|
THE
STATE BANK OF VIETNAM
-------
|
SOCIALIST
REPUBLIC OF VIET NAM
Independence - Freedom - Happiness
---------------
|
|
No.:
29/2011/TT-NHNN
|
Hanoi,
September 21, 2011
|
CIRCULAR
DEFINING SAFETY, CONFIDENTIALITY OVER PROVISION FOR BANKING
SERVICE ON THE INTERNET
Pursuant to the Law on the
State Bank of Vietnam No.46/2010/QH12 dated June 16, 2010;
Pursuant to the Law on Credit
Institutions No.47/2010/QH12 dated June 16, 2010;
Pursuant to the Law on
E-Transactions No.51/2005/QH11 dated November 29, 2005;
Pursuant to the Decree
No.35/2007/ND-CP dated March 08, 2007 of the Government on E-transactions in
the banking activities;
Pursuant to the Decree
No.64/2001/ND-CP dated September 20, 2001 of the Government on payment activities via payment
service providing organizations;
Pursuant to the Decree
No.26/2007/ND-CP dated February 25, 2007 of the Government detailing the
implementation of the Electronic Transaction Law on digital signatures and
digital signature certification services;
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Pursuant to the Decree No.97/2008/ND-CP
dated August 28, 2008 of the Government on the management,
provision and use of internet services and electronic information on the
internet;
The State Bank of Vietnam
defines the safety, confidentiality over provision for banking service on the
internet as follows:
Chapter 1.
GENERAL PROVISIONS
Article 1.
Scope of governing and subjects of application
1. This circular specifies the
requirements to ensure safety, confidentiality for the provision for banking
services on the Internet.
This Circular applies to all
credit institutions, branches of foreign banks providing for banking services
on the Internet (hereinafter collectively referred to as the service providers)
in Vietnam.
Article 2.
Interpretation of terms
In this Circular, the following
terms shall be construed as follows:
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
a) Information on service
providers and services of the providers.
b) Service to look up
information such as looking up information of customers, accounts, balance
inquiry, and other information.
c) Carrying out online financial
transactions, such as account services, wire transfer, credit, and payment via
account.
d) Other services as prescribed
by the State Bank.
2. Internet Banking
system: means a structured set of hardware equipment, software, databases,
security and communications networks systems for the management and provision
for banking services on the Internet.
3. Clients: mean the organizations,
individuals related to use of Internet Banking services.
4. Two-factor authentication:
means the authentication method requiring two different factors to prove the
correctness of an identity. Two-factor authentication based on the information
that the user knows, such as customer number, password, along with something
that user has such as one-time password (OTP), random matrix, signs of
biometrics, or other supportive devices to prove an identity.
5. Privileged account:
means the account accessing into the information technology system to perform
special works or access to sensitive data. Privilege accounts are often used
for device configuration, system administration, operating system
administration, database administration, or professional applications
management (such as the root accounts, supervisors, system, and administrator).
Article 3.
General principles for the provision of banking services on the Internet by the
service providers
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
a) Ensure confidentiality of
information relating to accounts, deposits, assets, and customers’ transactions
in accordance with the law regulations.
b) Customers’ passwords,
encryption keys and other key encryptions must be encrypted during the transaction,
on the transmission line and stored in the service providers.
2. Assurance of availability
a) Commit the continuous
operational capability of the Internet Banking system openly, clearly and to be
stated clearly in the service providing contracts with customers. This
commitment must include at least a commitment of total time to suspend the
system in a year, the time of service provision per day, the time to restore
system after the trouble.
b) Meet sufficient resources of
the information technology infrastructure and human resources to ensure the
continuity in service provision of Internet Banking in accordance with
commitment of the service providers to their customers.
c) Develop, promulgate and observe
the processes of the Internet Banking system.
d) Use the tools monitoring,
tracking the performance of the primary system and the backup system to ensure
their continuous operation.
3. Assurance of the integrity
a) Ensure the integrity of
information during the processing, storage and transfer between service
providers and their customers.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
- Physical access;
- Logical access;
- The process of access,
processing, transmission, dump, storage, recovery of data.
4. Client authentication and
transaction authentication
a) Ensure authentication and
identify customers when they access and use Internet Banking services.
b) Use two-factor authentication
on the Internet Banking system as performing payment transactions and other
important transactions such as the connection creation between accounts,
payment registration to a third party, change of the transaction limit in a
day, change of the account information related to personal data of customers
(such as address of offices or home, telephone numbers, email addresses and
other information to verify customers).
5. Consumer protection
a) Provide for sufficient
information on the rights and obligations of the customers before signing the
contracts to provide services with customers. In the service providing
contract, it must specify that the service provider shall ensure the terms set
out in this Article for the customer. The service providers must fully comply
with the terms of their responsibilities stated in the service contracts signed
with their customers.
b) In the service providing
contract, the service provider must specify the security responsibilities of
the personal information of customers when they use the Internet Banking
service; specify clearly the method that the bank to collect and use customer’s
information, commit not selling, disclosing or leaking such information.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
d) To be responsible for
checking, warning and implementing measures to prevent and combat fake websites
of providing for Internet Banking service of the service provider; at the same
time to notify the method to determine the real website to customers.
Chapter 2.
SPECIFIC PROVISION
Article 4.
Policy on safety and confidentiality of the systems
Develop and promulgate
regulations on safety and confidentiality for Internet Banking system in
accordance with regulations on safety, confidentiality for information
technology system of the State, banking sector and the regulations on safety
and confidentiality of information technology of the units. Periodically at
least once a year, the unit must review, modify and perfect these regulations
to ensure the suitableness, fullness, and effect of the regulations.
Article 5.
Human Resource Management
1. Selecting officials who have
the morality, educational level, ability to meet the requirements of
professional skill and technology when be assigned tasks related to Internet
Banking system.
2. The tasks of system
administration; development and maintenance of application software and the
system operation must be assigned to each division, different individuals.
Ensure the cross control and there is no person to have full rights on the
system or can initiate, intervene in the transactions of the Internet Banking
system. Having provision for responsibilities and clear decentralization for
each group of division or individual listed above. Privileged account on the
Internet Banking system must be designed to be accessible only when having key
of at least two people and must be strictly controlled over all operations of
this account.
3. Having specific, clear
regulations, and full implementing the management and supervision of personnel
of the third party as accessing to the Internet Banking system. The
requirements for safety, security, and agreements need to be specified in
contracts with third parties.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
1. To take measures to separate
the network partitions to ensure the control of system access.
2. To take measures to detect
and prevent intrusion, spreading of malicious code to the system.
3. To develop and implement
backup plans for key positions having a high impact level to the network system
or that potentially cause cripple for the entire network system of the units
when the incident occurs.
4. The wireless connection must
used authentication measures to ensure safety.
5. To guarantee bandwidth requirements
for Internet Banking services.
6. To update the system patches,
update the configuration of network devices and security devices at least every
six months. In case of system error detection, it must perform the immediate
update.
7. The equipment of network,
security, confidentiality, anti-virus software, analysis tools, network
management installed in the unit’s network must have the copyright and clear
source and origin.
Article 7.
Hardware and software of system
1. It must have the server infrastructure
and associated equipment for Internet Banking System (hereinafter referred to
as Internet Banking server) of full capacity, achieving performance as
required, ensuring the access processing speed to meet customers’ needs using
the service.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
a) To have high availability
features, flexible backup mechanism to ensure continuous operation.
b) To be put in the place where
is protected safely and supervised strictly.
c) To separate the logic or
physic with the servers operating other professional skills.
3. Requirements for system
software:
a) To be reviewed and updated
the versions, error patch of system software as recommended by the supplier at
least every six months.
b) To make a list of software
permitted to install on Internet Banking server and periodically at least every
three months to update, inspect, ensure the compliance with this list.
Article 8.
Software of application
1. General requirements
a) The requirements for safety,
security of operations must be determined before and organizing to implement
into the entire cycle of software development from analysis and design stage to
the stage of operation and maintenance.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
c) Prior to deploying new
applications, it must assess the risks of the deployment process for
professional operations, relevant information technology systems and making and
implementing plans to limit, overcome the risks.
d) It must be identified, made
statistics of activities and abnormal transactions arising in the system.
2. Inspection of the application
software test
a) Developing and approving
plans and testing scenario for applications offering Internet Banking services,
which clearly states the conditions of safety, security required to be met.
b) Detecting and eliminating
errors, frauds that can occur when entering input data and security
vulnerabilities in the process of inspecting the system test.
c) Writing down the errors and
process to deal with errors, especially errors on safety and security in the
reports on inspection of the test.
d) Inspection of the test of
safety, security features must be taken on the popular browsers like Internet
Explorer, Mozilla, Firefox, Google Chrome.
đ) Conducting the test on
separate environment and not affecting the normal operation of business;
preparing the reports of test results to submit to the competent authorities
for approval before being put into use.
e) The use of data for the test
process is required to take precaution measures for preventing to be benefited
or confused.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
a) For each requirement to change
software, it must analyze and assess the impact of changes to the existing
systems as well as business and other relevant information technology systems
of the units.
b) The software versions include
the source program required to be centrally managed, stored, kept secret and
have decentralization mechanisms for each member in the manipulation with the
files.
c) Information of the versions,
update time, the update person of versions must be saved.
d) Each upgraded version must be
inspected the test of safety, security features and stability before the
official deployment.
đ) The upgrade of version must
be based on test results and must be approved by the competent authorities.
e) After the software versions
are successfully tested, they must be managed closely; to avoid illegally
modified and ready for deployment.
g) Along with the new software
version, it must have clear instructions on the changed contents, software
update, and other relevant information and must be approved by the competent
authority prior to the deployment to customers.
4. Source program control
a) To check the source code, to
remove the malicious code sections, the security vulnerabilities (back-door).
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
c) The access to the source
program must be approved by the competent authorities and to be monitored and
logged.
d) The source program must be
kept safely in at least two separate locations.
đ) In case the service provider
purchases software from a third party without being handed over the source
program, the service provider must require the third party to sign agreement
not containing malicious code in the software application delivered to the
service provider.
Article 9.
Database safe
1. Only use the database
management system having copyright and clear origin and has been tested through
actual operations of similar domestic or abroad organizations.
2. Database management system
used for Internet Banking system must meet the requirements of stable
operation; processing, storage of much data volumes by business requirements;
with mechanisms to protect and decentralize access to the database resources.
3. To review, update the
patches, the error modifications of database management system at least once
every six months or right after the supplier's recommendations.
4. To formulate plans of backup,
reserve for database to ensure the Internet Banking system of continuous
operation when the incident for the database occurs.
5. To decentralize and define
strictly for each individual accessing to database. It must log for database
access, manipulation for the database configuration.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Article 10.
Data Encryption
1. To select the encryption
algorithm meeting the requirements to ensure the confidentiality and handling
capabilities of the Internet Banking system.
2. The encryption algorithm
being used must be periodically checked once a year, review the safety level
and handle timely weaknesses if any.
3. Not to let an individual
perform the entire process of creating the encryption key. The encryption key
must be created, modified, distributed, and stored safely.
4. It must ensure to recover
encrypted information when necessary.
5. It must have the strict rules
on the recovery of encryption keys, including the key destruction and the key
restoration.
Article 11.
Management of diaries
1. Logging the following events
for Internet Banking system:
a) The system access process.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
c) The events of authentication.
d) The events of grant and
revocation of the right to access system and to use service.
đ) Transaction processing.
e) The unusual accesses.
2. Logging customers’
transactions and monitoring financial transactions on the Internet Banking
system.
3. The log of the Internet
Banking system to be stored, protected safely, and accessible when needed. Time
for saving log is at least 03 years.
4. To check the access logs to
detect, prevent the abnormal, illegal accesses for at least once a month.
Article 12.
Incident management
1. To formulate the incident
management process, which must clearly define the responsibilities of related
departments, details the steps taken, including notification to the customers
and report to the State Bank.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
3. To apply the technical
solutions to detect and handle timely the attacks into the denied services such
as use of firewall devices; equipment to detect and prevent intrusion; the
specialized equipment warning strike, diverting of network traffic; filter the
information packets as being attacked.
4. To request third parties to provide
troubleshooting procedures for the services provided by third parties relating
to Internet Banking system.
Article 13.
Guidance for customer
1. To promulgate regulations in
which clearly state the rights and obligations of customers and of the service
providers for the provision and use of Internet Banking services.
2. To guide customers the
contents of self-ensuring safety in the use of Internet Banking services such
as:
a) Method to set a password and
protect password.
b) Not sharing the storage
equipment of passwords, digital signatures.
c) Not placing options of web
browser to allow the user name and password archiving.
d) Escape from the Internet
Banking system when not using.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
e) Method to access to
applicable address of the Internet Banking service of the units.
g) Notice to the service
providers of errors and incidents in the course of using the service.
h) Warning of the other risks.
Chapter 3.
REPORT
Article 14.
General requirements
The service providers are
responsible for submitting reports to the State Bank of Vietnam (Department of
Information Technology) as prescribed in Article 15, Article 16 of this
Circular.
Article 15.
The types of report
1. Report on provision for
Internet Banking services:
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
b) For the units that provide
services after the effective date of this Circular: The units send the reports
at least 10 days prior to the official provision of Internet Banking services.
2. Annual reports:
The service providers must
submit annual reports before March 15 every year.
3. Irregular reports:
The service providers shall
submit irregular reports when the unsafe incidents occur or affecting the
operation of the Internet Banking system within 05 days from the time of the
accident or of incident detection.
Article 16.
Contents of report
1. Report on Internet Banking
services includes the following:
a) Address of website to provide
for services.
b) The products and services
currently offered.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
d) Unit providing for Internet
Banking system products.
đ) The third parties hired or
coordinating together with to set up and operate Internet Banking system; the
activities related to Internet Banking system with the participation of third
parties and forms of participation of third parties.
e) The documents include
information technology infrastructure and communications, human resources,
process of business technique, the plans for dealing with risk, and other
related matters as prescribed in Chapter II of this Circular.
2. The annual report includes
the following contents:
a) The products and services of
Internet Banking being supplied.
b) The changes of the products,
Internet Banking services since the last report.
c) The changes of the documents
prescribed at Point e, Clause 1, Article 16 since the last report.
d) Number of customers using the
Internet Banking services and customer growth rate compared to the same period
of the last year.
đ) The problems have arisen in
the period. Incidents are reported at risk group, the damage and remedial
measures adopted.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
3. Irregular report includes the
following contents:
a) Date and place where the
incidents occur.
b) Preliminary description of
the incidents, the status of the incidents when they occur.
c) The cause of the problem.
d) Assessment of risk, the
impact toward Internet Banking system and other involved systems.
đ) The situation of the damage.
e) The measures that the unit was
taken to overcome the problem; prevent and stop risks.
g) Recommendations and
proposals.
Chapter 4.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Article 17.
Effect
1. This Circular takes effect as
from November 04, 2011.
2. The Circular
No.09/2003/TT-NHNN dated 05/08/2003 of the State Bank Governor guiding the
implementation of some provisions of Decree No.55/2001/ND-CP dated 23/08/2001
of the Government on management, provision and use of Internet and the Circular
No.01/2008/TT-NHNN dated 10/03/2008 amending, supplementing the Circular
No.09/2003/TT-NHNN shall be invalid since the effective date of this Circular.
3. In the course of
implementation, if problems arise, concerned organizations and individuals
should promptly reflect to the State Bank of Vietnam (Department of Information
Technology at No.64 Nguyen Chi Thanh, Dong Da, Hanoi, Vietnam) for review and
settlement.
Article 18.
Responsibility for implementation
1. The Information Technology
Department is responsible for monitoring and inspecting the implementation of
this Circular of the service providers. Each year, through the reports of the
units or performance of the site inspection to assess the compliance with
provisions and ensure safety, security for Internet Banking system of the
units; synthesizing and reporting to the Governor situation of safety, security
of Internet Banking services of Vietnam's banking system.
2. Agency inspectors, bank
supervisors are responsible for coordinating with the Department of Information
Technology to inspect and supervise the implementation of this Circular and
handling administrative violations for the violations under the provisions of
law.
3. Chief of Office, Director of
Information Technology and the heads of units of the Vietnam State Bank,
Directors of State Bank-branches in provinces and cities directly under the
Central Government, Chairmen of the Management Boards, Chairmen of the members’
Councils, general directors (directors) of credit institutions, branches of
foreign banks providing for Internet Banking services shall implement this
Circular./.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
FOR
THE GOVERNOR
DEPUTY GOVERNOR
Nguyen Toan Thang