RE: Bank Audit Best practices

["Keith Pachulski" <keithp () corp ptd net>]

Hey Dante

I have run into this on numerous occasions while doing some consulting and have always with 100% failure caused them to 
realize the potential threat of this design. In their eyes this is critical to their operations and any flaws in the 
communications between the bank and this transaction processor would severly impact their operations or cause their 
operation to cease. Even so, while I fail with this I still continue to preach this to those same customers as well as 
new financial customers I take on. This is going to fall into that bag of they won`t realize the impact until something 
occurs sourcing from the trasaction processor causing their operations harm that something will be done.

Good Luck..

-----Original Message-----
From: Dante Mercurio [mailto:Dante () webcti com]
Sent: Wednesday, March 17, 2004 9:07 AM
To: pen-test () securityfocus com
Subject: Bank Audit Best practices


I'm looking for some feedback from other people who conduct security
audits and penetration tests on banks. 

One of the network aspects I come across a lot is a direct line to their
transaction processor. This is often in the form of a point-to-point or
frame line that is dropped onsite with a router controlled by the
processor, not the bank. I always point out that this is a network
security risk, as there is no control from the bank side regarding the
access provided through that line, and recommend an ACL or departmental
firewall at that point.

As always, the administrators look at me like I recommended them selling
their firstborn. The relationship between the bank and their processor
is very symbiotic as the bank couldn't even exist without their
services, yet my perspective is any outside system should go through
some level of border security in order to monitor and restrict traffic.

Anyone run into this? How do you handle?

M. Dante Mercurio
dante () webcti com
Consulting Group Manager
Continental Technologies, Inc
www.webcti.com

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------


---------------------------------------------------------------------------
You're a pen tester, but is google.com still your R&D team?
Now you can get trustworthy commercial-grade exploits and the latest
techniques from a world-class research group.
www.coresecurity.com/promos/sf_ept1
----------------------------------------------------------------------------