End-to-end automated teller machine (ATM) network protection encompasses multiple security layers. Is it not enough to simply protect ATM endpoints to ensure the security of a bank’s finances. Instead, security teams at financial institutions must take a more advanced approach to ATM network protection.

ATM security has always been a hot-button issue for banking institutions because these machines are inexhaustible sources of fortune for cybercriminals. Nowadays, the problem of ATM security is even more acute. Fraudsters have become more sophisticated in their methods, and security analysts often have to protect entire ATM networks rather than individual endpoints.

Three Types of ATM Threats

There are three types of ATM security threats, each with a different target:

1. Physical threats to ATM hardware, the earliest and most straightforward ATM threat;
2. Skimming, a fraudulent technology designed to steal customers’ ATM cards to access finances; and
3. Threats to ATM network software, which target the entire ATM network to get money through the network’s unsolicited administration.

Let’s take a closer look at threats to ATM network software. Such attacks can be qualified as advanced persistent threats (APTs) because the perpetrators employ sustained intrusion techniques that require sophisticated engineering.

First, the attackers breach the bank’s network to gain access to the ATM controlling server, which leads them to individual endpoints. There, they deploy malware with modified code. The code allows them to control internal ATM commands, such as triggering a cassette receiver or a cash dispenser. In fact, this is how cybercriminals create botnets: The ATM controlling server becomes a command-and-control (C&C) server that instructs multiple infected endpoints to dispense cash when one threat actor sends a signal from a particular ATM.

A Basic ATM Network Protection Strategy

An ATM network is no different from any other network: It consists of ATM servers (endpoints), one or more controlling servers and network appliances. Standard network protection practices are valid. To detect unsolicited ATM network access, bank security specialists should follow best practices, including:

• Installing a perimeter firewall to ensure a secure connection between the bank’s network infrastructure and the internet;
• Installing an intrusion prevention system (IPS) and intrusion detection system (IDS);
• Installing antivirus software on all devices in the network;
• Placing the ATM network into a demilitarized zone (DMZ) to isolate the controlling server and endpoints from the bank’s local network; and
• Personalizing access to the ATM network to narrow the scope of people entitled to access the controlling server. Each user account registered on an endpoint must be personalized to make bank security specialists aware of who is behind them. Avoid default logins such as admin and user.

An Advanced Approach to ATM Security

Security specialists who choose an advanced protection strategy should address all threat types using a security information and event management (SIEM) solution. SIEM systems detect security offenses based on correlation rules. If not properly fine-tuned, however, these rules can cause problems that allow threats to slip through the cracks.

Antiskimming correlation rules help identify the consequences of using illegitimate bank card copies. They can determine whether the same card was used in different locations within a short period of time, for example. This way, an SIEM system can give an early warning to help analysts detect improper cash withdrawal from a bank account.

The SIEM system should receive audit logs from all the ATM endpoints and a controlling server for further analysis. The correlation rules allow analysts to monitor all entries into the network, launching of unsolicited services, software integrity, antivirus feeds, and DMZ router logs and flows.

Security specialists need to build four successive correlation rule categories in the SIEM system for detecting:

• Privileged user access. These rules monitor every privileged access to endpoints because it may change ATM configurations or inflict harm to the network.
• Unsolicited software installation and execution. This set of rules monitors privileged users’ attempts to install and execute the unauthorized software. Every divergence from the software installation standard is a sign of an APT.
• Integrity and access software breaches. Such rules monitor digital signature validation in software components. Changes in digital signatures indicate a software integrity breach. These rules also detect instances of unauthorized access to ATM network via nonstandard communication exploits between software components.
• Connection loss. This category detects the cases of sudden connection loss with ATM endpoints, which may indicate that someone switched it off.

All four of these correlation rule categories can be created in the IBM QRadar SIEM system. Each category contains a number of rules that cover specific security requirements.

Covering All the Bases

The days when ATM network protection meant simply installing closed-circuit television cameras are long gone. Today, end-to-end protection comes down to covering all the threat types through both basic and advanced tactics, which are devised and implemented in collaboration with proficient information security consultants.

Discover how IBM solutions help detect, enforce, investigate and remediate fraud