【正文】
因業(yè)務(wù)外包而獲得銀行數(shù)據(jù)的第三方,也應(yīng)當(dāng)遵守銀行數(shù)據(jù)使用和保護(hù)的有關(guān)標(biāo)準(zhǔn)和控制措施。誤用或未經(jīng)授權(quán)而公開披露這些信息可能給銀行帶來(lái)聲譽(yù)和法律方面的風(fēng)險(xiǎn)。 電子銀行交易和記錄程序在設(shè)計(jì)時(shí),應(yīng)該杜絕未經(jīng)授權(quán)的修改逃避監(jiān)控。因此,銀行在實(shí)施直通處理程序時(shí),很有必要確保安全、穩(wěn)健和數(shù)據(jù)完整性。 原則 7:銀行應(yīng)確保對(duì)電子銀行系統(tǒng)、數(shù)據(jù)庫(kù)和應(yīng)用程序擁有適當(dāng)?shù)氖跈?quán)控制和進(jìn)入特權(quán)制度。 在電子銀行業(yè)務(wù)環(huán)境中,建立和維護(hù)職責(zé)分解的通常做法包括如下: The bank’s standards and controls for data use and protection must be met when third parties have access to the data through outsourcing relationships. ropriate efforts are made to ensure that access logs are resistant to tampering. 中文翻譯 巴塞爾銀行監(jiān)管委員會(huì):《 電子銀行業(yè)務(wù)的風(fēng)險(xiǎn)管理原則 》 (部分 ): 原則 6:在電子銀行系統(tǒng)、數(shù)據(jù)庫(kù)和應(yīng)用程序中銀行應(yīng)該采取適當(dāng)?shù)拇胧?,以保證有效地分解職責(zé)。Segregation should be maintained between those initiating static data (including web page content) and those responsible for verifying its integrity. banking systems should be tested to ensure that segregation of duties cannot be bypassed. administrating ebanking systems. Principle 7: Banks should ensure that proper authorisation controls and access privileges are in place for ebanking systems, databases and applications. In order to maintain segregation of duties, banks need to strictly control authorisation and access privileges. Failure to provide adequate authorisation control could allow individuals to alter their authority, circumvent segregation and gain access to ebanking systems ,databases or applications