Computer Security Guidelines
- Use a current Internet browser with 128-bit encryption that supports secure and private transactions.
- Consider using the built-in security features that are provided with your Internet browser instead of disabling them.
- Use a software or hardware firewall to protect your computer from network intrusion.
- Maintain and run anti-spyware, anti-malware, and anti-virus software to detect new threats.
- If your computer is on a wireless network (home or public), ensure that the router settings are secure, (encrypted). Using scanning devices, individuals can intercept unencrypted signals and view or obtain your information.
- Use caution when downloading files, installing software, or opening email attachments from unverified or unknown sources. Many of these files contain spyware or key-logging programs that can send information back to a malicious site.
- Be suspicious of emails purporting to be from a Financial Institution, government department or other agency requesting account information, account verification or banking access credentials such as User ID’s, PIN’s, Codes and similar information. Opening file attachments or clicking on web links in suspicious emails could expose the system to malicious code that could hijack your computer.
- We recommend clearing the browser cache before starting an Online Banking session in order to eliminate copies of web pages that have been stored on the hard drive.
- Always lock your computer when you leave it unattended. Set the computer to automatically lock after a set period of inactivity, e.g. 5 minutes.
- When you are finished with your computer turn it off or disconnect it from the Internet by unplugging the modem or Ethernet/DSL cable.
- Properly dispose of old computers and ensure all sensitive information is removed from the hard drive. Reformatting the hard drive may not be sufficient – use specialized software to erase information
Additional Computer Security Guidelines for Business
As a business you have additional concerns, such as multiple users and cash management (ACH & Wires) functionality to contend with regarding the safety and security of your Online Banking accounts. There is the growing threat of fraudulent ACH transactions and Wire transfers from online banking accounts which primarily target small to medium sized businesses and government entities and can involve amounts as small as $10,000 US dollars to as much as several million dollars. The majority of these attacks require the attacker to compromise the target computer by installing malware (viruses, spyware, adware, Trojan horse, keyloggers, worms, rootkits), in addition to phishing and pharming techniques, to obtain users login credentials allowing access into the client’s Online Banking session via hijacked credentials.
The following recommendations are cyber security best practices that help reduce the risks associated with online banking. Nothing can eliminate all of the risks, however, an informed and vigilant user is a key defense. In conjunction with our Online Banking Security Information document the following is a list of additional online banking security measures for our Commercial Clients:
- Install a dedicated, actively managed firewall. A firewall limits the potential for unauthorized access to a network and computers.
- Install well known and supported anti-virus and desktop firewall software on all computer systems. Look for names you know and read independent reviews of all products you use.
- Ensure computers are patched regularly, particularly operating systems and key applications with security patches. It is highly recommended to sign up for automatic operating system updates for the operating system and many non-operating system applications.
- Change the default login names and PINs on routers, firewalls, and other network equipment and software.
- Monitor log files, especially proxy server logs, for unauthorized/suspicious Internet connections coming to and leaving the network.
- Carry out all online banking activities from a hardened and completely locked down computer system.
- Use a single computer with a static IP Address for all online banking transactions. If possible, register this IP Address with the Financial Institution. Actively monitor the computer for viruses and other malware and limit this computer from conducting any other Internet activity, including email.
- Use a dedicated computer for all online transactions and implement white listing methods to prevent the system from going to any site/address that does not have a documented business need.
- Whenever possible do not use a wireless network for financial transactions. If a wireless network must be used, enforce security measures such as enabling encryption and MAC address filtering, changing the service set identifier (SSID) and turning off SSID broadcasting.
- Turn off and remove services that are not needed on computers. Allow the use of CDs, DVDs, USB devices for legitimate business needs only.
- Consider blocking Internet plug-ins on the computers that access online banking accounts. Disabling Flash, scripts, pop-up windows, etc., can be frustrating for general users but will prevent multiple exploits.
- Educate users on good cyber security practices to include how to avoid having malware installed on a computer and new malware trends.
- Make sure employee computer profiles have the least privilege possible to do their job.
- Ensure employees cannot override or circumvent security software.
- Only approved company applications should be deployed on your computers, and should be patched regularly.
- Use a mail service that blocks or removes email file attachments such as files that end in .vbs, .bat, .pif, or .scr. These are file extensions for executables, and are commonly dangerous files.
- Prohibit the use of shared User IDs and PINs for Online Banking.
- Develop and implement employee rules and policies concerning appropriate and allowed use of the Internet.
- Instill good security habits with your employees. Develop a security awareness program that addresses the risks specific to your business and/or to the specific functions within your company. Review with employees on a regular basis.
- If you have employees that use laptops, consider implementing software that will determine if mobile devices have been infected before allowing them back into your network.
- Employ advanced authentication techniques for user logins such as two-factor authentication (User ID and PIN - something the user knows, and Token codes - something the user has.)
- Develop a working relationship with a member of law enforcement so that there is an established venue for reporting incidents.
Email Security Guidelines
- Question suspicious emails. We will never send you an email asking for confidential information or your Online Banking ID or PIN.
- If you receive an email that appears to be suspicious, do not reply to it or click on the link that it provides. Simply delete it.
- If you think you may have provided personal or account information in response to a fraudulent email or website, report the fraud immediately, change your PINs, and monitor your account activity frequently.
- Avoid clicking on links provided in emails. It is always better to type the address into your browser.
- Open email attachments only if you know the sender. It is best to scan attachments with your anti-virus software prior to opening.
- Most computer files have filename extensions such as “.doc” for documents or “.jpg” for images. Any file that appears to have a double extension, like “heythere.doc.pif” is extremely likely to be a dangerous file and should never be opened.
- Never open email attachments that have file endings of “.exe”, “.pif”, or “.vbs”. These are file extensions for executables, and are commonly dangerous files.
- Be careful and selective before providing your email address to a questionable website. Sharing your email address makes you more likely to receive fraudulent emails.
- Confirm the validity of all requests for sensitive personal, financial, or account information, particularly if they are made with an urgent or threatening tone.
- Confirm requests for personal or account information by going to the company’s website directly. Open a new browser window, type the Web address, and check to see if you must actually perform any activity that an email may be asking you to do, such as change a PIN.