Bank Audit Best practices

From: Dante Mercurio (Dante_at_webcti.com)
Date: 03/17/04

  • Next message: JTH: "Pen Test Data/Report Management; Tracking/Procedure document" 
    Date: Wed, 17 Mar 2004 09:06:34 -0500
To: <pen-test@securityfocus.com>

    I'm looking for some feedback from other people who conduct security
    audits and penetration tests on banks.

    One of the network aspects I come across a lot is a direct line to their
    transaction processor. This is often in the form of a point-to-point or
    frame line that is dropped onsite with a router controlled by the
    processor, not the bank. I always point out that this is a network
    security risk, as there is no control from the bank side regarding the
    access provided through that line, and recommend an ACL or departmental
    firewall at that point.

    As always, the administrators look at me like I recommended them selling
    their firstborn. The relationship between the bank and their processor
    is very symbiotic as the bank couldn't even exist without their
    services, yet my perspective is any outside system should go through
    some level of border security in order to monitor and restrict traffic.

    Anyone run into this? How do you handle?

    M. Dante Mercurio
    dante@webcti.com
    Consulting Group Manager
    Continental Technologies, Inc
    www.webcti.com

    ---------------------------------------------------------------------------
    Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
    any course! All of our class sizes are guaranteed to be 10 students or less
    to facilitate one-on-one interaction with one of our expert instructors.
    Attend a course taught by an expert instructor with years of in-the-field
    pen testing experience in our state of the art hacking lab. Master the skills
    of an Ethical Hacker to better assess the security of your organization.
    Visit us at:
    http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    ----------------------------------------------------------------------------

  • Next message: JTH: "Pen Test Data/Report Management; Tracking/Procedure document"

    Relevant Pages

    • RE: Bank Audit Best practices
      ... Your recommendation is in tune with best practices. ... educate the decision makers on internal FW, ACLs and network segmentation ... Subject: Bank Audit Best practices ... I'm looking for some feedback from other people who conduct security ...
      (Pen-Test)
    • RE: Security and the Under 30 User
      ... ages, sexes, colors, creeds, succumb -- even the holiest of holy network ... I've been into IT security since I was 12. ... I have friends about my age that have had their bank information ... crowd's attitude towards IT security. ...
      (Security-Basics)
    • RE: Security and the Under 30 User
      ... warming people to the need for security. ... ages, sexes, colors, creeds, succumb -- even the holiest of holy network ... I have friends about my age that have had their bank information ... crowd's attitude towards IT security. ...
      (Security-Basics)
    • Online Banking: How Safe is Your Money?
      ... Online banking is suffering through a withdrawal phase. ... who bank online plan to do so less often because of security concerns. ... Web site being spoofed by a fraudulent facsimile that would trick them ...
      (comp.dcom.telecom)
    • Re: Security and the Under 30 User
      ... I've been into IT security since I was 12. ... I have friends about my age that have had their bank information ... being transmitted across the network, they still think that out of the ... crowd's attitude towards IT security. ...
      (Security-Basics)