SECURITY AND CUSTOMER EXPERIENCE IN SELF SERVICE
A brief history… NCR – Confidential - Use and Disclose Solely Pursuant to Company Instructions
NCR Confidential
NCR Confidential
friction Experience = + confusion NCR Confidential
NCR Confidential
1. Enter your account number 2. Enter your TPIN NCR Confidential
NCR Confidential
1. Insert your card 2. Enter your PIN NCR Confidential
NCR Confidential
NCR Confidential
NCR Confidential
AGAIN… NCR Confidential
AGAIN… What to do? NCR Confidential
2 Factor Authentication
THE POWER OF PRE- STAGING 20
NCR – Confidential - Use and Disclose Solely Pursuant to Company Instructions
Realized the power of prestaging long ago NCR – Confidential - Use and Disclose Solely Pursuant to Company Instructions
NCR Confidential
Checkin at Home, speed up transaction at airport NCR Confidential
NCR Confidential
BIOMETRIC AUTHENTICATION 26
We go from this… 1. Enter your account number 2. Enter your TPIN NCR Confidential
1. Enter your account number 2. Enter your TPIN My voice is my password NCR Confidential
1. Enter your account number 2. Enter your TPIN My voice is my password NCR Confidential
We go from this… 1. Insert your card 2. Enter your PIN NCR Confidential
1. Insert your national ID card 2. Scan your fingerprint NCR Confidential
We go from this… NCR Confidential
experience becomes happiness NCR Confidential
NCR Confidential
80 The Growth and Geographic Expansion of Logical Attacks since 2013 Requires URGENT Action UKUK 70 Czech Republic Norway India UK UK Dom Ireland Cyprus Black Box Rep 60 Cyprus Peru Russia Online Spain Philippines Italy Mexico Offline Dominican Republic Mexico Network Mexico 50 UK Thailand Czech Republic India Unknown Romania Germany Greece Brazil Sweden Estonia 40 Germany Brazil Italy India Russia Russia Russia Ukraine Total No of attacks USA Ukraine India 30 Poland Russia Russia Germany Brazil India Spain India Mexico 20 Hungary Romania Germ… Jordan Oman Canada Mexico Malaysia Russia Brazil 10 Russia Russia Mexico UK Dominican Republic Mexico Guatemala Mexico Mexico 0 Oct‐12 May‐13 Nov‐13 Jun‐14 Dec‐14 Jul‐15 Jan‐16 Aug‐16 Mar‐17
Logical Attacks responsible for major losses Brazil Malaysia Lost more in 1 day than in Over $19 million lost the previous year Mexico Germany Over $12 million in losses Approximately $200K in in 2013 losses United Kingdom Canada Multiple malware attack Potential losses of $300K attempts made per ATM affected NCR Confidential
Logical Attacks EMERGING NEW LOGICAL THREATS Malware Malware Black in the on the Box Network ATM NCR Confidential 39
Logical Attacks EMERGING NEW LOGICAL THREATS Malware Malware Black in the on the Box Network ATM NCR Confidential 40
Black Box Attacks Criminal gains access to the Top Box of an ATM NCR Confidential
Black Box Attacks Bypasses the ATM’s core Criminal gains access to processor and connects the Top Box of an ATM an electronic device to the cash dispenser NCR Confidential
Black Box Attacks Bypasses the ATM’s core Send unauthorized Criminal gains access to processor and connects commands to dispense the the Top Box of an ATM an electronic device to the cash from the ATM cash dispenser NCR Confidential
Black Box Attacks Encrypted Comms Core to Dispenser Bypasses the ATM’s core UL 437 Locked Cabinets Send unauthorized Criminal gains access to processor and connects commands to dispense the the Top Box of an ATM an electronic device to the cash from the ATM cash dispenser NCR Confidential
Source: http://www.lockwiki.com/index.php/UL_437 NCR Confidential 45
Logical Attacks EMERGING NEW LOGICAL THREATS Malware Malware Black in the on the Box Network ATM NCR Confidential 46
47
Logical Attacks: Malware in the Network EMERGING NEW LOGICAL THREATS Malware Malware Black TLS Encryption or VPN (end to end encryption of in the on the Box ATM traffic) Network ATM NCR Confidential 48
Logical Attacks EMERGING NEW LOGICAL THREATS Malware Malware Black in the on the Box Network ATM NCR Confidential 49
Logical Attacks ATTACK CATEGORIES – Malware on the ATM ATM Hard Disk ATM Hard Disk Malware on the ATM OFFLINE ONLINE NCR Confidential 50
Logical Attacks ATTACK CATEGORIES – Malware on the ATM ATM Hard Disk ATM Hard Disk Malware on the ATM OFFLINE ONLINE NCR Confidential 51
Lockdown the BIOS, Encrypt Hard Disk NCR Confidential 52
Temkin Group Employee Engagement Benchmark Study, 2017 53
NCR Confidential
Logical Attacks ATTACK CATEGORIES – Malware on the ATM ATM Hard Disk ATM Hard Disk Malware on the ATM OFFLINE ONLINE NCR Confidential 55
56
WHITELIST 57
Security Requirements Summary to Protect against Logical Attacks 1. Secure your BIOS 9. Implement Rule based access control e.g. • Only allow boot from the primary hard disk • Define different accounts for different user privileges • Editing of BIOS settings must be password protected • Restrict functionality allowed via remote desktop access to ATMs 2. Establish an adequate operational password policy for all 10. Deploy a network authentication based Hard Disk ….passwords ..Encryption Solution • NCR Secure Hard Disk Encryption 3. Implement communications encryption • e.g. NCR Secure TLS Encrypted Communications 11. Ensure there is protected communications to the ...dispenser of the ATM 4. Establish a secure firewall • The ATM firewall must be configured to only allow known authorized 12. Perform a Penetration Test of your ATM production 15 Recommendations incoming and outgoing connections necessary for an ATM ...environment annually environment, the connections must be configured per program rather than per port 13. Use a secure Remote Software Distribution that will 5. Remove unused services and applications ..assist in maintaining the Confidentiality; Integrity and . ..Availability of your ATMs • Removing these from the system help reduce the attack surface area Required to meet rule 7 and allows for timely distribution of • 6. Deploy an effective anti-malware mechanism updated malware signature files if malware is found • NCR Recommends active whitelisting applications: e.g. Solidcore Suite for APTRA 14. Consider the physical environment of ATM deployment • e.g. Through the Wall ATMS may be more suitable for unattended 7. Establish a regular patching process for ALL environments software installed 8. Harden the Operating System e.g. 15. Consult a security enterprise specialist to deploy industry best-practice security controls within your enterprise • Ensure the application runs in a locked down account with minimum privileges required • Disable Auto play
http://response.ncr.com/security-alerts 59
Thank you 60
Recommend
More recommend
