Author Topic: ATM Network Security: Best Approach To Prevent Transaction & Card Data Breaches  (Read 245 times)


  • Moderator
  • Newbie
  • *****
  • Posts: 3
Protection of Automated Teller Machine (ATM) network end-to-end requires layered approach to security (i.e. implementing security at various levels or layers of the ATM endpoints, physical and logical network). While it is imperative to invest significantly in physically protecting the ATMs from burglary attacks and cash theft, the risk and impact of security compromise or breach of the ATM network is more severe and damaging than physical cash theft, which will be limited to the amount of cash available at the ATM as at the time of the attack. As such, it is important to adequately protect the ATM network rather than the individual ATM endpoints.

ATM security has remained a burning issue for banking institutions due to the interest and attraction of the ATMs to cybercriminals and fraudsters who continually feed on them by devising means and new ways of compromising security controls implemented around the ATMs for their continued survival. To remain afloat, fraudsters have become more sophisticated in their methods and ways of attacks while Security Analysts continue to play catch up to the cybercriminals to mitigate the risk and impact of attacks on the bank's brand and bottom-line. This requires a more holistic approach to ATM security where controls are implemented at ATM network level to protect the generality of the ATMs rather than pay more attention to the individual endpoints.

ATMs have continued to face these persistent threat to its operation, which are:

  • Threat to the ATM software targeting the entire ATM network, where attempts are made to compromise the ATM software at the network level to impair in its operations for purpose of cash theft via unsolicited remote administration of the machines.
  • Skimming: a malicious/fraudulent technology designed to steal or harvest ATM card data from unsuspecting cardholders, which are then used to steal money from their bank accounts. The skimming devices are physically installed at the ATMs in a manner that unsuspecting cardholders unknowingly swipe their cards through the skimming device, which collects their card information for use by the criminals.
  • Physical threat to the ATMs where criminals physically attacks the ATMs with the sole purpose of stealing physical cash loaded in the machines. This most times lead to physical damage of the machine or the use of stolen ATM physical keys or safe key combinations to gain unauthorized access to the machines.

The first threat (i.e. ATM software compromise) is an advance persistent threat (APT) where the cybercriminals employ various intrusion techniques to compromise the ATM controlling server that controls the workings of the ATMs. This require the attackers to first break into the bank's network, and then the ATM controller server, which eventually lead them to the individual ATM endpoints. They could easily install malicious codes (malware), which allows them to control the internal functions and commands of the ATMs. As such, they could easily change the command structure and configurations of the ATMs that affects the physical accessories of the machine. By doing so, cash could easily be dispensed to the criminals at specific ATM endpoints and locations within specific period by tinkering with the ATM cash dispense commands, which instructs the machine to dispense cash or altering the cassette configuration for currency denominations to influence the amount and number of notes the ATM dispense in favour of the criminals.

Fundamental ATM Network Protection Approach
Just like any other network of information assets, the ATM network consists of basic network devices such as switches, routers, ATM endpoints, ATM Controlling servers, communication link, etc. To detect and forestall unsolicited network access to the ATM network and controlling server, the bank must implement the following layered security controls to protect the ATM endpoints from compromise.

  • Put all ATMs in a Dedicated Domain: By aggregating all ATM endpoints/terminal in a dedicated domain, specific domain policy that will ensure protection of the machines end-to-end will be implemented without interfering with the default group policy of the bank's network where the ATM is in the same domain network as the organization. There could be group policy objects (GPO) implemented at the organization's enterprise domain, which might be detrimental or impair on the smooth workings/operation of the ATMs. Where the organization's primary domain network is too large and diverged, it might be difficult for domain group policies to easily reach/replicate to the ATM endpoints across the network given their physical locations and associated link/bandwidth challenges. As such, implementing a dedicated domain for ATMs only will ensure easy administration and dispatch of relevant policies that are specific to ATMs for overall security and optimization of the ATMs. Also, deployment of ATM specific patches and upgrades will be easily managed and controlled given that the ATMs are within the same domain network, which promotes interoperability. For details of domain controller/active directory baseline security configuration, visit or
  • Use of Virtual Private Network (VPN) for Offsite ATMs: Here, VPN is used to tunnel traffic from offsite ATMs (i.e. ATMs that are not located within the bank's premises and not directly connected to the bank's network. To ensure security of the traffic originating from offsite ATMs and to prevent interception of signals, a tunnelled VPN connection is used to route ATM transactions from the offsite location (e.g. Shopping malls, hospitals, public buildings, airport, train station, gas station, etc.) to the bank's data center via an internet service provider (ISP). This is to ensure that ATM transactions (i.e. traffic) are not intercepted for malicious use. A router at the offsite location with specific configuration can be used to achieve this. For details of VPN and ATM router baseline security configuration, visit
  • Perimeter Firewall: Installing perimeter firewall (a.k.a. frontend firewall) to separate the bank's network from the internet and prevent uncontrolled flow of internet traffic in and out of the bank's network. This is the first point of defense for the bank's network from malicious attacks from the internet. For details of baseline security hardening/configuration of perimeter firewall, visit
  • IPS/IDS: Install intrusion prevent system (IPS) and intrusion detection system (IDS) to proactively prevent and detect intrusions into the network for prompt action.
  • Place the ATM network in the Demilitarized zone (DMZ) section of the Enterprise Network: The DMZ is a section of the network just behind the perimeter/frontend firewall. This is to ensure that ATM traffic coming from offsite locations, which passes through the internet via tunnel VPN are first allowed on the perimeter firewall before hitting the ATMs. The ATM network can still be further protected using a firewalls within the DMZ to further isolate them from the DMZ area were other third party application web servers, internet facing servers/applications and vendor/trusted party applications are situated. ATMs located within the bank's branch network are aggregated via the wide area network (WAN) router to the ATM network.
  • Vulnerability Management and Data Loss Prevention (DLP): Here, vulnerabilities are managed within the ATM network by installing anti-virus and anti-spyware software such as Symantec Norton in all endpoints within the network, including ATMs, servers and workstations. This way, threats such as viruses, Trojan horses and other forms of malware will be arrested and prevented from reaching endpoints or spreading on the network. Also, loss and theft of data via the ATM endpoints through USB devices, or remote control software (e.g. dameware, teamviewer, remote VNC, etc.) will easily be arrested using DLP tools like Symantec Norton. Also, patch deployment across all endpoints will be easily managed and coordinated centrally to ensure update of all endpoints.

Best Innovative Approach To ATM Security That Will Prevent Data Breaches within the ATM Network
The best innovative approach to ATM security is online real-time monitoring of the ATM network and endpoints using security information and event management (SIEM) solution such as Arcsight ( and file integrity monitoring (FIM) solutions such as Tripwire or Cimtrack. This approach will largely address virtually all types of threats to the ATM. SIEM solution detect security breaches based on correlation rules written by SIEM Analysts to match security events to active rules and filters defined in the solution. However, false positive triggers could occur where rules/filters are not properly defined and fine-tuned to match specific events of interest, which could be misleading or result to slip of qualifying security events.

With the capability of detecting ATM card details that have been used in different locations (e.g. 10 km distances) within the shortest period of time (e.g. 5 minutes), which is practically almost impossible to achieve, the SIEM solution comes handy in detecting skimmed cards using anti-skimming correlation rules. Hence, giving the SIEM Analysts early warning signal of potential card breaches and unauthorized cash withdrawals from customers' bank accounts.

The SIEM solution receives audit/event logs of all ATM endpoints and controlling server into its CORE engine and converted for further analysis by Arcsight using relevant smart connectors that are capable of reading in ATM event logs. Entries into the network, installation and launching of unsolicited software/services/protocols, antivirus logs, syslog server consolidating logs of network devices are monitored by the Analysts using correlation rules in the SIEM.

Some of the correlation rules that SIEM Analysts need to build into the SIEM for effective monitoring and detection of suspicious activities within the ATM network and endpoints are not limited to the following.

  • Service Unavailability: Sudden Loss of connection or link unavailability to an ATM endpoint could mean a potential denial of service attack (DoS) or deliberate disconnection of the link to cause harm or service disruption. As such, monitoring of ATM link uptime is vital in ensuring that the ATM terminal delivers service to users. While link to an ATM terminal might be up and running, the ATM terminal might not be fulfilling service to users due to errors or malfunctioning that are local to the terminal, such as cash dispense error, cash jam, cash out, power outage, etc. It is therefore important that these other errors and glitches are monitored also for efficient running of all ATM terminals.
  • Unsolicited/unauthorized software installation and execution: Rules are set to monitor and detect attempted or successful installation of unauthorized software or service by privileged users. Detection of software not authorized for ATM endpoint operating system should be queried and escalated to management for action.
  • Integrity of ATM Software and Unauthorized Access: Rules are set to monitor digital signatures/certificates of ATM software components. Alteration is indicative of compromise of the software. Also, unauthorized access to ATM network through the use of nonstandard communication protocols or services (e.g. telnet or ftp) between software components is indicative of compromise, which should be flagged for further review.
  • Privileged user access: Rules to monitor every privileged access on all ATM endpoints is set up to detect configuration changes due to the likelihood of such users changing configurations or cause harm to the ATMs on the network.
  • Change in the Group Policy Object (GPO) of ATM domain network: Rules are set up to monitor and detect changes in the group policy of the ATM domain network. Of course, the audit GPO change log must first be activated in the default group policy setting of the ATM domain controller/active directory to ensure capture of these log on the SIEM solution.
  • Monitor specific configuration files of interest in the ATM network or endpoint using FIM solution: Specific files of interest can be further monitoring using FIM solution such as Tripwire or Cimtrack to detect changes to the files that could have adverse impact on the functioning of the ATM terminal and other network devices. FIM logs can always be imported/added to SIEM solution for active correlation to make sense of it.

Nwabueze Ohia
Tech Blogger and Self Publishing Author

Will appreciate your questions, comments and contributions to this post. For sponsorship, speaking opportunity and training bookings, please Contact US at  >>> or Send us an email at Remember that you need to first register and become a forum member before you can post a comment.
« Last Edit: March 13, 2018, 12:28:32 PM by Dera24c »