMA’s Individuals and Households Program (IHP), provides direct assistance (temporary housing units) and financial assistance (grant funding for temporary housing and other disaster-related needs) to eligible individuals affected by disasters. Our objectives were to (1) compare the types and amounts of IHP assistance provided to Hurricanes Katrina and Rita victims to other recent hurricanes, (2) describe the challenges FEMA faced by the magnitude of the requests for assistance following Hurricanes Katrina and Rita, and (3) determine the vulnerability of the IHP program to fraud and abuse. GAO determined the extent to which the program was vulnerability to fraud and abuse, by conducting statistical sampling, data mining and undercover operations.
The Federal Trade Commission (FTC) is responsible for economic issues that affect both consumers and businesses. Its primary function is to help maintain a competitive market environment that benefits both sides and in this respect, identity theft is seen as negatively affecting both consumers and businesses. In an effort to combat this problem, the FTC provides information and resources that enables the development of effective countermeasures against identity theft. The FTC has developed a website that gives information on how to deter the threat of identity theft, which it refers to as a "one stop national resource" to learn about identity theft. The website provides material that defines identity theft and procedures to deal with it if it occurs.
The purpose of this document is to present recommendations for Personal Identity Verification (PIV) card readers in the area of performance and communications characteristics to foster interoperability. This document is not intended to re-state or contradict requirements specifically identified in Federal Information Processing Standard 201 (FIPS 201) or its associated documents. It is intended to augment existing standards to enable agencies to achieve the interoperability goal of Homeland Security Presidential Directive 12 (HSPD-12). The document provides requirements that facilitate interoperability between any card and any reader. Specifically, the recommendations are for end-point cards and readers designed to read end-point cards.
Electronic mail (email) is perhaps the most popularly used system for exchanging business information over the Internet (or any other computer network). At the most basic level, the email process can be divided into two principal components: (1) mail servers, which are hosts that deliver, forward, and store mail; (2) clients which interface with users and allow users to read, compose, send, and store email messages. This document addresses the security issues of both mail servers and mail clients. Mail servers and user workstations running mail clients are frequently targeted by attackers. Because the computing and networking technologies that underlie email are ubiquitous, it is well understood and attackers are able to develop attack methods to exploit the technology. Mail servers are also targeted because they (and public Web servers) must communicate to some degree with untrusted third parties. Additionally, email clients have been targeted as an effective means of inserting malware into machines and of propagating this code to other machines.
Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of potential incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected potential incidents. Intrusion detection and prevention (IDP) systems are primarily focused on identifying potential incidents, logging information about them, attempting to stop them, and reporting them to security administrators. In addition, organizations use IDPs for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies. IDPs have become a necessary addition to the security infrastructure of nearly every organization. IDPs typically record information related to observed events, notify security administrators of important observed events, and produce reports. Many IDPs can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDP stopping the attack itself, changing the security environment (e.g., reconfiguring a firewall), or changing the attack’s content.
The advance of Web services technologies promises to have far-reaching effects on the Internet and enterprise networks. Web services based on the eXtensible Markup Language (XML), Simple Object Access Protocol (SOAP), and related open standards, and deployed in Service Oriented Architectures (SOA) allow data and applications to interact without human intervention through dynamic and ad hoc connections. Web services technology can be implemented in a wide variety of architectures, can co-exist with other technologies and software design approaches, and can be adopted in an evolutionary manner without requiring major transformations to legacy applications and databases. The security challenges presented by the Web services approach are formidable and unavoidable. Many of the features that make Web services attractive, including greater accessibility of data, dynamic application-to-application connections, and relative autonomy (lack of human intervention) are at odds with traditional security models and controls.
The Federal Deposit Insurance Corporation (FDIC) has a demanding responsibility enforcing banking laws, regulating financial institutions, and protecting depositors. The corporation relies extensively on computerized systems to support and carry out its financial and mission-related operations. As part of the audit of the calendar year 2005 financial statements, GAO assessed (1) the progress FDIC has made in correcting or mitigating information security weaknesses previously reported and (2) the effectiveness of the corporation's information system controls to protect the confidentiality, integrity, and availability of its key financial information and information systems.
The Federal Reserve System's Federal Reserve Banks (FRB) serve as fiscal agents of the U.S. government when they are directed to do so by the Secretary of the Treasury. In this capacity, the FRBs operate and maintain several mainframe and distributed-based systems-including the systems that support the Department of the Treasury's auctions of marketable securities-on behalf of the department's Bureau of the Public Debt (BPD). Effective security controls over these systems are essential to ensure that sensitive and financial information is adequately protected from inadvertent or deliberate misuse, disclosure, or destruction. In support of its audit of BPD's fiscal year 2005 Schedule of Federal Debt, GAO assessed the effectiveness of information system controls in protecting financial and sensitive auction information on key mainframe and distributed-based systems that the FRBs maintain and operate for BPD. To do this, GAO observed and tested FRBs' security controls.
1.1 Background Federal agencies and organizations cannot protect the integrity, confidentiality, and availability of information in today's highly networked systems environment without ensuring that each person involved understands their roles and responsibilities and is adequately trained to perform them. The human factor is so critical to success that the Computer Security Act of 1987 (Public Law [P.L.] 100-235) required that, "Each agency shall provide for the mandatory periodic training in computer security awareness and accepted computer practices of all employees who are involved with the management, use, or operation of each Federal computer system within or under the supervision of that agency." In accordance with P.L. 100-235, the National Institute of Standards and Technology (NIST), working with the U.S. Office of Personnel Management (OPM), was charged with developing and issuing guidelines for Federal computer security training. This requirement was satisfied by NIST's issuance of "Computer Security Training Guidelines" (Special Publication [SP] 500¬172) in November 1989. In January 1992, OPM issued a revision to the Federal personnel regulations which made these voluntary guidelines mandatory. This regulation, 5 CFR Part 930, is entitled "Employees Responsible for the Management or Use of Federal Computer Systems" and requires Federal agencies to provide training as set forth in NIST guidelines.
NIST Special Publication 800-50, Building An Information Technology Security Awareness and Training Program, provides guidance for building an effective information technology (IT) security program and supports requirements specified in the Federal Information Security Management Act (FISMA) of 2002 and the Office of Management and Budget (OMB) Circular A-130, Appendix III. A strong IT securityprogram cannot be put in place without significant attention given to training agency IT users on securitypolicy, procedures, and techniques, as well as the various management, operational, and technical controls necessary and available to secure IT resources. In addition, those in the agency who manage the IT infrastructure need to have the necessary skills to carry out their assigned duties effectively. Failure to give attention to the area of security training puts an enterprise at great risk because security of agencyresources is as much a human issue as it is a technology issue.
Purpose The staffs of the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision (the Agencies) have jointly developed the attached frequently asked questions (FAQs) to assist financial institutions and their technology service providers in understanding the Federal Financial Institutions Examination Council's (FFIEC's) guidance entitled Authentication in an Internet Banking Environment (the guidance). Overview The guidance, issued on October 12, 2005, updates the FFIEC's guidance entitled Authentication in an Electronic Banking Environment issued in 2001. It addresses the need for risk based assessments, customer awareness, and enhanced security measures to authenticate customers using Internet-based products and services that process high risk transactions involving access to customer information or the movement of funds to other parties. The attached FAQs are a representation of questions the Agencies have received from financial institutions, Agency examiners, and technology service providers and they address the scope of the guidance, risk assessments, the time frame for implementation, and other issues.
The mandatory dissemination of certain information by financial institutions is a key aspect of consumer protection law. It offers two significant advantages for consumer protection in the financial area over the alternative of direct government intervention into product pricing and content. First, information disclosure is compatible with competition, a significant market force already at work to protect consumers by keeping price rises in check. Because of competition, institutions already have incentives to make their products known, to reveal favorable pricing and product features, and to treat consumers fairly by keeping them generally informed about what they want and need to know. When a financial institution employs these strategies, it generates a good business reputation that will produce referrals and repeat customers. Actions that firms use to accomplish these goals include advertising their prices and supplying clients and potential customers with useful information about product prices and features. The requirements for disclosures assist in the dissemination of financial information by standardizing concepts and terminology, such as the finance charge and annual percentage rate under the Truth in Lending Act and the annual percentage yield under the Truth in Savings Act. Such standardization advances consumers; knowledge about pricing and features of the financial products and institutions and lowers consumers; transactions costs by making shopping easier. The standard format of required disclosures helps highlight the performance of the best institutions and exposes the inadequacies of the poorer ones. Well-informed shoppers help keep markets competitive, which benefits buyers of products and services by minimizing the spread between
producers’ production costs and market price.
NIST is pleased to announce the release of draft Special Publication 800-69, Guidance for Securing Microsoft Windows XP Home Edition: A NIST Security Configuration Checklist. SP 800-69 provides guidance to home users, such as telecommuting Federal employees, on improving the security of their home computers that run Windows XP Home Edition. Home computers face many threats from people wanting to cause mischief and disruption, commit fraud, and perform identity theft. The publication explains the need to use a combination of security protections, such as antivirus software, antispyware software, a personal firewall, limited user accounts, and automatic software updates, to secure a computer against threats and maintain its security. It also emphasizes the importance of performing regular backups to ensure that user data is available after an adverse event such as an attack against the computer, a hardware failure, or human error. The publication contains detailed step-by-step directions for securing Windows XP Home Edition computers that can be performed by experienced Windows XP Home Edition users. NIST requests comments on NIST SP 800-69 by August 31, 2006. Please submit comments to itsec@nist.gov with "Comments SP800-69/XPHome" in the subject line.
Why GAO Did This Study The Internet protocol (IP) provides the addressing mechanism that defines how and where information such as text, voice, music, and video move across interconnected networks. IP version 4 (IPv4), which is widely used today, may not be able to accommodate the increasing number of global users and devices that are connecting to the Internet. As a result, Internet version 6 (IPv6) was developed to increase the amount of available address space. In August 2005, the Office of Management and Budget (OMB) issued a memorandum specifying activities and time frames for federal agencies to transition to IPv6. GAO was asked to determine (1) the status of federal agencies' efforts to transition to IPv6; (2) what emerging applications are being planned or implemented that take advantage of IPv6 features; and (3) key challenges industry and government agencies face as they transition to the new protocol.
THE NEED FOR SECURITY CONTROLS TO PROTECT INFORMATION SYSTEMS The selection and employment of appropriate security controls for an information system are important tasks that can have major implications on the operations and assets of an IT organization as well as the welfare of individuals. Security controls are the management, operational, and technical safeguards or countermeasures prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. There are several important questions that should be answered by organizational officials when addressing the security considerations for their information systems: - What security controls are needed to adequately protect the information systems that support the operations and assets of the organization in order for that organization to accomplish its assigned mission, protect its assets, fulfill its legal responsibilities, maintain its day-to-day functions, and protect individuals?
Why GAO Did This Study Hurricanes Katrina, Rita, and Wilma (the Gulf Coast hurricanes) caused more than $118 billion in estimated property damages across the Gulf Coast region in 2005. The Small Business Administration (SBA) helps individuals and businesses recover from disasters through its Disaster Loan Program. GAO initiated work to determine how well SBA provided victims of the Gulf Coast hurricanes with timely assistance. This report, the first of two, focuses primarily on the Disaster Credit Management System (DCMS) and disaster loan process. Here, GAO evaluates (1) what affected SBA's ability to provide timely disaster assistance and (2) actions SBA took after the disasters to improve its response to disaster victims. In conducting this study, GAO analyzed data on loan applications and assessed key aspects of SBA's acquisition and implementation of DCMS. What GAO Recommends GAO recommends four actions including reassessing DCMS's maximum user capacity based on such things as lessons learned from the Gulf Coast hurricanes, a review of information available from catastrophe risk modeling firms and disaster simulations, and related cost considerations. In comments on a draft of this report, SBA generally agreed with our recommendations but said more credit should have been given to its improvement efforts.
The Federal Financial Institutions Examination Council today issued revised guidance for examiners and financial institutions to use in identifying information security risks and evaluating the adequacy of controls and applicable risk management practices of financial institutions. The Information Security Booklet is one of twelve that, in total, comprise the FFIEC IT Examination Handbook. In addition to the revised Information Security Booklet, the agencies also released an Executive Summary that contains high level synopses of each of the twelve booklets and describes the handbook development and maintenance processes. The security of financial institutions' systems and information is essential to maintaining the privacy of customer information and safe and sound operations. The Information Security Booklet describes how an institution should protect and secure the systems and facilities that process and maintain information. The booklet calls for financial institutions and technology service providers (TSPs) to maintain effective security programs tailored to the complexity of their operations.
Why GAO Did This Study
GAO was asked to examine (1) financial institutions' use of resellers; (2) federal privacy and security laws applicable to resellers; (3) federal regulators' oversight of resellers; and (4) regulators' oversight of financial institution compliance with privacy and data security laws. To address these objectives, GAO analyzed documents and interviewed representatives from 10 information resellers, 14 financial institutions, 11 regulators, industry and consumer groups, and others.
Why GAO Did This Study Federal regulation is one of the basic tools of government used to implement public policy. In 1980, the Regulatory Flexibility Act (RFA) was enacted in response to concerns about the effect that regulations can have on small entities, including small businesses, small governmental jurisdictions, and certain small not-for-profit organizations. Congress amended RFA in 1996, and the President issued Executive Order 13272 in 2002, to strengthen requirements for agencies to consider the impact of their proposed rules on small entities. However, concerns about the regulatory burden on small entities persist, prompting legislative proposals such as H.R. 682, the Regulatory Flexibility Improvements Act, which would amend RFA. At the request of Congress, GAO has prepared many reports and testimonies reviewing the implementation of RFA and related policies. On the basis of that body of work, this testimony (1) provides an overview of the basic purpose and requirements of RFA, (2) highlights the main impediments to the Act’s implementation that GAO's reports identified, and (3) suggests elements of RFA that Congress might consider amending to improve the effectiveness of the Act. GAO's prior reports and testimonies contain recommendations to improve the implementation of RFA and related regulatory process requirements.
The federal financial institution regulatory agencies and the Federal Trade Commission are soliciting comments on a Notice of Proposed Rulemaking (NPRM) concerning identity theft "red flags" and address discrepancies. The NPRM, which has been reviewed and approved by each of the listed agencies, implements sections 114 and 315 of the Fair and Accurate Credit Transactions Act of 2003. The regulations that the agencies are jointly proposing would require each financial institution and creditor to develop and implement an identity theft prevention program that includes policies and procedures for detecting, preventing, and mitigating identity theft in connection with account openings and existing accounts. The proposed regulations include guidelines listing patterns, practices, and specific forms of activity that should raise a "red flag" signaling a possible risk of identity theft. Under the proposed regulations, an identity theft prevention program established by a financial institution or creditor would have to include policies and procedures for detecting any "red flag" relevant to its operations and implementing a mitigation strategy appropriate for the level of risk.
Highlights of GAO-06-954T, a testimony before the Subcommittee on Management, Integration, and Oversight, Committee on Homeland Security, U.S. House of Representatives Why GAO Did This Study
The Homeland Security Presidential Directive (HSPD) 12 mandated the creation of new standards for interoperable identity credentials for physical and logical access to Federal government locations and systems. Federal Information Processing Standard 201 (FIPS 201), Personal Identity Verification (PIV) of Federal Employees and Contractors, was developed to establish standards for identity credentials [FIPS201-1]. This document, Special Publication 800-78-1, specifies the cryptographic algorithms and key sizes for PIV systems and is a companion document to FIPS 201. 1.1 Authority This document has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347.
Inspectors General In our role as principal auditor of the consolidated financial statements of the U.S. government (CFS), we plan to use the work of the inspectors general and contracted independent public accountants who audit the agency-level financial statements. The development of the joint PCIE/GAO Financial Audit Manual (FAM) has provided a common framework and methodology for federal financial statement auditing. Adherence to the FAM will enable us to readily review the work of other auditors as a basis for using that work under auditing standards. We want to all be on the same page so that we are in the position to use your work. Certain CFS line items that will be subject to our concurrent review because of their significance, such as the federal employee and veteran benefits payable line item, involve federal agencies’ significant actuarial estimations. Statement on Auditing Standards (SAS) No. 57, Auditing Accounting Estimates applies to such estimations. In addition, Statement of Federal Financial Accounting Standard (SFFAS) No. 5 requires that federal agencies disclose specific information in their financial statements for pensions, other retirement benefits, and other postemployment benefits.
Before the U.S. House of Representatives Committee on Financial Services Subcommittee on Oversight and Investigations Thank you Chairwoman Kelly, Ranking Member Gutierrez, and Members of the Subcommittee. I appreciate the opportunity to speak to you about the Treasury Department's contribution to pandemic planning within the financial services sector. Though the Treasury's efforts are just a small part of the enormous Federal effort, we have been very active. President Bush stated, "Together we will confront this emerging threat and together, as Americans, we will be prepared to protect our families, our communities, this great Nation, and our world." I would like to begin my remarks by telling you about the sector's general state of preparedness and then tell you about the Treasury's leadership on pandemic planning within the financial services sector.
Please note that the following rule is the version that was approved by the NCUA Board. The official version is published in the Federal Register approximately one week after Board approval. There may be some minor numbering or format differences between the two versions. The proposed rule describes in greater detail the requirements for reporting and filing a Suspicious Activity Report (SAR) and addresses prompt notification of the board of directors of SAR filings, the confidentiality of reports, and liability protection. NCUA also proposes to change the heading for this part so it more accurately describes its scope. While retaining cross-references in the rule to the SAR form and instructions, these changes will enhance credit union compliance by providing greater detail in the rule on the thresholds and procedures for filing a SAR.
The Federal Reserve Board on Thursday requested comment on proposed revisions to Part I of its Policy on Payments System Risk (PSR policy), which addresses risk management in payments and settlement systems. The proposed revisions update and revise the policy in several ways. First, the Board is proposing to incorporate into its PSR policy the international risk management standards for central counterparties recently developed by the Committee on Payment and Settlement Systems (CPSS) of the central banks of the Group of Ten countries and the Technical Committee of the International Organization of Securities Commissions (IOSCO). These standards, published by the Bank for International Settlements in a report titled Recommendations for Central Counterparties (Recommendations for CCP), will serve as the Board's minimum standards for central counterparties identified as systemically important and subject to the Board's authority. This proposed change is consistent with past revisions that incorporated into the PSR policy the Core Principles for Systemically Important Payment Systems (Core Principles) and Recommendations for Securities Settlement Systems (Recommendations for SSS), developed by the CPSS and CPSS-IOSCO, respectively.
The Treasury Department in cooperation with the FloridaFIRST regional financial coalition will sponsor the first U.S. pandemic flu response exercise focused on the financial sector Thursday, June 22 in Miami, Fl. Treasury Deputy Assistant Secretary for Critical Infrastructure Protection and Compliance Policy Scott Parsons and will join 70 participants from Florida financial services firms and health, police and fire officials from local, state and federal agencies to test the local industry's preparedness for such a crisis.
Why GAO Did This Study
GAO was asked to testify on VA's information security program, ways that agencies can prevent improper disclosures of personal information, and issues concerning notifications of privacy breaches. In preparing this testimony, GAO drew on its previous reports and testimonies, as well as on expert opinion provided in congressional testimony and other sources.
This publication is not from one of the Federal or State Banking Agencies, but given our extremely diverse audience, this will be of interest to organizations and individuals responsible for developing and maintaining security plans and programs. This Recommendation specifies techniques for the generation of random bits that may then be used directly or converted to random numbers when random values are required by applications using cryptography.
There are two fundamentally different strategies for generating random bits. One strategy is to produce bits non-deterministically, where every bit of output is based on a physical process that is unpredictable; this class of random bit generators (RBGs) is commonly known as non-deterministic random bit generators (NRBGs). The other strategy is to compute bits deterministically using an algorithm; this class of RBGs is known as Deterministic Random Bit Generators (DRBGs).
NIST is pleased to announce the release of draft Special Publication (SP) 800-97, Guide to IEEE 802.11i: Robust Security Networks. SP 800-97 provides detailed information on the Institute of Electrical and Electronics Engineers (IEEE) 802.11i standard for wireless local area network (WLAN) security. IEEE 802.11i provides security enhancements over the previous 802.11 security method, Wired Equivalent Privacy (WEP), which has several well-documented security deficiencies. IEEE 802.11i introduces a range of new security features that are designed to overcome the shortcomings of WEP. This document explains these security features and provides specific recommendations to ensure the security of the WLAN operating environment. It gives extensive guidance on protecting the confidentiality and integrity of WLAN communications, authenticating users and devices using several methods, and incorporating WLAN security considerations into each phase of the WLAN life cycle. The document complements, and does not replace, NIST SP 800-48, Wireless Network Security: 802.11, Bluetooth and Handheld Devices.
This Information Security Handbook provides a broad overview of information security program elements to assist managers in understanding how to establish and implement an information security program. The purpose of this publication is to inform members of the information security management team [agency heads, chief information officers (CIO), senior agency information security officers (SAISO), and security managers] about various aspects of information security that they will be expected to implement and oversee in their respective organizations. In addition, the handbook provides guidance for facilitating a more consistent approach to information security programs across the federal government. Even though the terminology in this document is geared toward the federal sector, the handbook can also be used to provide guidance on a variety of other governmental, organizational, or institutional security requirements.
Treasury Secretary John W. Snow today designated George S. Hender as Sector Coordinator and Chairman of the Financial Services Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security (FSSCC). The FSSCC works closely with the Treasury and other federal financial
regulators to coordinate the private sector's preparation for events
including natural disasters and terrorist attacks, which could disrupt
the normal business of the financial services industry. Hender,
Management Vice Chairman of The Options Clearing Corporation, served
as FSSCC Vice Chairman since September 2004.
PREPARED REMARKS BY DEPUTY ASSISTANT SECRETARY DANIEL GLASER TERRORIST FINANCING AND FINANCIAL CRIMES -- BEFORE THE FINANCIAL CRIMES FORUM FOR ASIA/PACIFIC -- HONG KONG – I am pleased to be here speaking today at the Financial Crime Forum
on behalf of the Treasury Department of the United States. I want to
commend the organizers of this event for assembling professionals from
multiple sectors, as this parallels the strategy we take at Treasury
to engage all stakeholders: financial sector regulators, policy
makers, financial crimes investigators, financial sector specialists,
bankers, compliance officers, and others. It is only through our
collaborative efforts that we can create highly effective Anti-Money
Laundering/Counter-Financing of Terrorism (AML/CFT) regimes, and all
efforts that enhance our communication across these sectors help us
achieve our collective goals.
National Credit Union Administration (NCUA) Board Member Gigi Hyland represented the agency yesterday at the inaugural meeting of President Bush's Identity Theft Task Force. On May 10, 2006, the President signed an Executive Order for the purpose of strengthening federal efforts to protect against identity theft. The Order establishes the Task Force and provides that it will be co-chaired by the Attorney General and the Chairman of the Federal Trade Commission. Task Force membership includes representatives from the other executive branch departments as well as representatives from all of the federal financial regulatory agencies.
Why GAO Did This Study Since 1979, Egypt has received about $80 billion in military and economic assistance with about $34 billion in the form of foreign military financing (FMF) grants that enable Egypt to purchase U.S.-manufactured military goods and services. In this report, GAO (1) describes the types and amounts of FMF assistance provided to Egypt; (2) assesses the financing arrangements used to provide FMF assistance to Egypt; and (3) evaluates how the U.S. assesses the program's contribution to U.S. foreign policy and security goals. What GAO Recommends
We recommend that the Secretaries of State and Defence conduct: (1) an assessment of the impact of potential shifts in appropriations on the Egypt FMF program; and (2) periodic program-level evaluations of the program. Specifically, the agencies should define the current and desired levels of modernization and interoperability the U.S. would like to achieve.
The Internet is the world's largest computing network, with hundreds of millions of users. From the perspective of a user, each node or resource on this network is identified by a unique name - the domain name - such as www.nist.gov. However, from the perspective of network equipment that routes communications across the Internet, the unique identifier for a resource is an Internet Protocol (IP) address, such as 172.30.128.27. To access Internet resources by user-friendly domain names rather than IP addresses, users need a system that translates domain anme to IP addresses and back. This translation is the primary task of the Domain Name System (DNS).
The DNS infrastructure is made up of computing and communication entities that are geographically distributed throughout the world. There are more than 250 top-level domains, such as .gov and .com, and several million second-level domains, such as nist.gov and ietf.org. Accordinaly, there are many name servers in the DNS infrastructure, which each contain information about a small portion of the domain name space. The DNS infrastructure functions through collaboration among the various entities involved. The domain name data provded by DNS is intended to be available to any computer located anywhere in the Internet.
This publication focuses on developing and implementing information security metrics for an information security program. The processes and methodologies described in this guidance link information security performance to agency performance by leveraging agency-level strategic planning processes. The performance metrics developed according to this guide will enhance the ability of agencies to respond to a variety of federal government mandates and initiatives, including the Federal Information Security Management Act (FISMA) and the President's Management Agenda (PMA).
The goal of each agency information security program is to provide the appropriate level of protection to the agency's information resources. Information security has become an essential business function, critical to enabling agencies to conduct their operations and eliver services to the public. Each agency's information security pgrogram provides direct support to the agency mission. Information security performance metrics provide a means for the monitoring and reporting of agency implementation of security controls. They also help assess the effectiveness of these controls in appropriately protecting agency information resources in support of the agency's mission.
Interagency Advance Notice of Proposed Rulemaking: Procedures to Enhance the Accuracy and Integrity of Information Furnished to Consumer Reporting Agencies Under Section 312 of the Fair and Accurate Credit Transactions Act. Summary
The OCC, Board, FDIC, OTS, NCUA, and FTC (the Agencies) request comment to gather information useful for developing the guidelines and regulations required by section 312 of the Fair and Accurate Credit Transactions Act (FACT Act). Pursuant to section 312, the Agencies, acting in consultation and coordination, must: Establish guidelines for use by persons that furnish information to consumer reporting agencies (furnishers) regarding the accuracy and integrity of the consumer information that they furnish to those agencies; and prescribe regulations that require furnishers to establish resonable policies and procedures for implementing the guidelines. Section 312 also requires the Agencies jointly to prescribe regulations that identify the circumstances under which a furnisher shall be required to reinvestigate a dispute concerning the accuracy of information contained in a consumer report on a consumer based on a direct request of the consumer.
The Federal Reserve Board announced Wednesday the consolidation of two internal advisory committees on payments system matters. The duties of the Payments System Policy Advisory Committee will be expanded to encompass the responsibilities and activities of the Payments System Development Committee, including its public outreach efforts. The Payments System Development Committee will be discontinued. The Payments System Policy Advisory Committee was formed in July 1986 to advise the Board on a range of issues, including risk-management issues, primarily in wholesale payment and settlement systems, and the relationship between wholesale payment systems and financial markets. The Payments System Development Committee was formed in July 1999 to advise on medium- and long-term public policy issues surrounding innovation in the retail payments system. The expanded Payments System Policy Advisory Committee will provide the Board with a coordinated view of developments in both wholesale and retail payments at a time of significant overall change in the U.S. payments system and help coordinate Federal Reserve work involving domestic and international payments and settlement systems.
The purpose of this risk alert is to emphasize to all federally insured credit unions the necessity of taking steps to prepare for the next potential disaster. Recent events have highlighted the importance for credit unions to perform ongoing reviews of their plans for disaster preparedness and response. These plans should be commensurate with a credit union’s complexity of operations and focus on minimizing interruptions of service to members and maintaining member confidence in times of emergency. Over the past year, we have accumulated many "lessons learned" in working through a major disaster. It is our intention that we build on these lessons and make long-term improvements in the area of disaster preparedness and response.
National Credit Union Administration (NCUA) Vice Chairman Rodney E. Hood joined fifty credit union CEOs in Boston for a roundtable dialogue during which he outlined his regulatory focus for 2006. "Regulatory flexibility will be a top priority of mine in 2006," said Vice Chairman Hood. He discussed the recent final rule empowering an additional 413 federal credit unions with RegFlex eligibility by allowing well-managed, well-capitalized credit unions with a qualifying net worth requirement of 7% rather than 9% for earned regulatory flexibility. "This rule demonstrates the Board’s belief that the agency should not micro-manage, well-managed institutions," said Vice Chairman Hood. "This year, I will look for ways to reduce unnecessary regulatory burdens on credit unions."
The Homeland Security Presidential Directive HSPD-12 called for a common identification standard to be adopted governing the interoperable use of identity credentials to allow physical and logical access to Federal government locations and systems. The Personal Identity Verification (PIV) of Federal Employees and Contractors, Federal Information Processing Standard 201 (FIPS 201) [4] was developed to establish standards for identity credentials. This document, Special Publication 800-73 (SP 800-73), specifies interface requirements for retrieving and using the identity credentials from the PIV Card and is a companion document to FIPS 201. Authority
This document has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347.
The purpose of this letter is to provide NCUA’s IT Security Compliance Guide for Credit Unions. The guide offers information to assist credit unions in complying with the NCUA Rules and Regulations, Part 748, Appendix A; Guidelines for Safeguarding Member Information, and Appendix B; Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice. Each section of the guide relates to specific parts of Appendixes A and B of Part 748 of the NCUA Rules and Regulations. Section III provides additional guidance on the risk-assessment process necessary to identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of member information or member information systems.
Chairman Shelby, Ranking Member Sarbanes and other distinguished members of the Committee, thank you for the opportunity to speak to you today about our progress in combating terrorist financing and money laundering. In the last four months, we have seen assessments of our progress in both of these arenas - the 9/11 Commission Public Discourse Project's evaluation of our terrorist financing efforts and the U.S. Government's first-ever Money Laundering Threat Assessment. These assessments and this hearing provide an opportunity to take stock of how we are doing with respect to two of the leading concerns of my office. I welcome this committee's ongoing focus on these threats, and your continued support for our efforts to help stop illicit flows of money. Terrorist Financing The 9/11 Commission's Public Discourse Project awarded its highest grade, an A-, to the U.S. Government's efforts to combat terrorist financing. This praise truly belongs to the dozens of intelligence analysts, sanctions officers, regional specialists, and regulatory experts in the Treasury's Office of Terrorism and Financial Intelligence (TFI) who focus on terrorist financing, along with their talented colleagues in other agencies - law enforcement agents who investigate terrorism cases, Justice Department prosecutors who bring terrorist financiers to justice, foreign service officers in embassies around the world who seek cooperation from other governments and many others from the intelligence community. You will not find a more talented and dedicated group of people, with no trace of ego and a total focus on the mission.
National Credit Union Administration (NCUA) Chairman JoAnn Johnson announced the extension of the application deadline for the Community Development Revolving Loan Fund’s (CDRLF) disaster relief grants from March 31, 2006 to September 30, 2006. Qualifying credit unions in areas affected by the Gulf Coast hurricanes may apply for up to $2,500 for assistance in resuming operations.
The NCUA’s Community Development Revolving Loan Fund (CDRLF) was established by Congress to support credit unions that serve low-income communities by providing loans and technical assistance grants (TAGs) to qualifying institutions. The programs are designed to further the safety and soundness of low income credit unions while stimulating economic growth. Qualifying credit unions may also apply for CDRLF loans of up to $300,000. Loans have a maturity of 5 years and an interest rate of 1 percent.
Federal regulators today released Evolution of a Prototype Financial Privacy Notice, a report by Kleimann Communication Group summarizing consumer research commissioned by the regulators as part of their ongoing efforts to develop improved financial privacy notices.
The report's release concludes the first phase of an interagency project by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Federal Trade Commission, the National Credit Union Administration, the Office of the Comptroller of the Currency, and the Securities and Exchange Commission to explore alternatives for financial privacy notices that would be easier for consumers to read, understand, and use than many of the notices consumers currently receive from financial institutions. These six agencies were among those that jointly issued regulations in 2000 implementing the financial privacy provisions of the Gramm-Leach-Bliley Act, but survey data indicate that many consumers neither read nor understand the notices financial institutions provide under those regulations.
The purpose of this Letter to Credit Unions (LTCU) is intended to raise awareness regarding the threat of a pandemic influenza outbreak and its potential impact on the delivery of critical financial services. It further advises credit unions and their service providers to consider this and similar threats in their event response and contingency strategies (business continuity and disaster recovery plans). This LTCU discusses the National Strategy for Pandemic Influenza (National Strategy) and the roles and responsibilities it outlines for financial institutions.
On November 1, 2005, the White House issued the National Strategy, which discusses the threat and potential impact of a pandemic influenza event. It also identifies the roles and responsibilities for the federal government, the private sector, and others.
The Financial Crimes Enforcement Network (FinCEN) today issued an Advance Notice of Proposed Rulemaking seeking comments from both the money services business industry and the banking industry on the issue of money services businesses obtaining appropriate access to banking services. Today's action is part of FinCEN's ongoing efforts to address continued concerns about the ability of money services businesses to open and maintain accounts and obtain other services at banks and depository institutions as well as the caution of the banking industry in dealing with money services businesses. "Money services businesses play an important role in America's economy by providing valuable financial services to many Americans who do not, or cannot yet, take advantage of typical savings or checking accounts," said Robert W. Werner, FinCEN's Director. "It is critical for the health and safety of the U.S. financial system that MSBs obtain and maintain banking services and not be driven underground."
Rich Spillenkothen, the director of the Division of Banking Supervision and Regulation, will retire on June 30 after thirty years of service with the Federal Reserve Board, including nearly fifteen years as the director of the division. "Rich has led the Board’s supervision program during periods of unparalleled growth, innovation, deregulation, and consolidation in the American banking system, as well as through a number of financial system and banking shocks,” said Federal Reserve Board Chairman Ben S. Bernanke. “During Rich’s tenure, the Federal Reserve’s approach to banking supervision has evolved significantly. His leadership in the supervision of risk management and capital adequacy form a sound basis for the future work of financial supervisors everywhere."
For many years, GAO has reported that ineffective information security is a widespread problem that has potentially devastating consequences. in its reports to COngress since 1997, GAO has identified information security as a governmentwide high-risk issue - most recently in January 2005.
Concerned with accounts of attacks on commercial systems via the Internet and reports of significant weaknesses in federal computer systems that make them vulnerable to attack, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which permanently authorized and strengthened the federal information security program, evaluation, and reporting requirements established for federal agencies.
National Credit Union Administration (NCUA) Vice Chairman Rodney E. Hood joined Federal Deposit Insurance Corporation (FDIC) Acting Chairman Martin Gruenberg today for an update to consumer organizations and financial services associations regarding the impending changes to federal deposit insurance coverage. “I was pleased that the NCUA and FDIC joined together for such an important forum to discuss the implementation of deposit insurance changes recently signed into law by President Bush,” said Vice Chairman Hood. “It is vital that credit unions have accurate information available for members. We look forward to the assistance of those within the credit union system and consumer affairs in outreach efforts concerning enhancements to deposit insurance.”
The Treasury Department this week launched the first meeting of the newly created Consumer Financial Protection Forum which was established to focus exclusively on financial consumer concerns and to provide a permanent forum for communication between federal and state regulators on these issues. The Forum is chaired by the Treasury Department and participants include the federal banking and credit union regulators, the Federal Trade Commission, and representatives from state supervisory organizations. "The strength of our economy and financial services sector depends on confidence in the system on the part of consumers," said Assistant Secretary for Financial Institutions Emil Henry, Jr. "The goal of the Forum is straightforward - bring federal and state regulators together to share information and discuss ways to address evidence of consumer financial abuse by financial institutions."
As Director of the Financial Crimes Enforcement Network, this nation’s financial intelligence unit, I am proud that our skilled professionals are at the forefront of this country’s efforts to protect our financial system from abuse by criminals and terrorist financiers. Under authorities granted to us by the Bank Secrecy Act and the USA PATRIOT Act, our role is to prevent and detect terrorist financing, money laundering, and other financial crime. These are times of rapid change in the financial arena. Internet-based financial activity, changing methodologies for money laundering and terrorist financing, and the sheer number and variety of worldwide financial transactions make tracking illicit financial activity increasingly challenging. In the face of these developments, the Financial Crimes Enforcement Network needs to become more sophisticated, agile, and creative in assessing and responding to financial system risks. Approaches that addressed the needs of the past must give way to policies, processes, and analytical techniques that meet present and future realities.
In our Letter to Credit Unions #04-CU-12 Phishing Guidance for Credit Union Members, we highlighted the need to educate your membership about phishing activities. As the number and sophistication of phishing scams continues to increase, we would like to emphasize the importance of educating your employees and members on how to avoid phishing scams as well as action you and/or your members may take should they become a victim. Appendix A of this document contains information you may share with your members to help them from becoming a victim of phishing scams. Appendix B contains information you may share with your members who may have become a victim of phishing scams. Background Phishing is a form of social engineering, characterized by attempts to fraudulently acquire sensitive information, such as passwords, account, credit card details, etc. by masquerading as a trustworthy person or business in an apparently official electronic communication, such as an e-mail or an instant message. Often the message includes a warning regarding a problem related to the recipient’s account and requests the recipient to respond by following a link to a fraudulent website and providing specific confidential information. The format of the e-mail typically includes proprietary logos and branding, such as a “From” line disguised to appear as if the message came from a legitimate sender, and a link to a website or a link to an e-mail address. All of these features are designed to assure the recipient that the e-mail is from a legitimate business source when in fact, the information submitted will be sent to the perpetrator.
The Federal Reserve and the other financial institutions regulatory agencies published on February 9, 2006, the attached Advisory to address safety and soundness concerns that may arise when financial institutions enter into external audit contracts (typically referred to as "engagement letters") that limit the auditors' liability for audit services. The Advisory informs financial institutions that it is unsafe and unsound to enter into engagement letters for audits of financial statements, audits of internal control over financial reporting, or attestations on management's assessment of internal control over financial reporting which include provisions that (1) indemnify the external auditor against all claims made by third parties, (2) hold harmless or release the external auditor from liability for claims or potential claims that might be asserted by the client financial institution (other than claims for punitive damages), or (3) limit the remedies available to the client financial institution (other than punitive damages).
Over the past two decades, systematic misappropriation of intellectual property has become a major concern to American businesses, artists, and authors. As the modern economy grows increasingly reliant on intellectual property, the proliferation of computers and computer networks has made the illegal reproduction and distribution of protected material much easier to accomplish. Congress has enacted workable criminal laws prohibiting such misappropriation. This manual begins in Chapter I with an overview of the legal protection of intellectual property. It first provides general background on intellectual property and the legal regimes employed to encourage its creation. It then explains the criminal law's role in addressing intellectual property misappropriation with a special focus on the recent Intellectual Property Rights Initiative.
In the last decade, computers and the Internet have entered the mainstream of American life. Millions of Americans spend several hours every day in front of computers, where they send and receive e-mail, surf the Web, maintain databases, and participate in countless other activities. Unfortunately, those who commit crime have not missed the computer revolution. An increasing number of criminals use pagers, cellular phones, laptop computers and network servers in the course of committing their crimes. In some cases, computers provide the means of committing crime. For example, the Internet can be used to deliver a death threat via e-mail; to launch hacker attacks against a vulnerable computer network; to disseminate computer viruses; or to transmit images of child pornography. In other cases, computers merely serve as convenient storage devices for evidence of crime. For example, a drug kingpin might keep a list of who owes him money in a file stored in his desktop computer at home, or a money laundering operation might retain false financial records in a file on a network server.
The Federal Reserve Board on Monday announced the approval of a final rule that expands the definition of a small bank holding company (BHC) under the Board's Small Bank Holding Company Policy Statement and the Board's risk-based and leverage capital guidelines for bank holding companies. The policy statement facilitates the transfer of ownership of small community banks by permitting debt levels at small BHCs that are higher than what would typically be permitted for larger BHCs. Because small BHCs may, consistent with the policy statement, operate at a level of leverage that generally is inconsistent with the capital guidelines, the capital guidelines provide an exemption for small BHCs.
I meet and work with financial leaders every day, but I can easily say that Credit Unions have the most heart. Your motto rings true to your culture: "not for charity, not for profit, but for service." You do good work: loans to small business, home mortgages, financial education and working in partnership with the government to fight the financial war on terror. You were wonderful in your response to hurricane Katrina, in a time when American's helping each other meant so very much. Each one of these efforts is critical to our country's economic health and strength, and I applaud you for doing good while you do business.
The nation’s federally insured credit unions reported strong loan growth as delinquencies remained low according to fourth quarter 2005 Call Report data submitted by the nation’s 8,695 federally insured credit unions. During 2005, the loan to share ratio climbed to 79.4 percent as loans grew nearly $44 billion, delinquencies remained well below 1 percent. “The strong pace of loan growth is an excellent indication that credit unions are fulfilling their mission of being the source of affordable loans for their members,” said Chairman JoAnn Johnson. “What’s more, net worth continues to grow at a consistent, healthy level, which indicates credit unions are effectively managing their balance sheets.”
The National Credit Union Administration (NCUA) requests public comment on whether and how to modify its Supervisory Committee audit rules to require credit unions to obtain an “attestation on internal controls” in connection with their annual audits; to identify and impose assessment and attestation standards for such engagements; to impose minimum qualifications for Supervisory Committee members; and to identify and impose a standard for the independence required of State-licensed, compensated auditors. In 1998, the Credit Union Membership Access Act (“CUMMA”), Pub. L. No. 105¬219, 112 Stat. 913 (1998), amended the Federal Credit Union Act to require credit unions having assets of $10 million or more to follow generally accepted accounting principles (“GAAP”) in all reports and statements filed with the NCUA Board. 12 U.S.C. 1782(a)(6)(C). CUMMA further required credit unions having assets of $500 million or more to obtain an annual independent audit of its financial statements (“financial statement audit”) performed in accordance with generally accepted auditing standards (“GAAS”) by an independent certified public accountant or public accountant licensed by the appropriate State or jurisdiction. 12 U.S.C. 1782(a)(6)(D).
The federal financial regulatory agencies today announced the issuance of a final advisory that addresses safety and soundness concerns that may arise when financial institutions agree to limit their external auditors' liability. The agencies' primary concern is that limiting the liability of external auditors in engagement letters may reduce the reliability of audits. The Interagency Advisory on the Unsafe and Unsound Use of Limitation of Liability Provisions in External Audit Engagement Letters informs financial institutions that they should not enter into external audit engagement letters that incorporate unsafe and unsound limitation of liability provisions with respect to audits of financial statements and internal control over financial reporting.
The federal bank and thrift regulatory agencies today announced that they will be hosting a forum in New Orleans for banks and thrifts on March 2 and 3, 2006. The forum, titled “The Future of Banking on the Gulf Coast: Helping Banks and Thrifts Rebuild Communities,” will focus on the short-term and long-term challenges facing banks and thrifts operating in the areas affected by Hurricanes Katrina and Rita and on ways of helping meet the needs of the local communities. Principals from each of the four federal banking agencies will participate in the forum, which will convene at the New Orleans Marriott, 555 Canal Street, New Orleans, Louisiana, at 8:00 a.m. CST on Thursday, March 2, 2006, and close at noon on Friday, March 3, 2006. The FDIC and NeighborWorks of New Orleans will conduct optional bus tours of devastated areas nearby on the afternoons of Wednesday, March 1, and Friday, March 3.
For the security of any system to be strong, the system's owners must consider three fundamental security areas: management controls, operational controls, and technical controls. While technical controls, such as encryption, digital signatures, or firewalls, receive the most attention, inadequate operational controls and the day-to-day administration of technical controls often create the most vulnerabilities. Strong management controls are needed to tie all the aspects of security together into a sensible protection strategy. NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, helps organizations to improve their operational and management controls. This CSL Bulletin explains some of the needs which GSSPs can solve and presents a set of generally accepted system security principles developed by NIST.
Whatever direction the cyberthreat takes, the United States Government will be confronting an increasingly interconnected world in the years ahead. This is the core message of GT2015. We will have to develop, in response, greater communications and collaboration across the agencies of our own Government, with other governments, and with the corporate world. Interagency cooperation will be essential to understanding the cyberthreat, as well as other transnational threats that will crowd our agenda, and to responding effectively with interdisciplinary strategies. Consequence management of a major attack on a critical US infrastructure would involve virtually all agencies of the Federal Government, State, and local governments, foreign governments, law enforcement, the military, the medical community, and the media. NSTISSC and the Intelligence Community clearly have a lot of work to do if we are to understand this evolving threat and to be prepared to deal with it.
At the request of the Assistant to the President and Chief of Staff, we have prepared this memorandum to provide guidance for reviewing Government information regarding weapons of mass destruction, as well as other information that could be misused to harm the security of our nation or threaten public safety. It is appropriate that all federal departments and agencies consider the need to safeguard such information on an ongoing basis and also upon receipt of any request for records containing such information that is made under the Freedom of Information Act (FOIA), 5 U.S.C. § 552 (2000). Consistent with existing law and policy, the appropriate steps for safeguarding such information will vary according to the sensitivity of the information involved and whether the information currently is classified.
The Check Clearing for the 21st Century Act (Check 21) was signed into law on October 28, 2003, and became effective on October 28, 2004. Check 21 is designed to foster innovation in the payments system and to enhance its efficiency by reducing some of the legal impediments to check truncation. The law facilitates check truncation by creating a new negotiable instrument called a substitute check, which permits banks to truncate original checks, to process check information electronically, and to deliver substitute checks to banks that want to continue receiving paper checks. A substitute check is the legal equivalent of the original check and includes all the information contained on the original check. The law does not require banks to accept checks in electronic form nor does it require banks to use the new authority granted by the Act to create substitute checks.
The Office of Inspector General (OIG) for the National Credit Union Administration (NCUA) engaged Cotton & Company LLP to conduct an independent evaluation of NCUA’s information systems (IS) and security program and controls for compliance with the Federal Information Security Management Act (FISMA), Title III of the E-Government Act of 2002.
The Office of Management & Budget (OMB) issued 2004 Guidance on Annual Information Technology Security Reports on August 23, 2004. This guidance provides clarification to agencies for implementing, meeting, and reporting FISMA requirements to OMB and the Congress. This report contains a summary of our evaluation of the NCUA’s information security program and is presented in the OMB prescribed format.
NCUA Annual Performance Budget 2005 I am pleased to present the National Credit Union Administration’s Annual Performance Budget 2005. You will notice that it is called a performance budget and not a plan. It was developed to serve as an element of budget development and reflects a greater correlation between our strategic and annual performance goals and resource allocation. This enhanced correlation is in support of the President Management Agenda Initiative #5 – Budget and Performance Integration.
The year 2004 has been a very productive year. NCUA Annual Performance Plan 2004 served to guide the agency’s efforts to achieve its performance goals and objectives in its regulatory and supervisory roles during the past year. The credit union industry’s performance validated these efforts with assets increasing $30.6 billion or 5.02%, net worth increasing $4.3 billion or 6.52%, shares increasing $22.8 billion or 4.31%, loans increasing $30.2 billion or 8.02% and delinquent loans as a percentage of total loans decreasing from 0.76% to 0.71% for a very productive year. As a result, NCUA’s priorities continue to stress providing proper training and tools for examiners, an optimal regulatory environment that balances innovation with safety and soundness, enhanced organizational effectiveness and efficiency, promoting access of financial services to all eligible residents and maintaining a responsible budget process.
The National Credit Union Administration (NCUA) has developed this guide to assist credit unions engaging in, or considering, e-Commerce activities. For the purposes of this guide, e-Commerce is defined as the electronic delivery of financial services via the Internet. NCUA does not expect all credit unions to offer e-Commerce. However, NCUA expects credit unions offering e-Commerce to do so in a safe and sound manner. This guide focuses on processes to assist credit unions in managing the risks related to e-Commerce in an environment of rapidly changing technology. Credit union management should use the information in this guide to assist with technology planning, contracting, delivery, and support of e-Commerce activities. This should be done within a framework designed to identify, quantify and, to the extent possible, reduce related technology risks.
Much of the information in this guide is derived from NCUA issuances such as Rules & Regulations and Letters to Credit Unions. Although this information is provided in summary format in the guide, the related issuances typically contain more detail on a particular subject and may contain additional checklists that can assist in evaluating performance in a given area. Please refer to Appendix A for a listing of NCUA reference information. These issuances, as well as additional guidance, can be found via the Information Systems and Technology link under the reference section of the NCUA website (http://www.ncua.gov)*. This site is updated frequently and can serve as a valuable resource.
This statement alerts the Board of Directors and management to some of the risks and concernsof retail on-line, personal computer banking (PC banking). Recently, the staff of the FFIECagencies organized a symposium to hear industry experts offer their thoughts and observations onthe development of retail on-line PC banking. Through this statement, the FFIEC agencies wishto impart many of the ideas discussed during the symposium to bankers and examiners. II.EXECUTIVE SUMMARY Financial institutions are beginning to utilize new technologies to offer innovative products andservices to their customers. On-line PC banking exemplifies an emerging delivery channel forretail banking services made possible by technology. One of the reasons for the rapid evolution ofPC banking involves the increased use of the Internet1. Regulatory agencies recognize that PCbanking offers opportunities for financial institutions to enhance customer relationships andimprove competitive positions. Before implementing a PC banking program, management should exercise sufficient due diligenceand develop comprehensive plans. Such due diligence would ordinarily include the followingactivities.
• Review the implications of PC banking on the institution's strategic plan;
TO:All Federally-Insured Credit Unions The purpose of this letter is to inform you of revised technology-related guidance provided to examiners and the credit union industry. Earlier this year, the Federal Financial Institutions Examination Council (FFIEC1) released the Information Security Booklet – a first in a series of booklets to revise the existing 1996 FFIEC Information Systems Examination Handbook. The revised Information Technology (IT) Examination Handbook will be composed of several booklets to address significant changes in technology since 1996 and incorporates a risk-based examination approachto each booklet.
The FFIEC agencies plan to issue additional booklets covering such topics as business continuity planning, technology service providers, electronic banking, audit, payment systems, outsourcing, management, computer operations, and systems development and acquisition.
This policy issuance alerts all financial institutions to the importance of strategic information systems planning and its role in overall corporate management and planning. It identifies management's responsibilities in preparing strategic plans for their information systems requirements.
This interagency statement alerts financial institutions to potential risks in contracting for EDP services and/or failing to properly account for certain contract provisions.
POLICY STATEMENT FOR THE REVIEW OF INFORMATION SYSTEM VENDORS
Weblinking:
Identifying Risks & Risk Management Techniques ENCL:
Weblinking Guidance The purpose of this letter is to assist
credit unions in identifying risks posed by the use of weblinks on
their websites and suggest a variety of risk management techniques to
mitigate these risks. A large number of credit unions maintain
sites on the World Wide Web. Virtually every website contains weblinks.
A weblink is a word, phrase, or image that contains coding that will
transport the viewer to a different part of the website or a completely
different website by clicking on it. While weblinks are a convenient
and accepted tool in website design, their use can present certain risks.
The primary risk posed by weblinking is viewer confusion about whose
website they are viewing and who is responsible for information, products,
and services available through that website. Credit unions using weblinks are encouraged
to review the enclosed guidance that was developed jointly with other
federal regulatory agencies. This guidance applies to credit unions
that develop and maintain their own websites, as well as those using
service providers for these functions. This letter supercedes NCUA Letter 02-FCU-04.
If you have any questions, please contact your NCUA Regional Office
or State Supervisory Authority.
Chairman Bachus, and Members of the Subcommittee, I appreciate your invitation to present this testimony reviewing the National Credit Union Administration’s (NCUA’s) experiences with information systems and technology (IS&T) incidents and other security events resulting in the potential compromise of personal financial data. We also identify actions by NCUA to ensure credit unions safeguard member information and to mitigate potential losses to credit unions and members when breaches occur. We recommend that NCUA be granted examination authority over third party vendors, which would enable us to better monitor risk and protect credit union members’ personal financial data. Examples of Data Security Breaches Involving Credit Union Members
Information is provided here on types of security breaches NCUA and credit unions have experienced. These security breaches include: fraudulent email or telephone scams, known as phishing; the unauthorized storing of customer information and the ensuing theft of this information; the theft of a credit union’s hard drive; and the theft of a vendor’s computer. We also provide information on how NCUA and credit unions have responded to these data security incidents.
The purpose of this letter is to provide important considerations for credit unions that are currently engaged in or may be considering the use of wireless technology. Wireless technology can potentially provide important benefits for credit unions and their members. For some, this may be a cost-effective alternative for a credit union seeking to expand its existing hard-wired computer network. Additionally, it may enable a credit union to provide members with increased accessibility to its Internet-based financial service offerings.
However, those credit unions that have made a decision to implement wireless technology should also be aware of the potential increase in the amount of risk exposure for the credit union. Credit unions may be able to mitigate the following risk areas with proper planning and controls.
GUIDELINES FOR ENSURING THE QUALITY OF DISSEMINATED INFORMATION Policy NCUA will undertake to ensure that the information it disseminates to the public is objective (accurate, clear, complete, and unbiased), useful and has integrity. Most information disseminated by NCUA is subject to the basic standard described in these guidelines. Additional levels of quality standards are adopted as appropriate for specific categories of disseminated information. The OMB guidelines require “influential scientific, financial or statistical information” to meet a higher standard of quality. OMB defines “influential” to mean, “the agency can reasonably determine that dissemination of the information will have or does have a clear and substantial impact on important public policies or important private sector decisions.” Id. at 8455. Influential information disseminated byNCUA is subject to a level higher than the basic standard. The NCUA’s Chief Information Officer (CIO) serves as the agency official charged with overseeing the agency’s compliance with OMB guidelines for the quality of information disseminated by NCUA.
The National Credit Union Administration (NCUA) Office of Inspector General (OIG) Annual Performance Plan for 2004 delineates those audits and investigations that would most benefit the NCUA. In formulating this Plan, we considered: • The agency’s strategic and annual performance plans; • Pertinent legislation, including the Inspector General Act, the Federal Credit Union Act, the Government Performance Results Act (GPRA), the Credit Union Membership Act, the Federal Information Security Management Act (FISMA), and the Sarbanes-OxleyAct of 2002; • Congressional activity and testimony by NCUA officials as well as significant areas of interest to NCUA Board members and the Congress; • Audits and reviews of NCUA and the credit union industry planned and performed by the General Accounting Office (GAO); • Input obtained from the NCUA Board and Executive staff; and • NCUA and the credit union industry’s operating environment.
The National Credit Union Administration (NCUA) Office of Inspector General (OIG) Annual Performance Plan for 2005 delineates those audits that would most benefit the NCUA. In formulating this Plan, we considered: • The agency’s strategic and annual performance plans; • Pertinent legislation, including the Federal Credit Union Act, the Government Performance Results Act (GPRA), the Credit Union Membership Act, Federal Information Security Management Act (FISMA), the Sarbanes-Oxley Act, and the Inspector General Act; • Congressional activity and testimony by NCUA officials as well as significant areas of interest to NCUA Board members and the Congress; • Audits planned and performed by the General Accounting Office (GAO); • Input obtained from the NCUA Board and Executive staff; and • NCUA and the credit union industry’s operating environment.
The National Credit Union Administration (NCUA) Office of Inspector General (OIG) Annual Performance Plan for 2003 delineates those audits and investigations that would most benefit the NCUA. In formulating this Plan, we considered: • The agency’s strategic and annual performance plans; • Pertinent legislation, including the Federal Credit Union Act, the Government Performance Results Act (GPRA), the Credit Union Membership Act, the Government Information Security Act (GISRA), and the Inspector General Act; • Congressional activity and testimony by NCUA officials as well as significant areas of interest to NCUA Board members and the Congress; • Input obtained from the NCUA Board and Executive staff; and • NCUA and the credit union industry’s operating environment. How the Annual Plan was formulatedThe NCUA OIG plans its work to identify and respond to issues that are of greatest importance to NCUA. For purposes of the Annual Plan, we have identified prospective audit and investigative work that is responsive to the agency’s strategic goals. The agency’s strategic goals are: • Promote a system of financially healthy, well-managed federally insured credit unions able to withstand economic volatility. • Facilitate credit unions’ ability to safely integrate financial services and emerging technology in order to meet the changing expectations of their members. • Create a regulatory environment that will facilitate credit union innovation to meet member financial service expectations. • Enable credit unions to leverage their unique place in the American financial system to extend availability of service to all who seek such service, while encouraging and recognizing their historical emphasis on servicing those of modest means.
• Enhance NCUA’s organization to continue to work with the credit union community in creating an environment that enables credit unions to continue to flourish while addressing the challenges of the 21stcentury.
Rapidly evolving technologies continue to provide efficient, cost effective methods for providing fast delivery of a wide range of member services. Accompanying the opportunities to deliver cost effective services is growing exposure of technology resources to misuse and theft, which can result in loss of member confidence. Intrusion and abuse of technology is growing at an escalating rate. Intrusions, as noted in the chart below, reflect an increasing average rate of approximately 300 percent annually. The data was provided by Computer Emergency Response Team/Coordinating Committee (CERT/CC). The CERT/CC1is a government sponsored organization operated by the Carnegie Mellon Software Engineering Institute. Part of its mission is to track vulnerabilities in computer systems and recommend methods to improve computer security. Incidents are voluntarily reported and include:
1. Attempts to gain unauthorized access to a system or its data;
The purpose of this Letter is to provide additional guidance for combating the email schemes discussed in the recently released Letter to Credit Unions #04-CU-05 Fraudulent E-Mail Schemes. In addition, this Letter is intended to raise awareness of the increasingly common Internet fraud called “phishing.” NCUA encourages credit unions to educate their members, strengthen monitoring systems, and enhance response programs to reduce the potential risk of Internet-related fraud schemes to their organization and members. Such schemes may negatively impact your credit union’s reputation, transaction, liquidity, and strategic risks.
This alert is intended to raise awareness of an Internet worm, BugBear.B, that recently surfaced as a potential threat specifically targeted to financial institutions and to prompt credit unions and credit union technology service providers to take immediate steps to mitigate the threat to their organizations and customers.
The purpose of this Letter is to provide additional guidance for combating the email schemes discussed in the recently released Letter to Credit Unions #04-CU-05 Fraudulent E-Mail Schemes. In addition, this Letter is intended to raise awareness of the increasingly common Internet fraud called "phishing." NCUA encourages credit unions to educate their members, strengthen monitoring systems, and enhance response programs to reduce the potential risk of Internet-related fraud schemes to their organization and members. Such schemes may negatively impact your credit union's reputation, transaction, liquidity, and strategic risks.
Information technology (IT) and security continue to evolve at a rapid pace. New risks and threats arise quickly to challenge emerging and established technologies. Yet the essential elements of strong controls and sound IT practices remain the same despite the environmental changes. As part of our review of IT in corporate credit unions, the Office of Corporate Credit Unions (OCCU) IT examiners have focused on ensuring the adequacy of basic control elements such as firewalls, intrusion detection, penetration tests, and sound network architectures. I am pleased to note that corporates have been diligent in this regard and that many sound control practices have been implemented. OCCU IT staff will continue to verify that basic IT security control elements remain strong. However, the ever changing dynamics of the corporate credit union IT risk profile require that we also focus attention on the following critical information security areas: Information Security Risk Assessment; 2. Security Application Code Reviews; 3. Service Provider Oversight & Contracts; 4. Security Awareness of Employees; 5. Change Management for Applications & Infrastructure; and 6. Security for Remote Locations. Each area is briefly discussed below.
European Union Data Directive The 1995 European Union Directive on the Protection of Individuals With Regard to the Processing of Personal Data and on the Free Movement of Such Data became effective on October 25, 1998, and covers the processing of data within the EU and its transfer outside of the EU. The Directive requires EU member states to pass national privacy laws implementing the principles established in the Directive. While laws implementing the Directive vary somewhat from one member state to another, the general framework remains the same throughout the EU. Since the EU imposes sanctions on its members for not passing laws according to its Directive, 15 EU member states (except Ireland, Luxembourg and France) have implemented the Directive to date. Even the three exceptions have privacy legislation that requires compliance from companies doing business in these nations. The EU Directive applies to all processing of personal information by any person or organization within the EU, both private and public. The Directive applies to all citizens and resident employees. It also covers data processing and/or transfer by entities owned or affiliated with United States companies that process data within the EU. Data can only be processed if certain processing principles are utilized.
The banking agencies will implement the Central Data Repository (CDR) to process the Reports of Condition and Income (Call Reports) beginning with the third quarter 2005. This filing period begins September 30, 2005. Except for certain banks with foreign offices, data must be received by October 30, 2005. **The agencies recognize that institutions whose operations have been significantly affected by Hurricane Katrina may experience difficulty or delay in filing their third quarter Call Report. Those institutions should contact their primary regulator or the CDR help desk at 1-888-CDR-3111 for special assistance in filing third quarter Call Report data. The CDR will require banks to validate their Call Report data before it will be accepted. To allow sufficient time to complete the new prevalidation process prior to the submission deadline, banks should start their Call Report preparation process earlier than in the past. The new prevalidation process will require banks to correct errors identified by the CDR and, where necessary, to prepare explanatory comments for data that fall outside specific parameters. These explanatory comments, which will be filed along with a bank's data, will be considered confidential.
Welcome to the fourth issue of The SAR Activity Review – By the Numbers, a compilation of statistical data gathered from Suspicious Activity Report forms submitted by depository institutions since April 1996,casinos and card clubs since August 1996,certain money services businesses since January 2002, and certain segments of the securities and futures industries since January 2003. By the Numbers serves as a companion piece to the publication of the Trends, Tips &Issues, which provides information about the preparation, use, and utility of Suspicious Activity Reports. By the Numbers is produced twice a year to cover two periods:January 1 A review of the statistical data generated for Issue 4 of By the Numbers reveals some interesting facts. As of December 31,2004,over 2.1 million Suspicious Activity Report forms 1 had been ith FinCEN. Although the remainder of this publication provides detailed statistical data on those , some general observations are provided below for each type of form.
The SAR Activity Review - Trends,Tips &Issues
Today;s announcement that 207,000 jobs were created in July is another significant indicator that Americas economy is expanding. Now, nearly 4 million new jobs have been created since May 2003 and the unemployment rate remains at 5 percent. Combined with several recent reports indicating steady non-inflationary increases in economic activity, this shows that the fundamentals of our economy are strong and that we are continuing on a positive path of growth and prosperity.
This alert is intended to raise awareness of an Internet virus, Bugbear.B, that recently surfaced as a potentially serious threat to financial institutions and to prompt banks and bank technology service providers to take immediate steps to mitigate the threat to their organizations and customers. BACKGROUND Viruses are an increasing threat to Internet-connected systems. The Bugbear.B virus is the latest and most capable variant that threatens financial institutions. Institutions with the capability to access the Internet, including dial-up connections, may be vulnerable to the Bugbear.B virus and other viruses, and should institute appropriate measures to mitigate the risks posed to their servers, desktops, laptops, and other computing devices.
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
RSS SyndicationCopyright © 2007 CUInfoSecurity.com