SECURITY STATEMENT
SECURITY
Our Online Services are provided by a third party service provider,
Fidelity Integrated Financial Solutions ("Fidelity").
Fidelity is responsible for providing account access and security
for Online Services. Fidelity has agreed to provide the security
arrangements described below, except that enrollment will be accomplished
via e-mail and first-class mail and will not be subject to the security
arrangements described below.
ONLINE SERVICES LOGIN
To begin an Online Services session, the user must key in a login
id and a password. Online Services uses a "three strikes and
you're out" lock-out mechanism to deter users from repeated
login attempts. After three unsuccessful login attempts, the system
locks the user out, requiring a phone call to verify the password
before re-entry into the system. Upon successful login, the Digital
ID from VeriSign authenticates the user's identity and establishes
a secure session with that visitor.
ESTABLISHING A SECURE CONNECTION
Our Online Services transmit data using SSL (Secure Socket Layer)
technology that supports 128-bit key encryption. It is important
to verify that a secure connection between your browser and our
server has been established before transmitting any confidential
account information over the Internet. An indicator on your web
browser can verify this. Netscape Navigator has a key symbol that
appears in the lower left corner of the screen. When the symbol
appears "solid," transmitted data is being encrypted.
When this symbol appears "broken," a secure session has
not been established. Similarly, Microsoft Internet Explorer has
a lock symbol that appears when data is being encrypted. When this
symbol does not appear, a session is not secure.
- Click "Help" in the toolbar of your Internet browser
- Click on "About [browser name]"
- A pop-up box or window will appear.
- For Internet Explorer: next to "Cipher strength" you should see "128-bit"
- For Netscape: you should see "This version supports high-grade (128-bit) security with RSA Public Key Cryptography"
If your browser does not support 128-bit encryption, you must upgrade to continue to access the website's secure pages.
HOW ENCRYPTION WORKS
- When visiting our login page, your browser establishes a secure
session with our vendors server.
- The secure session is established using a protocol
called Secure Sockets Layer (SSL) Encryption.
This protocol requires the exchange of what are called public
and private keys.
- Keys are random numbers chosen for that session and are only
known between your browser and our server. Once keys are exchanged,
your browser will use the numbers to scramble (encrypt)
the messages sent between your browser and our vendors server.
- Both sides require the keys because they need to descramble (decrypt) messages received. The SSL protocol assures privacy, but also ensures no other website can "impersonate" our website, nor alter information sent.
ENCRYPTION LEVEL
The numbers used as encryption keys are similar to combination locks.
The strength of encryption is based on the number of possible combinations
a lock can have. The more possible combinations, the less likely
someone could guess the combination to decrypt the message.
For your protection, our servers require the browser to connect at 128-bit encryption (versus the less-secure 40-bit encryption). Users will be unable to access online investment functions at lesser encryption levels. This may require some end users to upgrade their browser to the stronger encryption level.