Securing ATMs against Physical and IT Risks

ATM security incidents are on the rise worldwide and one of the most recent victims was the Indian Cosmos cooperative Bank falling for a cash-out Malware Attack. The ATMs in the Indian Ocean Islands (IOI) have also not been spared over the past years.

The IOI economies are still reliant on cash, and for the past 30 years ATMs of the IOI have been used predominantly to dispense cash. More recently, with the introduction of self-service automated solutions, there has been a constant increase in envelope-free deposits. 

ATMs are easy cash targets for criminals. ATM security incidents may deter consumers using this popular channel. By implementing effective security measures banks will maintain the safety perception around ATMs and make customers feel safer when using them.

The most common attacks on ATMs are:

• Identity Thefts: Stealing information used by customers to identify themselves through card skimming, eavesdropping and network sniffing.
• Physical Attacks: Physically breaching the safe of the ATM where the cash is stored.
• Logical Attacks: Stealing cash from the ATM by using techniques such as malware in the network or the ATM and black box attack.

To maintain and increase customers’ trust in the ATM channel, BIRGER. the leading ATM service provider in the IOI recommends the following five steps:

1. Raise the Security Awareness: Raising the level of security awareness within the banks through training will reduce the risk of ATM attacks and subsequent losses. For example, conducting regular inspections of the ATM location and the ATM hardware to identify any abnormal activities.
 
2. Secure the Physical Location: A complete set of physical security measures should be considered while deploying ATMs. Deploying ATMs in bank lobbies or off-site with security cameras and security guards will deter criminals from targeting these ATMs and enhance the perception of security. Other measures that can be taken are access controls for service staff and intrusion detection with alarms to notify when the ATM has been tampered.
 
3. Secure the ATM Hardware: Install anti-skimming solutions on the ATM such as NCR's Skimming Protection Solution (or SPS), which has the ability to detect and disable the attack and notify the ATM operator in real time. Locking the top box is required because it is the most vulnerable part of the ATM where the main board and the dispenser connections are located.  The ATM network should be secured and encrypted. Last but not least, the cash should be physically secured against explosions, safe cutting and the ATM should be bolted down against physical removal.
 
4. Secure and Update the ATM Software: Ensure your ATM runs on up-to-date software versions, including the operating system, XFS, and ATM software. Up to date software and security patches will protect the ATM from unauthorized downloads of malware and skimming software. Hard Disk Encryption will protect the ATM from software modifications initiated by external boot attacks. Encrypting the communication channel will protect the network against Malware Attacks. Further protection can be achieved by deploying a whitelisting solution such as NCR Solidcore Suite for APTRA. Securing the BIOS with a complex password and allowing the ATM to boot only from the Hard Drive will add another layer of security. 
 
5. Remote ATM Monitoring and Management: Remote ATM Monitoring and Management will enable banks to manage their ATMs in real time. ATM Monitoring and Management software will scan unusual transactions on all ATMs and sends alerts when suspicious activity is recorded. Monitoring should also cover the network for unusual transactions.
 
BIRGER.'s Cyber Defence Centre provides 24/7 Managed Security Services in all 5 territories of the IOI where we provide ATM services.
 
Since 1988, BIRGER. has deployed complete ATM solutions in the IOI, providing our customers with optimal uptime through our local certified teams. ATMs will continue to be an important channel for banks in the future. ATM use will increase with the introduction of new Interactive ATMs such as NCR's Interactive Teller Machines (or ITM), which will migrate banking activities away from tellers to the ITMs. Banks should ensure a secure and seamless ATM experience for its customers, which will optimize the use of their ATM network.
 
For more information on the topic and our Technology Solutions & Services, please contact us by mail technology@birger.technology.

BIRGER.