{"id":69947,"date":"2022-04-28T11:03:26","date_gmt":"2022-04-28T09:03:26","guid":{"rendered":"https:\/\/www.aurigaspa.com\/?p=69947"},"modified":"2023-03-15T09:01:36","modified_gmt":"2023-03-15T08:01:36","slug":"putting-zero-trust-into-self-service-banking-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.aurigaspa.com\/en\/news-and-media\/blog-eng\/putting-zero-trust-into-self-service-banking-cybersecurity\/","title":{"rendered":"Putting Zero Trust into Self Service Banking Cybersecurity"},"content":{"rendered":"

This month, European banks received a renewed warning<\/a> about increased cyber threats from a top authority.<\/p>\n

Cybersecurity hasn\u2019t been off the agenda for banks for many years now but the fears are even greater than before. There is an obvious business model <\/strong>for cybercriminal gangs to target banking services and especially ATMs \u2013 steal money and valuable financial information about customers and cause business continuity disruption and service interruptions. Attacks on financial institutions can generate serious cash returns and encourage cyber criminals to invest serious internal budgets into R&D to prepare attacks.<\/p>\n

New risks for banking security <\/strong><\/h2>\n

As banks have even greater focus on digitalisation<\/strong> there is a need to continually review cybersecurity strategies <\/strong>especially at a time of increased risks and threats.<\/p>\n

There should be a particular concern about the rise in ransomware attacks<\/strong> that shut down critical systems, extort massive sums and lead to damaging data theft. One recent study by cyber security experts at Palo Alto Networks Unit 42 revealed the average ransom demand on cases they saw climbed 144% to $2.2 million, while the average payment rose 78% percent to $541,010.<\/p>\n

Banks have tended to be prime targets for ransomware attack, For example, last year Trend Micro<\/a> reported that the banking industry was disproportionately affected with a 1,318% year-on-year increase in ransomware attacks in the first half of 2021.<\/p>\n

Banks can reduce the likelihood of attacks and mitigate the damage caused if they consider how cybersecurity goes hand in hand with their digital transformation programmes especially on the deployment of even the most advanced ATMs <\/strong>and assisted self-service terminals (ASSTs)<\/strong> now being used in next generation branches<\/a> and digital banking hubs.<\/p>\n

In their cybersecurity planning, banks also need to consider how new ways of both working and banking affect the balance of risks. While the lockdowns are ending, hybrid working patterns<\/strong> remain and include banking staff who aren\u2019t always working out of their branch or office. Security leaders need to be considering whether employees working from home are inadvertently creating security vulnerabilities<\/strong>.<\/p>\n

Similarly, the steep rise in customers doing online banking<\/strong> brings risks when so many of them who are new to digital banking services can be more susceptible to online scams or phishing attacks<\/strong> that could lead to serious breaches.<\/p>\n

Fundamentally the goal has to include reducing the attack surface and having a greater visibility of what is happening and faster insight into anomalous activities that could be or are suspicious.<\/p>\n

Zero trust approach to Self Service banking security <\/strong><\/h2>\n

For banks, their endpoint devices<\/strong> ranging from workstations to ATMs to ASSTs are vulnerable to attack and a starting point for their cybersecurity review. The approach that is increasingly discussed is zero trust<\/strong> and this can be relevant to securing critical endpoints and the other parts of the banking service infrastructure.<\/p>\n

First of all a quick definition. Zero trust means a cybersecurity system<\/strong> that minimises the level of implicit trust<\/strong> so that a system is only used and accessing software when stringent checks are done. This important concept can be successfully applied to ATMs <\/strong>and ASSTs<\/strong> as they comprise\u00a0several software layers including an operating system, hardware vendor software layer, the multi-vendor layer,\u00a0plus the different tools for operations, monitoring, security and so on.<\/p>\n

The risks with these layers is how, unlike PCs, the software updating on these devices tends to be reactive not proactive. This means vulnerabilities can slip into software inadvertently, making the concept of zero trust critical in isolating a layer that\u2019s unpatched.<\/p>\n

The value of zero trust to securing digital self-service banking is you are not trusting the assumed security of mainstream software. This distrust is important because cyber attackers will hijack legitimate tools and software to launch an attack.<\/p>\n

Additionally a zero trust strategy for banking endpoints should extend to the third party tools<\/strong> and services who have legitimate access to ATMs and ASSTs when servicing these devices. Again you need cybersecurity that interrogates whether their access at a specific time or place is correct or authorised.<\/p>\n

To help you apply a modern approach to protecting fleets of ATMs and ASSTs, here\u2019s a useful checklist:<\/p>\n