Internet caveats.

Most banks use the Internet to provide access to resources and to deliver information, products and services; however, they may be unaware of the Internet's inherent security risks. The FDIC has issued a paper to help identify many of those risks, as well as several systems controls that financial institutions can use to manage them.

The paper, Security Risks Associated With the Internet, identifies the FDICs areas of concern relating to transactional and systems security issues, such as data privacy and confidentiality, data integrity and authentication. For example, the paper explains that "sniffer" programs can be set up to look for and collect data, such as account numbers or passwords, and "IP spoofing" programs can be used to make one computer actually claim to be another by mimicking its Internet protocol address.

The paper also discusses the primary technologies, standards and controls that manage Internet risks, such as encryption, digital signatures and certificate authorities--trusted third-parties that verify the identity of a party to a transaction. It also examines other methods of systems security, including the use of firewalls, "smart cards" and blometric technologies, such as retina scanning.

A copy of the paper (FIL-131-97) is available online at www.fdlc.gov (click on banking news) or by calling the FDIC public information center at 800-276-6003.