Employees at smaller credit unions may have fewer resources than their counterparts at large credit unions, but they often have greater freedom to surf the Internet and check outside e-mail, opening up all the possibilities and perils of the web.
"Employees need access to the World Wide Web for all the advantages required in today's competitive environment," asserted David Graham, chief financial officer at THE Credit Union of Palm Beach County.
But with the possibilities come perils: employees inadvertently may disseminate member information, visit sites that lack proper security, or simply play around at work.
Due to these risks and the sheer number of employees, many larger credit unions prevent staff from accessing the Internet or web-based email services, such as Google Gmail or MSN Hotmail, using automated control (see related story, this page).
Things are different at smaller credit unions, which take a hands-on approach to controlling employee behavior.
And according to two smaller credit unions, the approach works.
"Our credit union has experienced minimal risks," said Joe Alicea, chief information officer at THE Credit Union of Palm Beach County.
The $90-million credit union "constantly trains employees on the downfalls of opening emails or attachments that are not from recognized senders," said Alicea.
Training sessions include a review of the credit union's electronic access policy, Graham added.
Dangerous
The 50-employee credit union also uses network firewalls and filters as well as intrusion detection to prevent malicious events, said Alicea.
Kent County Credit Union in Grand Rapids, Mich., takes a similar tack, according to Chief Executive Officer Ray Ward.
"Occasionally employees may check Hotmail or Yahoo! Mail," he explained. "But they are instructed not to open anything they receive from unknown sources and not to open any attachments."
However, the $32-million credit union prevents its 21 employees from using web-based search engines, Ward said.
The freedoms afforded by smaller credit unions may be dangerous, asserted the marketing director at one credit union under $170-million in assets.
The marketing director, who asked to remain anonymous, said that his credit union has no policy or tools against outside e-mail-although use is "strongly discouraged."
"We have no restraints on visits to web-based email," he said. "As for the risks inherent to web-based e-mail, to me it seems clear that the credit union loses control.
"An employee can receive numerous types of e-mail, some of which may be harmful to the credit union's systems, and there's really not too much to do about it," he continued.
In fact, the credit union has been exposed to computer viruses after employees opened web-based e-mails, resulting in headaches for the credit union IT department, he said.
The credit union is reexamining access to web-based e-mail, he added. Several other credit unions that refused to go on the record expressed the same concerns, demonstrating just how touchy this subject can be.
CUJ Resources
For additional info:
* Kent County CU, www.kentcountycu.org
* THE Credit Union of Palm Beach County, www.thecu.coop
* Consumers CU, www.consumerscu.org
* EECU, www.eecu.org
* Fairwinds, CU, www.fairwinds.org
* First Source FCU, www.fsource.org
* NuUnion CU, www.nuunion.org
