Language Selection

English French German Italian Portuguese Spanish

FDIC advises banks on how to protect against spyware

Filed under
Security

The Federal Deposit Insurance Corp. (FDIC) today issued a list of best practices for financial services firms that details how to protect against spyware, which the agency said can be used by criminals to collect customer data or hack into banking systems.

"It is critical that banks stay vigilant about the risks involved with this malicious software and take appropriate action so that they and their customers do not fall victim to it," said Michael Zamorski, director of the FDIC's Division of Supervision and Consumer Protection.

The guidance spells out the risks associated with spyware and recommends actions that financial institutions can take to mitigate those risks on internal computers as well as on those used by customers to connect to transactional banking Web sites.

The FDIC recommends rolling out multifactor authentication to limit the ability of identity thieves to access customer accounts. Firms should also consider spyware as part of their risk-assessment analysis and bolster security against it by setting Internet-use policies for employees. The FDIC also recommends that banks advise customers on the risks of using public computers such as those in hotels, libraries or Internet cafes to connect to online banking Web sites because of the uncertainty of what spyware may have been installed on the public equipment.

According to the FDIC, the risks associated with spyware include allowing attackers to eavesdrop and intercept sensitive communications, such as customer IDs and passwords; allowing unauthorized access to user accounts; permitting unauthorized access to bank systems; and increasing vulnerability to other Internet-based attacks, such as phishing.

By Lucas Mearian
ComputerWorld.

More in Tux Machines

Linux/FOSS Events

  • The Linux Foundation Announces Session Lineup for ApacheCon(TM) Europe
  • OpenShift Commons Gathering event preview
    We're just two months out from the OpenShift Commons Gathering coming up on November 7, 2016 in Seattle, Washington, co-located with KubeCon and CloudNativeCon. OpenShift Origin is a distribution of Kubernetes optimized for continuous application development and multi-tenant deployment. Origin adds developer and operations-centric tools on top of Kubernetes to enable rapid application development, easy deployment and scaling, and long-term lifecycle maintenance for small and large teams. And we're excited to say, the 1.3 GA release of OpenShift Origin, which includes Kubernetes 1.3, is out the door! Hear more about the release from Lead Architect for OpenShift Origin, Clayton Coleman.

Security News

  • Report: Linux security must be upgraded to protect future tech
    The summit was used to expose a number of flaws in Linux's design that make it increasingly unsuitable to power modern devices. Linux is the operating system that runs most of the modern world. It is behind everything from web servers and supercomputers to mobile phones. Increasingly, it's also being used to run connected Internet of Things (IoT) devices, including products like cars and intelligent robots.
  • security things in Linux v4.6
    Hector Marco-Gisbert removed a long-standing limitation to mmap ASLR on 32-bit x86, where setting an unlimited stack (e.g. “ulimit -s unlimited“) would turn off mmap ASLR (which provided a way to bypass ASLR when executing setuid processes). Given that ASLR entropy can now be controlled directly (see the v4.5 post), and that the cases where this created an actual problem are very rare, means that if a system sees collisions between unlimited stack and mmap ASLR, they can just adjust the 32-bit ASLR entropy instead.

Raspberry Pi PIXEL and More Improvements

Trainline creates open source platform to help developers deploy apps and environments in AWS