Home > About Us > Security >

In 2005, the Federal Financial Institutions Examination Council (FFIEC) issued guidance related to e-banking, �Authentication in an Internet Banking Environment.� This updated interagency guidance, which replaced the FFIEC's Authentication in an Electronic Banking Environment, issued in 2001, specifically addressed the need for risk-based assessment, customer awareness, and security measures to authenticate customers using a financial institution�s Internet-based services.

Although this guidance is focused on the risks and risk management techniques associated with the Internet delivery channel, the principles are applicable to all forms of electronic banking activities.

The guidance, which banks are expected to have achieved conformance with by year-end 2006, states that financial institutions should periodically:

• Ensure that their information security program:
• Identifies and assesses the risks associated with Internet-based products and services;
• Identifies risk mitigation actions, including appropriate authentication strength; and
• Measures and evaluates customer awareness efforts;
• Adjust, as appropriate, their information security program in light of any relevant changes in technology, the sensitivity of their customer information, and internal or external threats to information; and
• Implement appropriate risk mitigation strategies.

Town North Bank has undertaken a risk-based assessment of all electronic banking systems. During this assessment, we reviewed the threats to those systems and the existing controls. We found that most systems have adequate controls and therefore have little to no residual risk.

Here are the key findings of our risk assessment:

• www.tnbonline.com is a low-risk system therefore current controls are adequate.
• TNB has evaluated our customer awareness program. The following types of customer communication are provided:
• Customers are provided with information related to e-banking authentication on www.tnbonline.com. A �security section� has been established to house relevant information.
• Appropriate communication is provided, as needed, to customers through the normal communication channels related to e-banking authentication requirements or guidelines.
• Statement messages related to keeping information secure are scheduled to be inserted on an annual basis.
• PASSPORT Online Banking with Bill Payment and Cash Manager products will use a TriCipher solution to be implemented by the end of 2006.
• A committee has been chartered to continue the process of evaluating our customer awareness program and to ensure that we take a risk-based assessment of our systems on an annual basis.