Purpose

The following e-banking risk assessment and controls evaluation is provided to assist commercial Internet banking users in identifying threats and measure the strength of their controls.

Risk Assessment Questions

For each question, select the answer that best represents your environment. Following the assessment, use the "Control Evaluation - Tips" to evaluate your environment.

Personnel Security:

  1. Are employees required to sign an Acceptable Use Policy (AUP)?
  2. Does each employee using Internet banking go through security awareness training?
  3. Do you complete background checks on employees prior to hire?

Computer System Security:

  1. Is a dedicated computer system used for e-Banking activities?
  2. Do computer systems have up-to-date antivirus software?
  3. Is there a process in place to ensure software updates and patches are applied (e.g. Microsoft, web browser, Adobe products, etc.)?
  4. Do users run as local Administrators on their computer systems?
  5. Does a firewall protect the network?
  6. Do you have an Intrusion Detection/Prevention System (IDS/IPS) in place to monitor and protect the network?
  7. Is Internet content filtering being used?
  8. Is email SPAM filtering being used?
  9. Are users of the Internet banking system trained to manually lock their workstations when they leave them?
  10. Is wireless technology used on the network with the Internet banking system?

Physical Security:

  1. Are critical systems (including systems used to access Internet banking) located in a secure area?
  2. How are passwords protected?

Previous Experience:

  1. Have you experienced fraud through e-Banking in the past?
  2. Has malware been discovered on systems used for e-Banking activities in the past?

©CoNetrix