RECOMMENDATIONS SECURITY ONLINE BANK TRANSACTIONS. interests in the use of IT services, such as online bank services of Société Générale de Banques au

Transcription

1 RECOMMENDATIONS SECURITY ONLINE BANK TRANSACTIONS Best practices IT security refers t the bdy f techniques and best practices t prtect yur cmputers and yur interests in the use f IT services, such as nline bank services f Sciété Générale de Banques au Sénégal. If the techniques and gd practices have been develped by It security experts, yu must knw abut and implement the easiest nes. Detectin f a malicius act: cntact ur security services D yu think yu are a cybercrime victim? D yu have any dubt f the nature f a received message? Cntact ur security teams as sn as pssible: Sgbs.sgebase@scgen.cm Prtect wn passwrd A passwrd is an imprtant prtectin t carry ut nline transactins safely. Nevertheless, t ensure full prtectin, a passwrd must cmply with gd practices listed belw. Chice f a passwrd: a 6 digit passwrd is intended t be entered n the virtual keybard. Chsing a «strng» passwrd shall prtect frm fraud attempts, passwrds must nt be trivial (repetitin f digits r sequences f digits) and must nt be easily identifiable by a third persn (anniversary date). Use f a passwrd: nly enter yur cde n the virtual keybard f the secured access space f yur nline bank at the fllwing address 1

2 Never cmmunicate yur passwrd t anybdy. We remind yu that Sciété Générale de Banques au Sénégal shall never ask fr yur passwrd. Lg ut after cnsultatin : Authenticatin n nline bank services shall initiate a cnsultatin sessin f yur custmer space. The sessin enables yu t brwse pages and carry ut sme peratins withut having t authenticate yurself again. Thugh practical, such functinality may enable a user f yur cmputer t brwse and make sme peratins n yur custmer space withut yur knwledge. Yu must lg ut after cnsultatin via «lg ut» buttn, clsing the page r the brwser shall nt be enugh. We remind yu that any peratin made in yur name via yur sessin cannt be denied Disable the aut-cmplete feature f the brwser : Mst internet brwsers suggest that yu save usernames and passwrds used in the authenticatin frms, including yur lgin username fr nline bank services. The aut cmplete feature f the username shall enable t access in the future yur custmer space withut having t enter yur username again. Thugh practical, the aut-cmplete feature f yur username may allw a user t lg in t yur custmer space withut yur knwledge Yu must disable the aut-cmplete feature f the brwser. We remind yu that any peratin made in yur name via yur sessin cannt be denied Secure ne s cmputer : Befre yu brwse n Internet, yu must prtect yur cmputer frm pssible malicius attacks. Yu shud therefre fllw the fllwing instructins : 2

3 Update ne s perating system and ne s sftware: update ne s perating system and sftware * is paramunt in rder t prtect neself frm malicius attacks. In fact, making up knwn security faults wuld make inefficient the mst cmmn attack techniques. Install an antivirus : an antivirus sftware, even a free ne, must be installed in yur cmputer. Such sftware shall prtect yu by identifying and blcking malicius applicatins installed in yur cmputer. In additin, an antivirus sftware shall check the reliability f the files yu dwnlad n Internet r yu receive by . See als t update yur antivirus slutin. * In pririty shuld be updated access-internet sftwares (brwser, mail bx ) and widely knwn sftware (pack Office, suite Adbe, Java ) Check the reliability f the visited site Whether yu cnsult a bank site r an e-cmmercial site, it is imprtant t ensure that yu are n an fficial and secured site befre making any authenticatin peratin r bank peratin. Please fllw these instructins s as t make sure f the reliability f the site yu are visiting: Check the URL site n the address bar: an URL is the sle username f the web page yu are cnsulting and which is visible n the address bar f yur brwser. Checking carefully yur address shall enable yu t identify any malicius site as its address shall inevitably display sme differences frm ne fficial site (ex. instead f Check the address prefix : an fficial internet site f bank r cmmercial services, shall use sme secured cmmunicatin prtcls with its custmers. Make sure yu brwse n a site securing yur cmmunicatins; the prefix «https» must precede the site URL (instead f «http»). The full address f SGBS secured space is as fllws: Check the security certificate: The certificate is used t ascertain that the site belngs t the Sciété Générale grup. Yur Internet brwser shall enable t display the security 3

4 certificate used n the page yu are visiting. The certificate must have the fllwing frm : Specific Prtectins t Smartphnes : The grwing use f Smartphnes and the increasing develpment f bank services n such platfrm intrduce new risks fr yur security. The cnfusin between prtable telephnes and Smartphnes is frequent; hwever Smartphnes are nt mre r less cmputers yu can call with. Security measures valid fr cmputers (as mentined previusly) are therefre fr Smartphnes. Hwever, specific prtectins must be applied t smartphnes: Prtect yur telephne with a passwrd (nt trivial) and autmate the screen lck in case f inactivity See t apply all updates prpsed by yur system manager Only dwnlad applicatins frm fficial applicatin site stres (ex. Apple Stre, Ggle Play Stre), at the risk f intrducing malicius applicatins n yur Smartphne D nt unlck under any pretext the perating system f the Smartphne (ex. jailbreak, rting), such practice shall increase yur expsure t risks D nt stre any cnfidential data if they are nt encrypted 4

5 Install an applicatin antivirus sftware yu will keep update We remind that it is essential t use the same precautins n a Smartphne as n a cmputer when yu brwse n Internet Security Measures Aware f security risks due t the sensitiveness f nline bank services, Sciété Générale shall implement all security measures in the state f art in rder t ensure an ptimal security level. Mechanisms and authenticatin prcedures Authenticatin is a key element f nline bank service security. Such prcedure, which gives yu access t cnsultatin and management f yur accunts, shall enable the cmputer systems f Sciété Générale t frmally identify yu. Elements enabling t authenticate yu are yur username and passwrd. The username is unique and is prvided t yu at subscriptin t nline services. A passwrd by default is allcated t yu at subscriptin t nline services and a passwrd change frm shall be submitted t yu upn at first subscriptin. Authenticatin case by passwrd A new passwrd that yu will chse shall be mdifiable any time at the fllwing address: The cuple username, passwrd shall enable yu t access cnsultatin and management f yur accunts thanks t innvating system implemented by Sciété Générale. Never cmmunicate yur passwrd t anybdy. We remind yu that Sciété Générale de Banques au Sénégal shall never ask fr yur passwrd. Authenticatin case by virtual keybard 5

6 A new passwrd that yu will chse shall be mdifiable any time at the fllwing address: The cuple username, passwrd shall enable yu t access cnsultatin and management f yur accunts thanks t innvating system implemented by Sciété Générale. The Virtual keybard shall reinfrce the passwrd security by its recuperatin by a malicius individual mre cmplicated. Never cmmunicate yur passwrd t anybdy. We remind yu that Sciété Générale de Banques au Sénégal shall never ask fr yur passwrd. Cmmunicatin encryptin : Online bank services f Sciété Générale de Banques au Sénégal are based n the prtcl f encryptin cmmunicatin SSLv3/TLS (Secure Scket Layer versin 3 / Transprt Layer Security). The encryptin activatin shall enable t strengthen HTTP cmmunicatin which is nw referred t as HTTPS (S: Secure/Sécurisé). The HTTPS prtcl shall ensure that all the infrmatin exchanged n the site are cnfidential and accurate. D nt hesitate t check that yu are visiting a secured site The prefix «https» precedes the address f the site yu are visiting Accrding t the brwser yu use, a lck lg displays n the status bar Case f «Extended Validatin Certificate» (EV) 6

7 Accrding t the brwser yu use, the address bar becmes green and displays a certificatin lg The full address f SGBS secured space is as fllws: Autmatic lg ut prcedure : Fr yur security, after ten minutes f inactivity n the service, yu will autmatically lg ut. Thus, nbdy can use the site in yur place when yu are missing withut being first lgged ut. In rder t lg in again, yu must enter again the username and passwrd. Yu must lg ut at the end f yur cnsultatin via «lg ut» buttn We remind yu that any peratin made in yur name via yur sessin cannt be denied Traceability and archiving: Fr security purpses, the activity f yur bank site is traced and filed 24/24 and 7/7, and this, with respect t banking regulatin in frce and in accrdance with the laws n IT and individual liberty. Any default shall be subjected t in-depth analysis as well ad hc prcedures t ensure reliability and cntinuity f the service at any time. 7