Security measures when working with the RB system

[Агентство. PrivacyGuard.]

Good afternoon, colleagues.

In the course of work to prevent and investigate frauds in the banking system, a set of recommendations was developed to ensure safety when working with banking systems. I bring to your attention. If anyone has comments, suggestions - I will listen with pleasure.

When working with remote banking, follow the recommendations for increased safety:
• If possible, use a USB token to store the digital signature private key. Using a USB token significantly increases the security of the certificate.
• Under no circumstances should you disclose information about your password to the certificate to anyone, including Bank employees, relatives and other third parties.
• In no case do not save information about your password from the certificate on any media, including a computer. If you suspect that someone has information about your password, you need to change the password yourself or by temporarily blocking access to the Bank.
• Periodic replacement of passwords for access to private keys. Especially in the case of the dismissal of a responsible employee or an employee who had access to the RBS system, it is necessary to immediately replace the passwords. The password must have at least 8 characters, we recommend using a combination of letters, numbers and special characters.
• Do not store the EDS certificate on the computer hard drive. Keep certificates only on a USB token, flash media or on CD-ROMs in a place inaccessible to outsiders (safes, lockable boxes).
• Limit access for employees and unauthorized persons to certificates and computers with installed RB systems.
• Monitor the payment documents sent when working with the RB system.
• Try not to work with untrusted computers (Internet cafes, kiosks, etc.). Since in this case the risk of theft of your credentials (login / password, certificate) increases.
• Verify that the connection does indeed take place in SSL protected mode, the web browser should display a lock icon;
• Check that the connection is established specifically with the server of the RBS system. Verify that the site certificate information matches the site URL.
• Check the information about the IP address from which the previous login was carried out) if this possibility exists).
• After finishing work in the RBS system, be sure to close the system window using the “EXIT” button. After exiting, you must remove the USB token or other storage medium from which the certificate is stored from the computer.
• Make sure your computer is not infected with viruses. Install and activate antivirus software. Regularly update anti-virus databases. Please note that the action of viruses can be aimed at remembering and transmitting to third parties information about your password and certificate.
• Install and configure a personal firewall (firewall) on your computer, this will prevent unauthorized access to information on your computer. Additionally, you can configure the firewall to access only the addresses of the servers of the RBS system. Server addresses can be specified in the Bank’s technical support service.
• Use licensed software from trusted and reliable sources. Perform regular updates to the operating system and application software (browser, document programs, etc.).
• Pay attention to changes in your usual login processes or system functioning. Any changes, especially concerning safety, are surely announced in advance in the system news. If you doubt that the RBS system is functioning correctly, be sure to call the Bank.
• If you detect attempts of unauthorized access or in the case of motivated fears that such attempts may be made, it is necessary:
- immediately inform the Bank of this;
- block the technical means used to work in remote banking systems. Disconnect them from the local area network and power supply network;
- to save the state of the system, remove the bitwise image of the compromised computer.
If you do not know how to do this, you can contact us message@privacyguard.ru . We will help you.

 

[Матушкин Андрей Николаевич]

Thank!