Improve ATM Security and protect cyber crime

Introduction:

ATM or Automated Teller Machine complies the customer need by identifying the signature of authorized user which is maintained from the central server. The request of cash withdraw sent to the server and verifying the PIN (Personal Identification Number) of the user, server response to the valid request sent by the customer.

There are two basic types of ATMs:

• The basic ATM units allow customers to withdraw cash and receive receipts of only their account balances.

• The more complex ATM machines accept deposits, enable line-of-credit payments and report account information. To access the innovative features of these complex units, a user will have to be an account holder at the bank that runs the ATM machine.

ATM Security Mechanism:

ATMs are mostly owned by credit unions and banks. However, it is also possible for businesses and individuals to lease or buy ATMs, through an ATM franchise or on their own. When ATMs are owned by individuals or small businesses such as gas stations or restaurants, the profit model is centered on charging fees to the machine’s users.

ATM Security Mechanism depends on two vital security measures.

1. Logical security measures

2. Physical security measures

Logical security measures:

Network plays a vital role in the working of ATMs from the time when a customer swipes a card, enters the PIN and details are then sent to the RDBMS for validation. Usually, attackers intercept this information to execute logical frauds. The following logical security measures can help avert such incidents:

• Firewalls

• Encryption technologies

• Fraud detection system

• Protection of communication

• Logical access control

• Effective tracking and monitoring system

Physical security measures:

Physical ATM security is vital in cases where cipher keys exist in terminals. When there is no physical security, an abuser will be able to probe for a key or substitute its value. To avoid such exploitations, banks should be keen on preserving the integrity of non-secret parameters and also the privacy of secret parameters. ATM security should thus focus on protecting ATMs from physical attacks. Modern ATM security focuses on rejecting access to money inside the machine to a thief, by employing techniques like smoke canisters and dye-markers.

Other methods include:

• Security guards

• Central monitoring station

• Perimeter surveillance

• Access control

• Intrusion detection

• Tested and approved ATM enclosures

ATM Security Policy:

Logical

1. PCI DSS:

PCI-DSS is an information security standard which stands for Payment Card Industry Data Security System that provides the guideline for debit/credit/master cards provided organizations. The organizations must follow the guidelines to maintain secure payment process.

2. IDS & IPS:

Banking system is the most handsome target for skimmers, hackers and carders. The attack can occur in any moment so that to detect the real intruder in real time, Intrusion detection system must be implemented in the organization’s infrastructure as well as Intrusion prevention system can prevent the intruder in emergency cases. 

3. Antivirus/Endpoint security:

Though antiviruses are old concept to maintain the security policies but without this technology system remain more insecure, in this case, organizations should think about to install latest antivirus technologies such as Endpoint security and also should be updated on a regular basis.

4. SIEM:

Security Information and Event Management is one of the ultimate information security solutions in recent years. To analyze the logs of servers with more efficiently, SIEM must be implemented in the network infrastructure where ATM machines are connected. SIEM is a kind of one stop solution to manage the privileges of both internal and external users and monitoring the system across 24/7.

5. Internal Audit:

A regular internal audit process should be conducted in order to meet the standard of information security policy within the services. This process also helps to assess the updated condition of network and system infrastructure so that any recent vulnerability can be patched up and wipe out suspicious applications from ATM network.

6. VAPT:

Avoiding the process of Vulnerability Assessment and Penetration Testing is one of the root causes of cyber attacks in the banking system. This is a mandatory process to identify the loopholes exist in a system that may let an intruder to install malware and raise their privileges into the system. Vulnerability assessment helps to identify the security flaws in a system and by penetration testing process the exact causes of the problems can be measured.

7. Malware analysis:

According to recent cyber attacks in ATM networks clearly showed that malwares are becoming much too dangerous to manipulate the logical vulnerabilities of the system and let the attackers cloning the switch system of the ATM. In addition authentication system should be implemented in order to install any kind of application in the ATM network as well as authorization needed to complete the execution process.

8. Source code review of ATM firmwares:

Banking and financial organizations are now shifting to online payment system and developing their own application. To develop an application more securely, source code review is a better concept even before installing firmwares in ATM infrastructures. This process helps a penetration tester to test the application more precisely and also helps an auditor to simplify the complex analysis of risk management.

Physical:

1. ATM Location (Environmental design):

Hardware security must be assured before implementing the software in ATM network. The location of ATM booths must be in secured areas where the 

2. 24 hours under surveillance:

ATM booths must be under surveillance 24/7 by CCTV and dedicated persons should be responsible for monitoring the booths and they must be trained up in this sector to provide their best. 

3. Onsite validation process:

The location of ATM booths should be visited to validate the security and observe if any suspicious activities noticed and make sure that no crime occurred and ATM booths remain safe.

4. Alarming system:

Every ATM booth must have self alarming system when any intruder tried to take control over the ATM machines physically and this process will help to law enforcement agencies to take action immediately. 

5. Security Operation Center:

Implementing a SOC or Security Operation Center is one of the most essential requirements to develop an ideal secure environment and maintain the overall security operations immediately and in emergency cases. And this requirement must be complied to provide the best security services to the ATM machines and other confidential components.

Summary:

ATM fraud occurring according to the policy violation of the particular bank as well as  depending on monitoring activities executed by the organization. To resolve this issue, maintaining and updating the ATM security policy is a mandatory process which should be practiced and followed strictly. The logical security measures are becoming more concerning issue than physical security measures. 

Organizations must focused on Vulnerability Assessment and Penetration Testing (VAPT) actions and perform it in a periodic time. Banking organizations may integrate additional security measures as two step verification like OTP (One Time Password) or biometric authorization and thus it can be more secure than traditional PIN verification system.