Re: Bank Audit Best practices

["wirepair" <wirepair () roguemail net>]

I've run into it a lot, and I have the same concerns you do. Core Processors *should* be restricted
especially if they do not provide any type of reports of their own internal security audits.
Usually we ask the client to see if the core processor has done any assessments and if so give the
client (the bank) the report, or at least parts of it. Usually the processor really only needs access
to the teller machines and any other hosts doing general ledger. (I usually see this just
being an FTP server.) Other than those hosts, I do not see any need for the processor to have any extended
access. The client needs to identify what hosts/servers require this access and by either firewalling
or strict ACL's (VLAN's are good) limit the access given. This really shouldn't be a problem as the Core Processor 
shouldn't
ever notice these changes.
-wire

 
On Wed, 17 Mar 2004 09:06:34 -0500
 "Dante Mercurio" <Dante () webcti com> wrote:
> I'm looking for some feedback from other people who conduct security
> audits and penetration tests on banks. 
>
> One of the network aspects I come across a lot is a direct line to their
> transaction processor. This is often in the form of a point-to-point or
> frame line that is dropped onsite with a router controlled by the
> processor, not the bank. I always point out that this is a network
> security risk, as there is no control from the bank side regarding the
> access provided through that line, and recommend an ACL or departmental
> firewall at that point.
>
> As always, the administrators look at me like I recommended them selling
> their firstborn. The relationship between the bank and their processor
> is very symbiotic as the bank couldn't even exist without their
> services, yet my perspective is any outside system should go through
> some level of border security in order to monitor and restrict traffic.
>
> Anyone run into this? How do you handle?
>
> M. Dante Mercurio
> dante () webcti com
> Consulting Group Manager
> Continental Technologies, Inc
> www.webcti.com
>
> ---------------------------------------------------------------------------
> Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
> any course! All of our class sizes are guaranteed to be 10 students or less
> to facilitate one-on-one interaction with one of our expert instructors.
> Attend a course taught by an expert instructor with years of in-the-field
> pen testing experience in our state of the art hacking lab. Master the skills
> of an Ethical Hacker to better assess the security of your organization.
> Visit us at:
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> ----------------------------------------------------------------------------

--
Visit Things From Another World for the best
comics, movies, toys, collectibles and more.
http://www.tfaw.com/?qt=wmf

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------