Network Security Vulnerabilities: Network Security Vulnerabilities

Purpose

This alert is intended to raise awareness regarding potential threats in electronic banking systems and to remind banks and service providers to identify and correct network security vulnerabilities.

Background

In recent weeks, hackers have exploited a number of significant vulnerabilities in e-commerce systems. Recent National Infrastructure Protection Center (NIPC) advisories report an increase in unauthorized activities targeting e-commerce Websites and identify some common and frequently utilized vulnerabilities in commercially available hardware and software.¹ These vulnerabilities may allow unauthorized access to bank and service provider systems. Unauthorized intrusions threaten the confidentiality, integrity, and availability of bank information systems and customer information. If successful in breaching a system and gaining access to customer records, unauthorized parties may fraudulently withdraw funds from bank accounts, obtain funds through identity theft, or extort funds by threatening public disclosure.

Response to Network Security Vulnerabilities

In response to the increased risks, the Office of the Comptroller of the Currency (OCC) advises banks and service providers to review the NIPC advisories. In addition, banks should review their controls to safeguard customer information and bank information systems. As part of this effort, banks and service providers should take the following steps to respond to network vulnerabilities:

• Identify systems vulnerabilities in a timely manner and evaluate the inherent risks, taking into account the network system configuration and system architecture.
• Eliminate unwarranted risks by applying vendor-provided software fixes, commonly called “patches.”
• Ensure that exploitable files and services are assessed and removed or disabled, based upon known vulnerabilities and business needs.
• Ensure that changes to security configurations are documented, approved, and tested.
• Update vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities.
• Conduct subsequent penetration testing and vulnerability assessments, as warranted.
• Review contracts with service providers to ensure that security maintenance and reporting responsibilities are clearly described. As part of this review, banks should ensure that service providers notify them of systems security breaches that may affect their bank.
• Establish monitoring, reporting, and investigation controls that identify unusual funds transfer activities as a potential indicator of system security breaches.

Additional Information

A bank's board of directors is responsible for ensuring that an effective information security program is in place and operating properly. In the event that bank information systems are subject to unlawful activities, including suspected intrusions, the events should be reported in Suspicious Activity Reports, consistent with 12 CFR 21.11. Additional information on OCC and FFIEC information security guidance can be obtained on the OCC's website at www.occ.gov and includes:

• OCC Bulletin 2001–8: Guidelines Establishing Standards for Safeguarding Customer Information - February 15, 2001
• OCC Advisory Letter 2000–12: FFIEC Guidance on Risk Management of Outsourced Technology Services - November 28, 2000
• OCC Bulletin 2000–19: Suspicious Activity Report: New SAR Form - June 19, 2000
• OCC Bulletin 2000–14: Infrastructure Threats - Intrusion Risks - May 15, 2000
• OCC Bulletin 98–38: Technology Risk Management: PC Banking - August 24, 1998

Questions regarding this alert should be directed to Clifford A. Wilke, Director, Bank Technology Division, at (202) 874–5920 or by email: clifford.wilke@occ.treas.gov.

Clifford A. Wilke
Director, Bank Technology Division