From: Clint Bodungen (clint@secureconsulting.com)
Date: Thu Mar 18 2004 - 18:16:16 EST
That's interesting... I used to head up the IT Security Dept. of one
state-wide bank and consult for a few other National banks and my experience
has been different. They were all set up to have the dataprocessing company
still fall under the holding company so that they are all the same
company... in a sense... but in seperate geographical locations. So, it
could still theoretically still fit into your scenario I think. However,
online transactions were another story. Internet banking was always
outsourced to a 3rd party. The main processing ran over private frame so
that was not a problem. The problem was the Internet banking and the lease
lines that the ATM's ran over. Eventually, we had to take internet banking
"in house" because there *was no security compliant way to handle it. We
were still battling the ATM communication issues when I left. I can give
your more details in an off-line discussion.
>Wednesday, March 17, 2004 8:06 AM
>I'm looking for some feedback from other people who conduct security
>audits and penetration tests on banks.
>One of the network aspects I come across a lot is a direct line to their
>transaction processor. This is often in the form of a point-to-point or
>frame line that is dropped onsite with a router controlled by the
>processor, not the bank. I always point out that this is a network
>security risk, as there is no control from the bank side regarding the
>access provided through that line, and recommend an ACL or departmental
>firewall at that point.
>As always, the administrators look at me like I recommended them selling
>their firstborn. The relationship between the bank and their processor
>is very symbiotic as the bank couldn't even exist without their
>services, yet my perspective is any outside system should go through
>some level of border security in order to monitor and restrict traffic.
>Anyone run into this? How do you handle?
---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:50 EDT