Solutions for E-Banking Security Holes:

Digital Security of software systems in Banks is very important to protect sensitive bank information, employeeâs identity and customerâs privacy, also to avoid many legal problems. Strong security solutions are very important especially with the presence of online banking, banking software and workflow systems. The extensive usage of software systems in banks without strong security could lead to many legal problems. Normal security systems and policies do not stop internal or external hacking, and do not provide a legal way to proof any made transaction.

Online banking accounts are frequently targeted by cybercriminals. Security issues remain a major concern for customers and corporations alike. As a result, banks need to implement adequate security measures to protect themselves and their customer base.

Saudi Arabian Monetary Agency (SAMA) suggested the following solutions that aim to increase the level of security for online banking:

1- Identity Authentication

Banks should use appropriate measures in order to authenticate the identity of customers. It is important for any bank to check that each online transaction or access request is legitimate to ensure the safety of online banking. Banks therefore have to use reliable methods for verifying the identity and authorisation of new and existing customers. Showing the customers what has been done to secure them, makes them feel the system is secure and that there money are protected.

2- Segregation of Duties

Banks should promote adequate segregation of duties within e-banking systems, databases and application, which is critical for their security and soundness. Therefore, Banks are required to set up sophisticated internal control designed specially to reduce fraud risk in operational processes and systems and to ensure that transactions and equipment are properly authorised, recorded and safeguarded.

The classification of duties should cover authorization, custody, record keeping and reconciliation.

3- Protect Data Integrity

Data integrity of transactions, records and information are essential for any bank to be protected. If the bank did not give special attention to that, it may face financial losses as well as legal and reputational risk. In addition, banks should arrange and represent proper organisational, procedural and technical methods, which ensure that the integrity of financial and transactional data is maintained. Financial data recording should be stored securely, retrievable for inquiry or reporting, safeguarded against improper alteration, and mostly reflect the actual values involved.

4- Regular Update and Audit

Feasible updates of the online banking system would reassurance that the authentication platform is stay one step ahead of hackers and decrease there chances to stole the data and also minimize the security holes. Banks should ensure that the internal control system is adapted to e-banking services and that clear audit trails are maintained. Added to that, internal controls should be independently auditable by external agencies. Audit trail should:

Give adequate proof to show the transaction stream, from start to finish, and any accompanying control/procedural execution.

Be sufficient to fulfill the rules of the courts under which they could be used.

5- Preserve the Confidentiality

The advent of online banking introduces extra security challenges for banks since it increases the exposure that information transmitted over the public network or stored in databases may be accessible by unauthorised or inappropriate parties. Also, expand the use of service providers may uncover essential data of banks to other parties. So, the key data of the banks must remain private. Any abuse could result in exposing the bank to high impact reputation and legal risk. The protection of confidentiality should be commensurate with the impact of the risk of unauthorised exposure:

Confidentiality should be maintained by use of access controls and encryption.

Cryptographic techniques should be based on recognized algorithms that have not been disputed in their strength or use.

Access should only be permitted based on the âneed to knowâ principle.

_______________________________________________________________

I think the best solution is number 5 but i need more information about :

Given what you learned about E-Banking Security Holes ?

what do you think would be the best solution to the problem?

Why you selecation this ?

What are the possible impacts?

periwinklemink259

You are doing a walk-through of the credit and collections function to get an idea of what internal controls exist and where there might be weaknesses. Then, after you finish, you or another member of the audit team will be testing the system to determine whether the internal controls actually exist and actually work as you have been told. In the meantime, keep your eyes, ears, and mind open for any weaknesses in internal control.

The department head of the credit and collections department is telling you how things work in the department. "Jenny, here, receives the mail and distributes it to the various collectors. They each open their own mail. There is a lot of correspondence going back and forth to and from customers, so it is easier if each collector just handles her own mail." It is easy for Jenny to distribute the mail because most of the letters are addressed to a specific individual.

You watch as one of the individuals opens the mail and handles the items inside. Many of the items are disputes-the customer says the items billed were not ordered, or, if ordered, were not received. Every such letter results in the disputed bill being written off. As the department head explains, the vice president of sales told him, a few years ago, that too many customers were complaining that the credit department was too tough on them, so he had decided that rather than have any more complaints, every such bill would be written off. The procedure is that the collector initiates a form, called a write-off form, to write off a particular amount from a customer's balance. In the explanation block, the collector simply writes "customer dispute." This form is signed by the collector, sent to accounting, and accounting processes the forms each Wednesday. There are so many letters with so many disputes that the department has a monthly competition for the most unusual letters, which are tacked up on a bulletin board. All the rest of the dispute letters are thrown away as soon as the collector has filled out the write-off form.

Collectors also receive checks in the mail. These are payments from customers whose accounts are wholly or partly overdue. As one of the collectors explains, they each receive a print-out once a month, so if the customer sends in a payment, there is no way for the collector to find out about it before the next month's print-out arrives unless the collector receives the payment. Most of the collectors process dozens of payments each month. They make whatever notations they need on the monthly print-out, prepare a deposit ticket, send the department's runner to the bank each Friday (collections are accumulated until Friday, with the customers' payments being held in an otherwise empty desk drawer until then), and send the receipted deposit ticket on to the department which records collections of cash. The credit and collections department also sends a listing of which customers to credit for having paid all or part of their balances.

Near the end of each fiscal quarter, the corporate controller gets a preliminary set of financial statements, and then he tells the department head by telephone how much the department is allowed to write off in bad debts. Thus, the company writes off bad debts only in the third month of each fiscal quarter. "Why does he tell you by telephone?" you ask of the credit and collections manager. "He doesn't want any written record of it," is the reply.

You are interested in how the department decides which customer balances to write off as uncollectible and which to leave on the books. "We write off the oldest ones, up to the amount of what we have been told we can write off," says the credit and collections manager. "That way, our percentage of bad debts always comes out pretty much in line with what we have done before, and the auditors have always been satisfied with it. They had read some academic articles from some people who recommended using time-series analysis to see if the numbers were correct, so they test the accounts receivable account and satisfy themselves that the sales and receivables are real, but they always test the write-offs and bad debts expense simply by using the time-series analysis recommended by the accountants with those fancy doctorates. Go ask the guy who ran the audit last year."

You inspect the process by which customer payments are received the regular way, which is done in a different department. The company has a special Post Office box set up. Twice a day, some one person from maintenance goes to the Post Office to pick up the mail, including the customer payments received at this special Post Office box. It is not always the same person from maintenance who goes to the Post Office; whoever is available when the department head looks around is typically the one who is sent.

When the person returns from the Post Office, he brings a bunch of mail to the cash receipts department, where the mail is opened and customers' checks are paperclipped to the envelopes they came in. One of the goals of the cash receipts department is to get the customer payments deposited promptly, so after all the checks are paper-clipped, someone from the department goes to the bank, fills out a whole bunch of deposit slips, deposits those checks, and comes back to the department with those receipted deposit slips. Then the department members try to figure out which customer paid which amounts. They are helped by the routing number on the checks, but those routing numbers represent banks, not customers, and multiple customers use the same banks. Consequently, they refer to a listing of routing numbers to identify the banks, then to a listing of banks to see which customers use those banks, and then to another copy of the same monthly print-out used in credit and collections to figure out which of the customers who use that bank must have paid that particular amount. If they cannot make a good guess, they call some of the customers to ask if they are the ones who paid the amount. Once they think they know who paid the amount, they generate a journal entry to debit cash and credit the customer's account; the credit to the customer's account is automatically also a credit to accounts receivable. Since they have a copy of the monthly printout of accounts receivable, when a customer's payment is not for the full amount of an invoice, they just go ahead and adjust that customer's account so the full amount of the invoice is taken off the customer's account. They say they are creating a lot of goodwill with customers that way.

a. What internal control weaknesses do you see in this system?

b. What are the potential effects of these weaknesses?

c. What do you recommend instead (that is, if you have such a recommendation)?

skycricket458

Assignment Please read the instructions carefully. You need to write 6 sentences for each article which includes what i have given in instructions.

Instructions

For the two articles below:

Write a few sentences explaining how the article is relevant to Verizon or Sprint Mobile. How and why would you expect it to affect stock prices, and whether they were affected in the way you expected (do this in terms of expected future earnings). Because traders buy or sell stocks immediately as new information becomes available, stock prices respond rapidly. Be sure to include the date of the article. You should be able to distinguish whether the news was relevant to only one of your stocks, your industry, or the whole market by noting the relative price changes - if only one of your stocks went up while the market was down, the news affected only your stock; if both your stocks moved differently from the market, the news probably affected your industry as a whole; if your stocks moved in tandem with the market, the news probably broadly affected the whole economy. You should also be able to explain why the news affected just one company, the industry, or the whole market. The articles selected should be balanced chronologically and topically.

article:1 China Aims to Build Its Own Secure Smartphones

State-owned and private tech firms team up to cut cord to U.S. suppliers

An employee inspects a circuit board in a manufacturing facility at ZTE's headquarters in the Nanshan district of Shenzhen, China. Photo: Brent Lewin/Bloomberg News

By

Eva Dou in Beijing and

Juro Osawa in Hong Kong

Updated Nov. 20, 2015 6:02 p.m. ET

China is seeking to make its own secure smartphones, in an attempt to insulate its handsets from U.S. surveillance.

The effort involves both state-owned companies and some of the countryâs savvier technology firms and marks the latest step in Beijingâs quest to build a homegrown tech industry that cuts out U.S. suppliers.

Chinese officials have long chafed at U.S. companiesâ dominance in smartphone operating systems and processorsâthe parts of a handset most vulnerable to hacking. In China, the worldâs largest smartphone market, almost all handsets are either Apple Inc. iPhones or are powered by Googleâs Android operating system.

For years, Chinaâs lagging technology meant there was little it could do. The countryâs first lady, Peng Liyuan, last year switched publicly to a Chinese-made smartphone, the ZTE Nubia Z5, after being criticized for using an iPhone, yet the Chinese device ran on Android and included a Qualcomm Inc. processor, according to its specifications list.

Now, a number of Chinese technology companies are making progress toward cutting the cords to Western technology. China is encouraging that effort, spurred by revelations in 2013 from former U.S. National Security Agency contractor Edward Snowden that the NSA had placed surveillance âback doorsâ in some American gear sold overseas.

Chinese smartphone maker ZTE Corp. is working on a secure smartphone for government agencies using an operating system developed in-house, and a processor chip from a Chinese supplier, a spokesman said. The countryâs largest chip-design company, Spreadtrum Communications Inc., separately said it would begin mass producing a set of chips that run a Chinese operating system by year-end.

Chinese e-commerce company Alibaba Group Holding Ltd. has joined with Chinaâs Ministry of Public Security to develop a mobile operating system for police officers that it bills as more secure.

ENLARGE

A worker examines machinery used to adhere components to smartphone circuit boards at ZTEâs headquarters in Shenzhen, China. Photo: Brent Lewin/Bloomberg News

All of the efforts target a niche group of government agencies and state-owned enterprises and are unlikely to appeal to the average consumer. ZTEâs secure phone, for example, will come without camera, GPS, Wi-Fi and Bluetooth wireless connections to minimize security risks.

The trend is unlikely to have much impact on the market share in China of U.S. mobile components and software. Analyst James Yan of market-research firm IDC estimates secure phones might make up 3% of Chinaâs smartphone sales next year, or about two million units. But if more made-in-China operating systems and processors make their way into consumer handsets, that could potentially pose a challenge for Googleâs Android and for Qualcomm.

Qualcomm, whose processors accounted for 52% of the smartphone market last year, according to Strategy Analytics, declined to comment.

Alphabet Inc. âs Google, whose Android system ran 82.8% of the worldâs smartphones in the second quarter of this year, according to IDC, didnât immediately have a comment.

Other U.S. tech companies already are feeling a chill in China. U.S. networking- and computing-gear makers such as International Business Machines Corp. and Cisco Systems Inc. have recorded sales declines, as government agencies and state-owned enterprises buy more from domestic counterparts such as Chinese server maker Inspur Group Co. and telecommunications-gear supplier Huawei Technologies Co.

Cisco doesnât provide sales figures for specific countries, but has said the Snowden disclosures affected its China sales. IBM has attributed sales setbacks to Chinaâs economic slowdown. Both companies say they donât build âback doorsâ into their technology.

In smartphones, Chinese banks have begun to buy more domestic brands, though formal quotas were suspended earlier this year because of U.S. pressure. China had wanted to require that 50% of new smartphone purchases at financial institutions meet âsecure and controllableâ standards, according to a copy of the suspended rules reviewed by The Wall Street Journal.

Chinaâs push to build homegrown secure handsets also has economic benefits: The components that are crucial to security are also some of the most profitable.

But even with made-in-China processors, modems and operating systems, Chinese secure phones will likely include plenty of foreign components, albeit less-sensitive ones.

A spokesman for ZTE said it isnât possible to use exclusively Chinese-made hardware and software in a smartphone, but to meet the needs of government agencies it is trying to use domestic suppliers as much as possible.

Other Chinese phone makers, including Coolpad Group Ltd. and Qihoo 360 Technology Co. , are scrambling for a piece of the market too, touting security features such as data encryption in their new handsets this year.

âRight now the security sector is very hot,â said Chris DeAngelis, Beijing-based general manager at consultancy Alliance Development Group. âThe government is looking for nonforeign technologies as much as possible to prevent various back doors.â

Leo Li, chief executive of Spreadtrum, said his company will begin sales this year of special chipsets that will let phone users switch between Android and an encrypted operating system made by Chinese company Yuanxin Technology Co.

âYour voice is encrypted. Your data is encrypted. It is very secure,â he said.

But just because a phone has domestically made guts doesnât mean it is secure, said Bryce Boland, Asia chief technology officer for network-security company FireEye Inc. A hacker could still siphon data directly from a telecom operator, he said. New operating systems are also likely to have more vulnerabilities.

China isnât alone in seeking a high-security smartphone for government work. The U.S. NSA developed its own domestic version in 2009, although it this year switched to a new system based on Samsung Electronics Co. smartphones with customized secure software. The NSA-developed phone was âovertaken by technology by the time it was actually delivered,â Debora Plunkett, the NSAâs information assurance director, told National Defense Magazine in 2012.

Lao Yao, secretary-general of the China Smartphone Alliance, said some Western governments work with BlackBerry Ltd. of Canada to custom make high-security phones for their officials, but that China and Western companies donât trust each other enough for this to be an option. âChina has no choice but to develop its own operating system to maintain security,â he said.

âGillian Wong in Beijing contributed to this article.

Write to Eva Dou at [email protected] and Juro Osawa at [email protected]

article 2: Sprint to Get Cash Infusion With Deal to Sell and Lease Back Devices

Transaction, for $1.1 billion, would essentially act as a loan

ENLARGE

Sprint, the No. 4 wireless carrier in the U.S. by subscribers, has been working to improve its network. Photo: mike blake/Reuters

By

Ezequiel Minaya and

Ryan Knutson

Updated Nov. 20, 2015 1:54 p.m. ET

Sprint Corp. took a big, if unusual, step on Friday to address its cash woes and take some risk off its books.

The carrier, which has been losing customers and money for years, said it would get a $1.1 billion cash infusion through a deal to sell certain handsets and other devices it has leased to its customers. The purchaser is a newly formed entityâbacked by Sprint parent SoftBank Group Corp.âthat will rent the devices back to the carrier.

Sprint said the transaction essentially serves as a loan that will cost it less than tapping debt markets, freeing up much-needed resources for network investment and operations.

Sprint, the No. 4 wireless carrier in the U.S. by subscribers, has struggled with competition and a difficult network overhaul. Its network has improved recently, and in the most recent quarter, Sprint added 237,000 of the more desirable postpaid phone subscribers, although 199,000 of those came from converting its own customers from prepaid arrangements. In an effort to boost subscriber gains, Sprint also launched a promotion this week to sell wireless service for half the price charged by rivals.

The carrier, which is based in Overland Park, Kan., has more than $30 billion in total debt, and hasnât posted an annual profit since 2006. It reported a loss of $585 million for its latest quarter. In September, Moodyâs downgraded Sprintâs bonds to B3, citing concerns about the companyâs turnaround plan. The carrier has said it has no plans to tap debt or equity markets in the foreseeable future.

The deal to sell 2.5 million device leases to the new entity, called Mobile Leasing Solutions LLC, will help reduce one of Sprintâs biggest expenses: the cost of purchasing millions of new iPhones and other devices. The carrier in turn leases them to individual subscribers, who must either return the phone at the end of the lease or pay extra to buy it outright.

Sprintâs relationship with SoftBank, which owns more than 80% of Sprint, as well as with phone-distribution firm Brightstar Corp., which was founded by Sprintâs CEO, helps give the carrier access to favorable terms on the deal with Mobile Leasing Solutions. The latter was formed by a group of equity investors including SoftBank, and has secured debt financing from several lenders, including international banks and leasing companies.

Sprint Chief Financial Officer Tarek Robbiati said Sprint expects to execute additional deals roughly every quarter, and is also working on a similar structure to finance network construction. Mr. Robbiati said the implied cost of funds was in the âmid-single digits,â which is well below the carrierâs high-yield alternatives, although he wouldnât provide a specific number.

Reaction to the deal was mixed. Analysts at Evercore said they were âcautious of whether the deal improves [Sprintâs] actual business model or instead just moves some of the risk off balance sheet.â Analysts at Macquarie Securities said the deal was âa major positive for Sprint sharesâ and would dramatically improve the companyâs cash-burn rate, helping it focus on new growth.

Sprint shares fell more than 5% on Friday.

The newly formed entity will rely on Brightstar to resell the used devices at the end of each lease. Sprint said it envisions the deal including only high-end devices, which have the highest resale value. Used phones are easily sold in developing markets overseas; they are also useful for insurance programs that replace broken phones.

In the wake of the deal, Sprint revised its annual outlook for adjusted earnings before interest, depreciation, taxes and amortization to a range between $6.8 billion and $7.1 billion, down from a previous forecast of $7.2 billion to $7.6 billion. The transaction is expected to close in early December.

Write to Ezequiel Minaya at [email protected] and Ryan Knutson at [email protected]