End-to-end automated teller machine (ATM) network protection encompasses multiple security layers. Is it not enough to simply protect ATM endpoints to ensure the security of a bank’s finances. Instead, security teams at financial institutions must take a more advanced approach to ATM network protection.

ATM security has always been a hot-button issue for banking institutions because these machines are inexhaustible sources of fortune for cybercriminals. Nowadays, the problem of ATM security is even more acute. Fraudsters have become more sophisticated in their methods, and security analysts often have to protect entire ATM networks rather than individual endpoints.

Three Types of ATM Threats

There are three types of ATM security threats, each with a different target:

  1. Physical threats to ATM hardware, the earliest and most straightforward ATM threat;
  2. Skimming, a fraudulent technology designed to steal customers’ ATM cards to access finances; and
  3. Threats to ATM network software, which target the entire ATM network to get money through the network’s unsolicited administration.

Let’s take a closer look at threats to ATM network software. Such attacks can be qualified as advanced persistent threats (APTs) because the perpetrators employ sustained intrusion techniques that require sophisticated engineering.

First, the attackers breach the bank’s network to gain access to the ATM controlling server, which leads them to individual endpoints. There, they deploy malware with modified code. The code allows them to control internal ATM commands, such as triggering a cassette receiver or a cash dispenser. In fact, this is how cybercriminals create botnets: The ATM controlling server becomes a command-and-control (C&C) server that instructs multiple infected endpoints to dispense cash when one threat actor sends a signal from a particular ATM.

A Basic ATM Network Protection Strategy

An ATM network is no different from any other network: It consists of ATM servers (endpoints), one or more controlling servers and network appliances. Standard network protection practices are valid. To detect unsolicited ATM network access, bank security specialists should follow best practices, including:

  • Installing a perimeter firewall to ensure a secure connection between the bank’s network infrastructure and the internet;
  • Installing an intrusion prevention system (IPS) and intrusion detection system (IDS);
  • Installing antivirus software on all devices in the network;
  • Placing the ATM network into a demilitarized zone (DMZ) to isolate the controlling server and endpoints from the bank’s local network; and
  • Personalizing access to the ATM network to narrow the scope of people entitled to access the controlling server. Each user account registered on an endpoint must be personalized to make bank security specialists aware of who is behind them. Avoid default logins such as admin and user.

An Advanced Approach to ATM Security

Security specialists who choose an advanced protection strategy should address all threat types using a security information and event management (SIEM) solution. SIEM systems detect security offenses based on correlation rules. If not properly fine-tuned, however, these rules can cause problems that allow threats to slip through the cracks.

Antiskimming correlation rules help identify the consequences of using illegitimate bank card copies. They can determine whether the same card was used in different locations within a short period of time, for example. This way, an SIEM system can give an early warning to help analysts detect improper cash withdrawal from a bank account.

The SIEM system should receive audit logs from all the ATM endpoints and a controlling server for further analysis. The correlation rules allow analysts to monitor all entries into the network, launching of unsolicited services, software integrity, antivirus feeds, and DMZ router logs and flows.

Security specialists need to build four successive correlation rule categories in the SIEM system for detecting:

  • Privileged user access. These rules monitor every privileged access to endpoints because it may change ATM configurations or inflict harm to the network.
  • Unsolicited software installation and execution. This set of rules monitors privileged users’ attempts to install and execute the unauthorized software. Every divergence from the software installation standard is a sign of an APT.
  • Integrity and access software breaches. Such rules monitor digital signature validation in software components. Changes in digital signatures indicate a software integrity breach. These rules also detect instances of unauthorized access to ATM network via nonstandard communication exploits between software components.
  • Connection loss. This category detects the cases of sudden connection loss with ATM endpoints, which may indicate that someone switched it off.

All four of these correlation rule categories can be created in the IBM QRadar SIEM system. Each category contains a number of rules that cover specific security requirements.

Covering All the Bases

The days when ATM network protection meant simply installing closed-circuit television cameras are long gone. Today, end-to-end protection comes down to covering all the threat types through both basic and advanced tactics, which are devised and implemented in collaboration with proficient information security consultants.

Discover how IBM solutions help detect, enforce, investigate and remediate fraud

More from Intelligence & Analytics

The 13 Costliest Cyberattacks of 2022: Looking Back

2022 has shaped up to be a pricey year for victims of cyberattacks. Cyberattacks continue to target critical infrastructures such as health systems, small government agencies and educational institutions. Ransomware remains a popular attack method for large and small targets alike. While organizations may choose not to disclose the costs associated with a cyberattack, the loss of consumer trust will always be a risk after any significant attack. Let’s look at the 13 costliest cyberattacks of the past year and…

What Can We Learn From Recent Cyber History?

The Center for Strategic and International Studies compiled a list of significant cyber incidents dating back to 2003. Compiling attacks on government agencies, defense and high-tech companies or economic crimes with losses of more than a million dollars, this list reveals broader trends in cybersecurity for the past two decades. And, of course, there are the headline breaches and supply chain attacks to consider. Over recent years, what lessons can we learn from our recent history — and what projections…

When Logs Are Out, Enhanced Analytics Stay In

I was talking to an analyst firm the other day. They told me that a lot of organizations purchase a security information and event management (SIEM) solution and then “place it on the shelf.” “Why would they do that?” I asked. I spent the majority of my career in hardware — enterprise hardware, cloud hardware, and just recently made the jump to security software, hence my question. “Because SIEMs are hard to use. A SIEM purchase is just a checked…

4 Most Common Cyberattack Patterns from 2022

As 2022 comes to an end, cybersecurity teams globally are taking the opportunity to reflect on the past 12 months and draw whatever conclusions and insights they can about the threat landscape. It has been a challenging year for security teams. A major conflict in Europe, a persistently remote workforce and a series of large-scale cyberattacks have all but guaranteed that 2022 was far from uneventful. In this article, we’ll round up some of the most common cyberattack patterns we…