basel ii compliance report - airmagnet...basel ii, issued by the basel committee on banking...

Basel II Compliance Report

14:34:06 Monday, January 29, 2007 Time Period:

Designated Official:

What is Basel II?*1

Basel II, issued by the Basel Committee on Banking Supervision (Committee), comprise new regulations to measure the capital adequacy of international banks in the Group of Ten (G10) countries *2. Basel II replaces Basel I *3capital requirements.

How does Basel II affect information technology?

Current risk-based capital requirements under Basel I do not include an explicit capital charge for operational risk. Basel II incorporates a capital charge for operational risk. It requires banks engaged in an Advanced Measurement Approach*4 of operational risk to identify, monitor, manage, and report on certain external events. Events include information technology concerns such as system disruptions or failures and external fraud resulting from computer hacking.

How will Basel II be implemented in the European Union?

Basel II will be implemented in the European Union (EU) as the Capital Requirements Directive (28 September 2005)*5, popularly known as CAD3 (Capital Adequacy Directive). There are three main differences between Basel II and the EU Directive. The Directive: (1) applies to credit institutions and investment firms in member states; (2) relies more on insurance to mitigate operational risk; and (3) allows small institutions flexibility by portfolio in calculating credit risk. AirMagnet has a separate compliance report dedicated to the EU's Capital Requirements Directive.

When is Basel II effective?

The Committee aims for member countries to implement Basel II by the end of 2006. For banks using Advanced Measurement Approach to calculating capital assurance, by the end of 2007.

How and when will Basel II affect banks in the United States?

Basel II will be implemented in parallel with Basel I in 2008. In 2009, Basel II will become the standard. Basel II's capital adequacy requirements for international banks will be regulated by the Federal banking agencies: Department of the Treasury (Office of the Comptroller of Currency, Office of Thrift Supervision), Federal Deposit Insurance Corporation, and the Federal Reserve*6.

Notes:1) International Convergence of Capital Measurement and Capital Standards: a Revised Framework (Updated

November 2005).2) The G10 countries include Belgium, Canada, France, Germany, Italy, Japan, Luxembourg, the Netherlands, Spain,

Sweden, Switzerland, the United Kingdom, and the United States.3) Basel I, see http://www.bis.org/publ/bcbs04a.pdf.4) Banks regulated by Basel II can use one of three different models to calculate operational risk. They can use a

basic or standard approach that is calculated as a percentage of their capital assets or they can engage in an advanced measurement approach that incorporates external events and external fraud.

P o we r e d b y Ai r Ma g n e t 2:34:06PMMonday, January 29, 2007

Live Capture

How does Basel II impact computer and network systems?

Risk assessment incorporates operational risk, defined as “the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” Basel II sets out three ways to approach operational risk: Basic Indicator Approach, Standardized Approach, and the Advanced Measurement Approach.

Under the Basic Approach, banks must hold capital for operational risk equivalent to a fixed percentage of annual gross income. Under the Standardized Approach, bank activity is divided across 8 business lines and risk exposure is calculated as a fixed percentage of the income generated from the separate business lines. The Advanced Measurement Approach uses a more sophisticated approach to operational risk. The Committee expects active, international banks and those with significant operational risk exposures to use the Advanced Measurement Approach.

The Advanced Measurement Approach includes a series of quantitative standards that apply to internally generated operational risk measures. The standards include operational risk measurement systems that identify and mitigate events that may lead to a bank's loss of capital (loss events). Loss events include external fraud, business disruptions or failures, and failed transaction processing.

AirMagnet Basel II Compliance Reports

Where wireless technology is used to access international bank systems and/or internal processes, it becomes an operational risk that needs to be identified, managed, and reported under Basel II. AirMagnet System and Device-level Compliance Reports can identify and report on security events and performance problems that lead to loss events defined in Basel II, such as external fraud, business disruptions or failures, and failed transaction

AirMagnet Disclaimer

AirMagnet Basel II Policy Compliance Report™ provides a security framework for wireless networks and devices that can be used to comply with the Basel Committee on Banking Supervision's regulations on capital adequacy (Basel II). The Policy Compliance Report focuses on wireless network security and aims to record and report on certain loss events that occur on wireless networks and devices that can lead to capital loss.

Under Basel II, individual banks must document internal loss data and, where possible, correlate it with respective loss events for reporting purposes. AirMagnet Enterprise is limited to recording certain loss events for wireless networks and devices, not correlating them with internal loss data. It is up to individual banks to document internal loss data and correlate it with respective loss events.

AirMagnet operation is limited to wireless networks and devices operating in the unregulated radio frequencies (2.4 - 5 GHz). It operates and reports on networks and devices that use wireless technologies. It does not apply to wire-line networks and devices not operating in the wireless spectrum.

AirMagnet Policy Compliance Reports provide information about the law and are designed to help users satisfy government and industry regulations. This information, however, is not legal advice. AirMagnet has gone to great lengths to ensure the information contained in the Policy Compliance Reports is accurate and useful. AirMagnet, Inc. recommends you consult legal counsel if you want legal advice on whether our information and software is interpreted and implemented to fully comply with industry regulations.

The information contained in the Policy Compliance Reports are furnished under and subject to the terms of the Software License Agreement (“License”). The Policy Compliance Reports do not create a binding business, legal, or professional services relationship between you and AirMagnet, Inc. Because business practice, technology, and governing laws and regulations vary by location, full compliance with regulations will depend on your particular


Live Capture

1/ System Level Compliance Report

This report summarizes your network’s overall compliance with the Basel II on a per-policy basis.

Section 669. Any internal operational risk measurement system must be consistent with the scope of operational risk defined by the Committee in section 644 and the loss event types defined in Annex 9. (The loss events for the European Union's Capital Requirements Directive are found in Annex X, Part 5).

AirMagnet Compliance Reports document technological processes on wireless networks and report on security events that can be tied with historical loss data to help banks calculate operational risk.

Section 671. Internal loss data is most relevant when it is clearly linked to a bank’s current business activities, technological processes and risk management procedures. Therefore, a bank must have documented procedures for assessing the on-going relevance of historical loss data, including those situations in which judgment overrides, scaling, or other adjustments may be used, to what extent they may be used and who is authorized to make such decisions.

The AirMagnet product is designed to manage the risks inherent in implementing wireless networks using policy-based controls. Using its security monitoring technology and device level alarms, AirMagnet Enterprise can alert credit institutions and investment firms to more than 100 different threat conditions. Alarms can be configured to match the requirements of the European Union's Capital Requirements Directives using

Basel II Compliance

Section 673. A bank’s internal loss data must be comprehensive in that it captures all material activities and exposures from all appropriate sub-systems and geographic locations... A bank must develop specific criteria for assigning loss data arising from an event in a centralized function (e.g. an information technology department) or an activity that spans more than one business line, as well as from related events over time.

AirMagnet Compliance Reports provide a comprehensive view of system and device level activities on wireless networks and maintains that information in a secure, centralized database by date and time time to correlate with a bank's loss data record.

Section 676. In addition to using loss data, whether actual or scenario-based, a bank’s firm-wide risk assessment methodology must capture key business environment and internal control factors that can change its operational risk profile.

AirMagnet records and reports on over 100 security-related events on wireless networks that have the potential to change a bank's operational risk profile.

AirMagnet System Level Compliance Reports


Live Capture

Basel II Compliance

Section 736. The same efforts should be applied to managing operational risk as to other significant banking risks. The failure to properly manage operational risk can result in a misstatement of an institution’s risk/return profile and expose the institution to significant losses.

Wireless technologies pose critical questions for banks and financial institutions that must identify and respond to new threats and vulnerabilities that affect operational risk on wireless networks. AirMagnet can effectively document security events on wireless networks and devices and effectively manage them by taking automated actions to mitigate and avoid events that lead to

Section 737. A bank should develop a framework for managing operational risk and evaluate the adequacy of capital given this framework. The framework should cover the bank’s appetite and tolerance for operational risk, as specified through the policies for managing this risk, including the extent and manner in which operational risk is transferred outside the bank. It should also include policies outlining the bank’s approach to identifying, assessing, monitoring and controlling/mitigating the risk.

AirMagnet System and Device Level Compliance Reports are policy-based reports that use security- and performance-based alarms to identify, assess, monitor, and help control the risks in using wireless technology.


Live Capture

Businessdisruption& system

failure

Execution,delivery &process

management

Externalfraud

Business disruption & system failure 26.2%Execution, delivery & process management 13.8%

External fraud 60.0%

Total: 100.0%

Basel II Violations Per Section

0

20

40

60

80

100

120

140

160

Exter

nal fra

ud

Busines

s disr

uptio

n

& sys

tem

failu

re

Execu

tion, d

elive

ry

& pro

cess

man

agem

ent

Violating DeviceCompliance Device

# o

f D

evic

es

Basel II

2/ Policy Level Compliance Report

This report summarizes your network’s compliance on a per-policy basis, showing you the total number of devices that are in compliance or violation of each and every policy in the Basel.


Live Capture

Compliance %

# C

omp

lian

ce

Dev

ices

# V

iola

tin

g D

evic

es

Pol

icy

Vio

lati

on

Basel II

65.24%External fraud, Systems Security, Hacking damage, theft of information 78 57 107

81.71%Business disruption & system failures, Systems, Hardware, software 34 30 134

89.02%Execution, delivery & process management, Transaction capture, execution & maintenance, Miscommunication, model/system misoperation, delivery failure

18 18 146


Live Capture

# V

iola

tin

g D

evic

es

# C

omp

lian

ce

Dev

ices

Com

pli

ance

S

tatu

s

AirMagnet Alarms

Basel II

External fraud, Systems Security, Hacking damage, theft of information

163 1Client with encryption disabled 99.39%

160 4Device Probing for APs 97.56%

162 2Crackable WEP IV key used 98.78%

132 32AP broadcasting SSID 80.49%

142 22Exposed Wireless Station detected 86.59%

163 1DoS: Unauthenticated association 99.39%

152 12Device unprotected by TKIP 92.68%

160 4AP operating in bridged mode detected 97.56%

Business disruption & system failures, Systems, Hardware, software

161 3Excessive frame retries 98.17%

163 1Higher speed not supported 99.39%

150 14Unassociated station detected 91.46%

163 1Ad-hoc node using AP's SSID 99.39%

163 1Potential Pre-802.11n device detected 99.39%

154 10Excessive missed AP beacons 93.90%

160 4Excessive low speed transmission 97.56%

Execution, delivery & process management, Transaction capture, execution & maintenance, Miscommunication, model/system misoperation, delivery failure

150 14Unassociated station detected 91.46%

163 1Ad-hoc node using AP's SSID 99.39%

161 3Excessive frame retries 98.17%

Notes:

1) By default, your network fails to comply with the Basel II if one of the devices violates any of its policy sections.


Live Capture

3/ Device-Specific Compliance Report

This report contains detailed information about devices in compliance or violation of Basel II. It checks the devices against each and every provision in the Directive to show what policy provisions are violated or upheld to. It lists all wireless devices deployed on your WLAN.

Device Information Policy Sections

MAC Address - TypeCompliance

%

SSID

VENDOR

CHANNEL

External fraud

Business disruption & systemfailure

Execution, delivery & process management

00:90:4B:BD:FC:3A-b

F P P 66.67%ChannelQA_linksys2

?

GemTek

00:16:B6:F9:2E:CC-b

P F F 33.33%ChannelQA_linksys2

?

00:40:96:AF:8C:79-b

F F F 0.00%ChanneldlinkG

?

Cisco

98:06:9D:D5:FF:31-b

P P P 100.00%ChannelSensor Coverage Survey

?

00:90:7A:05:2F:CF-b

P P P 100.00%ChannelAirMagnetGuest

2

SpectraLink

00:90:7A:05:12:AC-b

P P P 100.00%Channelqa_wireless_11a_only@tv_cubicle

5

SpectraLink


Live Capture

00:02:6F:20:2D:E7-b


?

Senao

60:1D:4D:7A:96:B2-b

P P P 100.00%Channelcompg

?

72:ED:3F:67:E4:B3-b

P P P 100.00%ChannelBuffalo

?

00:12:17:B5:AA:45-b

F F F 0.00%ChannelQA_linksys2

10

Cisco

00:02:6F:22:36:6E-b

P P P 100.00%ChannelNGbg

2

Senao

00:02:6F:22:7E:E9-b


?

Senao

00:02:6F:20:32:3D-b


?

Senao

00:14:F1:AF:1B:97-b

F P P 66.67%ChannelQA-1130-15

7

Cisco


Live Capture

00:20:A6:52:8F:65-b

F P P 66.67%Channeltv-Wireless Network B

8

Proxim

00:0B:86:84:B5:30-b

F F P 33.33%Channelaruba-engr-11g

8

Aruba

00:11:5C:4D:E8:41-b

F P P 66.67%ChannelAirMagnetGuest

4

Cisco

00:0E:35:C0:35:7D-g

F F F 0.00%ChannelAir2

4

00:0D:ED:AB:7C:23-b

P P P 100.00%ChannelNetgear

?

Cisco

00:40:96:A1:4A:F8-b

P P P 100.00%ChannelBuffaloQA

?

Cisco

00:16:6F:9C:00:A0-b

P P P 100.00%ChannelQA_linksys2

10

28:B7:C6:A0:0B:B7-b


?


Live Capture

00:13:02:1F:F0:1D-b


?

00:0C:F1:3E:E6:58-b

F P P 66.67%ChannelNGbg

?

00:14:A5:49:D3:3B-b


?

GemTek

00:14:A5:54:87:1A-b


?

GemTek

00:90:7A:05:2E:45-b

P P P 100.00%Channelcompa

2

SpectraLink

00:02:6F:22:3B:D3-b


?

Senao

32:64:0D:38:5B:8F-b


?

00:0C:41:A8:7A:C2-b

F F P 33.33%ChannelENG-linksys_rtf

9


Live Capture

00:14:F1:AF:1B:96-b

F F P 33.33%ChannelQA-1130-14

7

Cisco

00:12:17:DB:88:81-b

F F F 0.00%ChannelQA_linksys1

11

Cisco

00:11:5C:4D:E8:40-b

F P P 66.67%ChannelAir2

4

Cisco

00:0B:85:79:03:C0-b

P P P 100.00%ChannelQA-1130-15

11

Airespace

00:15:2B:AC:CB:CF-b

P P P 100.00%ChannelAM_vofi

7

Cisco

00:90:96:C6:C2:CE-b

P P P 100.00%ChannelAir3

?

Askey

00:0B:85:66:24:90-b

P P P 100.00%Channel<No current ssid>

?

Airespace

00:0B:85:26:7F:80-b


?

Airespace


Live Capture

00:12:F0:1A:6C:5D-b


?

00:90:7A:05:2E:AA-b

P P P 100.00%ChannelNETGEAR

2

SpectraLink

00:02:6F:22:7E:E7-b


?

Senao

04:83:6D:6C:AE:AA-b


?

00:14:F1:AF:1B:95-b


7

Cisco

00:20:A6:53:8E:73-b

F F F 0.00%ChannelBuffaloQA

8

Proxim

00:90:96:CB:2F:8B-b

F P P 66.67%ChannelSensor Coverage Survey

?

Askey

00:13:02:1B:3A:AC-b


?


Live Capture

00:0D:0B:4F:5E:00-b

F F F 0.00%ChannelBuffaloWing

6

00:14:F1:AF:1B:94-b


7

Cisco

00:0F:34:A7:78:10-b

P F P 66.67%ChannelQAVOFI

2

Cisco

00:0B:85:01:33:A0-b


?

Airespace

00:12:F0:9E:5D:01-b


?

00:90:4B:BD:FC:46-b


?

GemTek

00:0E:35:0D:DA:73-b

P P P 100.00%ChannelQAVOFI

?

00:0C:F1:42:84:29-b

P P P 100.00%ChannelQAVOFI

?


Live Capture

00:0C:F1:4C:27:6E-b


?

B8:8D:56:46:54:8B-b


?

00:14:F1:AF:1B:93-b


7

Cisco

00:0B:46:91:EA:72-b

P P P 100.00%ChannelBuffaloQA

1

Cisco

00:0E:35:C0:5D:AE-g

F F F 0.00%ChannelQAVOFI

2

00:90:4B:BD:FC:34-b

P P P 100.00%ChannelHopOnWireless

8

GemTek

00:90:4B:BD:FD:12-b


?

GemTek

68:B3:1E:94:E5:5B-b


?


Live Capture

00:90:7A:05:2F:74-b

F F P 33.33%ChannelQAVOFI

5

SpectraLink

00:16:6F:6D:57:FA-b


?

00:13:02:1B:39:88-b

P P P 100.00%Channelaruba-engr-11a

?

00:14:A5:01:94:D0-b

P P P 100.00%Channeltv-Wireless Network B

8

GemTek

02:24:12:1D:E4:3D-b


?

00:02:6F:20:6C:90-b


?

Senao

00:14:F1:AF:1B:92-b


7

Cisco

00:0B:85:01:33:AF-b


10

Airespace


Live Capture

00:03:7F:BE:E0:35-b

F P P 66.67%Channelcompg

?

Atheros

00:40:96:A4:0E:EC-b


?

Cisco

00:0E:35:7F:4E:29-b


?

00:02:6F:20:32:6A-b


?

Senao

00:0B:7D:27:9C:EB-b


?

00:40:96:59:A9:39-b


6

Cisco

00:14:F1:AF:1B:91-b


7

Cisco

00:11:F5:43:B1:B9-b

F F P 33.33%ChannelSensor Coverage Survey

1


Live Capture

96:20:7C:98:19:E6-b


?

00:90:4B:BD:FD:21-b


?

GemTek

00:90:4B:BD:FC:43-b


?

GemTek

00:59:29:6D:54:0D-b

P P P 100.00%ChannelMetroFi-Free

?

00:02:6F:21:27:23-b


10

Senao

00:90:7A:04:F0:C4-b


2

SpectraLink

00:14:F1:09:12:D8-b


?

Cisco

00:14:F1:AF:1B:90-b

F P P 66.67%ChannelAM_vofi

7

Cisco


Live Capture

00:13:80:43:11:55-b


11

Cisco

00:0B:85:52:FF:F0-b


11

Airespace

00:0B:85:54:D8:30-b


?

Airespace

6E:BB:13:70:43:A0-b


?

00:12:F0:95:67:4B-b


?

00:04:23:A2:81:E8-b


?

Intel

00:90:4B:BD:FD:0F-b


?

GemTek

42:DE:6D:E4:F7:D0-b

P P P 100.00%ChannelBuffalo

?


Live Capture

00:13:80:43:11:54-b


11

Cisco

00:14:A5:54:85:67-b


?

GemTek

00:02:6F:20:2D:88-b


8

Senao

00:02:6F:21:2A:43-b


?

Senao

6E:B0:18:D5:8B:09-b


?

00:13:5F:F9:7F:00-b

F P P 66.67%Channelcompg

10

00:13:80:43:11:53-b


11

Cisco

00:13:80:43:12:20-b


11

Cisco


Live Capture

00:13:80:43:15:20-b

F F P 33.33%ChannelQA_QATest4

2

Cisco

00:90:4B:72:B8:6D-b

F F F 0.00%ChannelP-780_g6

?

GemTek

00:16:6F:6C:72:B4-b

P P P 100.00%ChannelMonitored

?

00:16:6F:54:3C:95-b

P P P 100.00%ChannelSabre

?

00:14:A5:01:95:87-b

F F F 0.00%Channeltv-Wireless Network B

8

GemTek

00:0C:F1:42:8B:BC-b

P P P 100.00%ChannelSabre

?

00:90:4B:CC:75:7E-b

F F F 0.00%ChannelNGbg

?

GemTek

00:16:CF:9F:E8:EC-b


?


Live Capture

D6:C2:55:CC:AA:FD-b


?

00:13:80:43:11:52-b


11

Cisco

00:14:A8:53:4C:60-b

F P P 66.67%Channeltech-1200

7

00:02:6F:3A:3F:B1-b

F F F 0.00%ChannelPRISM-SSID

?

Senao

00:02:6F:20:18:85-b

F P P 66.67%ChannelSensor Coverage Survey

?

Senao

00:02:6F:22:37:52-b


?

Senao

00:02:6F:20:8A:BF-b


2

Senao

00:0E:35:89:B5:C3-b


?


Live Capture

00:13:CE:CF:4A:D7-b

P P P 100.00%ChannelNETGEAR

?

00:02:8A:A8:9A:15-b


11

Ambit

00:13:80:43:11:51-b


11

Cisco

00:12:F0:29:83:8A-b

F F F 0.00%ChannelHopOnWireless

?

00:90:7A:05:07:F3-b

F F P 33.33%ChannelQAVOFI

5

SpectraLink

00:02:6F:20:8C:E0-b


?

Senao

00:14:A5:54:77:FC-b


2

GemTek

00:40:96:AF:31:BC-b


?

Cisco


Live Capture

00:40:96:A1:49:BA-b

F P P 66.67%Channel<No current ssid>

?

Cisco

00:13:80:43:11:50-b


11

Cisco

00:09:5B:D6:5C:F8-b

F P P 66.67%ChannelNGbg

2

Netgear

00:0B:85:54:EA:60-b


11

Airespace

00:02:6F:21:C4:7C-b

F P P 66.67%ChannelBuffaloQA

?

Senao

00:02:6F:22:00:5E-b

F P P 66.67%ChannelBuffaloQA

?

Senao

00:09:7C:14:A7:0D-b

F F F 0.00%ChannelANY

?

Cisco

00:02:6F:20:2E:0D-b


?

Senao


Live Capture

00:14:A5:01:95:84-b


2

GemTek

00:14:A5:01:95:EA-b


2

GemTek

00:14:A5:01:95:B7-b


?

GemTek

00:CD:59:78:3C:00-b


?

00:40:96:AB:51:F4-b

F F F 0.00%ChannelAir2

?

Cisco

00:0B:46:91:E2:48-b

P F F 33.33%ChannelQA-1200-32

?

Cisco

00:40:96:A8:2E:28-b

F P P 66.67%ChannelQAVOFI

?

Cisco

00:90:4B:BD:FC:D6-b


?

GemTek


Live Capture

00:40:96:59:B9:44-b


6

Cisco

00:02:8A:A3:09:20-b


9

Ambit

00:20:A6:4C:A6:A3-b

F P P 66.67%ChannelAM_vofi

?

Proxim

00:15:F9:41:C4:46-b


7

Cisco

00:02:6F:20:32:2F-b


?

Senao

00:02:6F:21:29:D7-b


?

Senao

00:13:CE:C8:54:ED-b


?

00:90:4B:BD:FD:09-b


10

GemTek


Live Capture

00:13:02:89:9F:86-b


?

00:11:5C:4D:E9:11-b

F P P 66.67%ChannelAirMagnetGuest

4

Cisco

00:07:85:B3:8A:E3-b

P F P 66.67%ChannelQAVOFI

5

Cisco

00:0B:85:01:34:40-b


11

Airespace

00:0B:85:23:7B:00-b


11

Airespace

00:0B:85:08:12:D0-b


11

Airespace

00:04:23:6C:CB:AC-b

F F F 0.00%Channelwhitman_wireless

11

Intel

00:0B:85:54:E9:90-b

P P P 100.00%ChannelEagerWireless

?

Airespace


Live Capture

00:0B:85:04:3A:80-b


?

Airespace

00:13:02:77:23:ED-b


?

00:13:02:31:12:22-b

F F F 0.00%Channelairpocket

?

5C:7B:25:56:9C:A1-b


?

00:0D:0B:1A:14:03-b

F P P 66.67%ChannelBuffalo

10

00:11:5C:4D:E9:10-b

F P P 66.67%ChannelAir2

4

Cisco

Notes:

1) P = Pass; F = Fail2) A device is considered to have failed to comply with Basel II Directive if it violates any of the policy

provisions. 3) Basel II, Section 699 describes a series of quantitative standards that apply to internally generated

operational risk measures for the purposes of calculating the regulatory minimum capital charge. Subsection (a) states that any internal risk measurement system must be consistent with the scope of operational risk defined by the Committee (Paragraph 644) and the loss types in Annex 9. The loss types above are applicable to AirMagnet device level alarms.

4) Channel specific policy violations will not be included in the Device-Specific Compliance Report.


Live Capture

basel ii compliance report - airmagnet...basel ii, issued by the basel committee on banking...

Documents