Employees may do more than get mail when they check their outside e-mail accounts from the credit union.
Social security numbers, electronic statements, and loan approvals go whizzing over the Internet through popular services such as Yahoo! Mail, MSN Hotmail, and Google Gmail, say some credit union IT managers.
Yahoo-checking employees are no fringe element. The free service is used by up to 40% of Americans with e-mail accounts, according to various Internet research firms. Hotmail follows Yahoo in the free e-mail market, whereas Gmail claims less than 5%.
"Web-based e-mail represents a convenient vehicle for compromising confidential data and a source of potential fraud," asserted Charlie Lai, chief information officer at $1.3-billion Fairwinds CU here.
For that reason-and for fear of spreading computer viruses-FAIRWINDS is one of many credit unions that makes it a policy to prevent access to web-based mail.
"Our policy prohibits any non-business e-mail communication," Lai said. "A combination of firewalls and appliances allow us to block non-approved e-mail."
Though some CUs argue that free range of the Internet allows employees to work smarter (see related story, this page), the credit unions interviewed here disagreed.
"The risks outweigh any business-driven need," said Tom Koehler, IT manager at First Source FCU in New Hartford, NY.
Employees at the $179-million are "strictly prohibited" from signing-in to web-based e-mail, Koehler said.
Web-filtering software has ensured that webmail is blocked since 2004, he added.
Outside e-mail is also outlawed at EECU in Forth Worth, Texas, according to Bill Burrows, CIO at the $577-million CU.
Viruses delivered through web-based e-mail "could shut down our business for several days," he said.
The CU stops between 4,000 and 10,000 malicious messages from hitting its internal e-mail systems every month, said Burrows.
EECU also uses web-filtering and Virtual Private Network (VPN) software to bar outside e-mail and most Internet sites as well-except to certain employees for particular purposes, said Burrows.
"We have, for example, emergency communications for senior staff set up on Yahoo! Mail, and we have a Hotmail account that Information Services uses in certain cases, plus a small number of other exceptions," he said.
Many EECU employees used to bypass corporate e-mail, relying on outside e-mail just to get the job done, Burrows continued. That's because the CU's systems erred on the side of caution, blocking too many legitimate e-mails.
Now, an e-mail content-filtering solution refines the process: suspicious e-mail is quarantined and the recipient is notified. Employees can then make a "quick call" if they want to release the quarantined mail, he said.
"Since we have this alternative, requests for Yahoo or Hotmail have about dried up," said Burrows.
Security is not the only concern. Employees are more tempted to goof-off when they can Google or Yahoo, said some CUs.
EECU once suffered a "loss of productivity due to employees playing during duty time," Burrows explained.
Scott Sylvester, vice president, Technology, at $185-million Consumers CU in Oshtemo, Mich., also worries about CU employees who work from home and access outside e-mails.
"We do have a policy in place for best practice, but any employee with VPN access at home does pose a potential threat," Sylvester said.
Viruses downloaded from outside e-mail could launch key-logging software, which in turn could capture the employee's username and password during VPN login, he explained.
NuUnion CU (formerly SECU) in Lansing, Mich., still allows employees to access outside e-mail-but not for long, according to MaryAnne MacIntosh, systems security administrator.
"We are in the middle of making it accessible to only those staff who need it for testing purposes of outages, and nothing else," she said.
CUJ Resources
For additional info:
* Kent County CU, www.kentcountycu.org
* THE Credit Union of Palm Beach County, www.thecu.coop
* Consumers CU, www.consumerscu.org
* EECU, www.eecu.org
* Fairwinds, CU, www.fairwinds.org
* First Source FCU, www.fsource.org
* NuUnion CU, www.nuunion.org
