Today, most people who do not reject new technologies enjoy the benefits of e-banking systems (EBS). Nobody will stand in line at savings banks or go to a bank for some money transfer, even retirees. Now the children and grandchildren can save them from bank office visits.

EBS benefits for legal entities are even more obvious. Embezzlers disappeared as a class. Accounting office work hours are optimized due to the absence of paper work flow. There is no need to keep tens and sometimes hundreds of kilos of paper documents.

Banks act as the main engine of e-banking systems development. They get economic benefits due to reduction of the customer service cost. Naturally, the credit institution spends a lot to implement such system, but its payback period is significantly reduced with the increasing number of customers, which are attracted by bank developing various channels of remote banking services, such as "thick" or "thin" client, mobile client, and others.

At that operating systems and common use software are developed with the "convenience above all" priority, i.e. the compromise between convenience and security shifts from security towards convenience. And it generates a large number of potential vulnerabilities. For example, before the ninth article of the Federal Law № 161 "About national payment system" came into effect, the bank was obliged to process only payment orders received from a client. Traditionally EBS agreement sets the rules that are not performed by most inexperienced users. The violation of such rules may be the ground for client damage compensation denial.

Since the attack of the bank's information systems is a challenging task, the easiest way is to take advantage of an accountant and/or system administrator's lack of vigilance at the client location. The most popular are specialized Trojans that a user may "catch" from the Internet or by the means of social engineering. There are a lot of species of similar programs. For example, the "malware" program allows to intercept "login/password" combination from a keyboard, transmit and distort monitor images to gain the access to the private key of an electronic signature.

There is a new trend of malware concept development which is capable of infecting BIOS, CMOS and compromising a system at hardware level, leaving no traces on the computer's hard disk.

The universal solution in this case is the use of a specialized system for EBS programmed to use only the necessary functions, strict user authentication, which does not allow malware penetration, providing insulation from hazardous Internet connections, i.e. developing an environment, fully protected from any unauthorized intervention.

This function may be performed by SPDS "POST" software developed by S-Terra CSP company, which is based on the concept of a trusted environment session creation. This device is a carrier, made in USB form factor.

Workstation (CWS) is loaded in SPDS "POST" only in case of a successful PIN-code entry, the standard of which is kept on a secured and certified smart card of leading Russian manufacturers. PIN-code check result defines the user's rights, the access to the USB-drive sections is granted on the basis of abovementioned rights, the integrity of operating system and its loading with SPDS "POST" is verified.

After the download and network settings profile selection an insulating secure connection with the bank's server is set up. At that all other connections are prohibited as a rule (in accordance with the administrator policy).

Target software (e.g., client-bank) is launched in an isolated environment. And the keys for electronic signature may be stored on a smart card, built in SPDS "POST", and on an external token. The presence of SPDS "POST" product in terminal and browser version allows the use of different versions of the Client-Bank system.

As a result, the created isolated sandbox of CWS functioning cannot start third-party software, connect the external devices prohibited by administrator's policy, you may not connect to it via network.

Measures of protection from physical exposure to the elements of the device are provided to increase USB-drive security level.

In some cases it is more convenient to use a complete solution for a trusted session creation that includes not only the SBM (special bootable media), but also a diskless workstation, configured for cooperative work. Such a set of trusted session (TSS), which includes SPDS "POST", the "thin" client of trusted Russian manufacturers and electronic lock in BIOS to provide mutual authentication between the terminal and SPDS "POST" is offered by S-Terra CSP. TSS is perfectly suitable for business process organization in situations when the shift work on the same workplaces is performed.

It is important to note that in the case of TSS use the workstation loading is possible only if an employee has SBM. This helps to attain workplace personalization for each specialist, reduces the risk of data leakage, prevents unauthorized access to confidential information and the economic efficiency of a workplace is increased.

Thus, the device SPDS "POST" of S-Terra CSP company provides a two-factor authentication, isolated closed functional environment, the secured channel between the bank client and the bank server - in other words, it completely protects the user's CWS. The product is certified by Russian FSB as KS2 CIPF, allows to satisfy CIPF requirements approved in STO BR IBBS (Standard of Bank of Russia for ensuring the information safety of bank system entities in Russian Federation) and may enable banks to rank the range of safety means for a customer depending on expected risks.