Banking regulator warns of spyware on public computers

The guidance from the Federal Deposit Insurance Corporation (FDIC) is a reaction to the growth of spyware, the term for software that is deposited on a computer without the user's knowledge and can then send information in secret from that computer to others.

"The information collected through spyware can be used to compromise a bank's systems or conduct identity theft," said Michael Zamorski, Director of the FDIC's Division of Supervision and Consumer Protection. "So it is critical that banks stay vigilant about the risks involved with this malicious software, and take appropriate action so that they and their customers do not fall victim to it."

In particular, banks should consider spyware threats as part of their general risk assessment process, according to the guidance.

They should enhance security and internet use policies and enforce them properly, so that user behaviour and spyware risks are better constrained. Employee training and customer education are also priorities.

The FDIC also says that customers should be advised of the risks in using public computers – such as those in hotels, libraries or internet cafés – to connect to online banking websites because of the uncertainty of what spyware may have been installed on the public equipment.

Finally, banks should look at implementing multi-factor authentication methods, which should make it more difficult for identity thieves to access accounts.

The growth of spyware was highlighted on Monday by the publication of research by security firm ScanSafe.

This found that outbound spyware transmissions on infected machines now account for up to 8% of total outbound web traffic, on some of the networks tested.

ScanSafe says this statistic is most startling when it is considered that spyware is at its most damaging when capturing confidential information and transmitting it outside of the local area network or performing a so called “calling home” action.

“It’s clear that traditional methods of preventing spyware infection are not working and companies must re-think the way in which they tackle this escalating problem,” said Roy Tuvey, director and co-founder, ScanSafe. “By far the most effective strategy is to protect corporate data by cutting out threats before they can reach the network and before they have a chance to penetrate and corrupt security and operating systems.”