RE: Bank Audit Best practices

From: Michael Bitow (mbitow_at_GuardianCapital.com)
Date: 03/18/04

  • Next message: scheyne_at_att.net: "Re: how to alert company of security hole" 
    Date: Thu, 18 Mar 2004 15:25:18 -0500
To: <pen-test@securityfocus.com>

     I was the network administrator for a small community bank for a few
    years and saw this same problem. Everything was already set up when I
    came in, so I had to do a little adjusting. What I did was build an ACL
    rule set for the route interface that went to the processor that denied
    any inbound traffic from them, while allowing the necessary outbound for
    us. Essentially a basic firewall rule set. Pretty basic but effective
    in keeping any wandering traffic from other banks from bothering us, as
    well as for the most part preventing that as an avenue of attack if
    another bank on the processor's network became compromised (as well as
    the processor).

     If you wanted, you could build a DMZ off an existing firewall,
    depending on how the bank's network is set up.

     For fun, use a network mapping util and find out how many banks on the
    processors network you can map out :) If it's the same processor we
    used, I bet you find several.

    > -----Original Message-----
    > From: Dante Mercurio [mailto:Dante@webcti.com]
    > Sent: Wednesday, March 17, 2004 9:07 AM
    > To: pen-test@securityfocus.com
    > Subject: Bank Audit Best practices
    >
    >
    > I'm looking for some feedback from other people who conduct security
    > audits and penetration tests on banks.
    >
    > One of the network aspects I come across a lot is a direct
    > line to their
    > transaction processor. This is often in the form of a
    > point-to-point or
    > frame line that is dropped onsite with a router controlled by the
    > processor, not the bank. I always point out that this is a network
    > security risk, as there is no control from the bank side regarding the
    > access provided through that line, and recommend an ACL or
    > departmental
    > firewall at that point.
    >
    > As always, the administrators look at me like I recommended
    > them selling
    > their firstborn. The relationship between the bank and their processor
    > is very symbiotic as the bank couldn't even exist without their
    > services, yet my perspective is any outside system should go through
    > some level of border security in order to monitor and
    > restrict traffic.
    >
    > Anyone run into this? How do you handle?
    >
    > M. Dante Mercurio
    > dante@webcti.com
    > Consulting Group Manager
    > Continental Technologies, Inc
    > www.webcti.com
    >
    > --------------------------------------------------------------
    > -------------
    > Ethical Hacking at the InfoSec Institute. Mention this ad and
    > get $545 off
    > any course! All of our class sizes are guaranteed to be 10
    > students or less
    > to facilitate one-on-one interaction with one of our expert
    > instructors.
    > Attend a course taught by an expert instructor with years of
    > in-the-field
    > pen testing experience in our state of the art hacking lab.
    > Master the skills
    > of an Ethical Hacker to better assess the security of your
    > organization.
    > Visit us at:
    > http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    > --------------------------------------------------------------
    > --------------
    >
    >

    ---------------------------------------------------------------------------
    Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
    any course! All of our class sizes are guaranteed to be 10 students or less
    to facilitate one-on-one interaction with one of our expert instructors.
    Attend a course taught by an expert instructor with years of in-the-field
    pen testing experience in our state of the art hacking lab. Master the skills
    of an Ethical Hacker to better assess the security of your organization.
    Visit us at:
    http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    ----------------------------------------------------------------------------

  • Next message: scheyne_at_att.net: "Re: how to alert company of security hole"

    Relevant Pages

    • RE: Security and the Under 30 User
      ... ages, sexes, colors, creeds, succumb -- even the holiest of holy network ... I've been into IT security since I was 12. ... I have friends about my age that have had their bank information ... crowd's attitude towards IT security. ...
      (Security-Basics)
    • RE: Security and the Under 30 User
      ... warming people to the need for security. ... ages, sexes, colors, creeds, succumb -- even the holiest of holy network ... I have friends about my age that have had their bank information ... crowd's attitude towards IT security. ...
      (Security-Basics)
    • Re: Security and the Under 30 User
      ... I've been into IT security since I was 12. ... I have friends about my age that have had their bank information ... being transmitted across the network, they still think that out of the ... crowd's attitude towards IT security. ...
      (Security-Basics)
    • Re: Premium Messaging Service Received
      ... services on a web site - about which the network knows nothing. ... they are reliant on the provider of the service being ... incoming texts unless they have some sort of proof that the customer ... Imagine if your bank account worked the same way - I ...
      (uk.telecom.mobile)
    • RE: Bank Audit Best practices
      ... Your recommendation is in tune with best practices. ... educate the decision makers on internal FW, ACLs and network segmentation ... Subject: Bank Audit Best practices ... I'm looking for some feedback from other people who conduct security ...
      (Pen-Test)