From: Jeff Lumley (jlumley@forfend.org)
Date: Thu Mar 18 2004 - 18:23:39 EST
Dante -
I happen to work at a financial institution, and generally speaking the
processor has no problem working with security folks to firewall the
connection. I am a tad surprised the admins are giving you grief about this
though, usually it is sr. management that has a misconception about the
security of a "trusted vendor" circuit dropped unprotected on the LAN. Those
guys should have better sense then that!
>From my experience actually changing over a Credit Union from a non existent
security model to having all external connections filtered & firewalled, the
politics are 10X harder than actually working with the Visa's and other
processors of the world to get the addressing changed and NAT'ed around.
That said, you are 100% correct in your recommendations to these
institutions to segregate these lines from the LAN. My best tip for you is
to use the liability card! Once they realize the potential liability for
ignoring security from a legal perspective (can you say negligence?) and a
customer impact perspective (it is not cheap to re-issue 100,000 cards when
the numbers get comprimised) approval to change things comes rapidly.
My 2c!
Jeff Lumley
Network Analyst
----- Original Message -----
From: "Dante Mercurio" <Dante@webcti.com>
To: <pen-test@securityfocus.com>
Sent: Wednesday, March 17, 2004 9:06 AM
Subject: Bank Audit Best practices
I'm looking for some feedback from other people who conduct security
audits and penetration tests on banks.
One of the network aspects I come across a lot is a direct line to their
transaction processor. This is often in the form of a point-to-point or
frame line that is dropped onsite with a router controlled by the
processor, not the bank. I always point out that this is a network
security risk, as there is no control from the bank side regarding the
access provided through that line, and recommend an ACL or departmental
firewall at that point.
As always, the administrators look at me like I recommended them selling
their firstborn. The relationship between the bank and their processor
is very symbiotic as the bank couldn't even exist without their
services, yet my perspective is any outside system should go through
some level of border security in order to monitor and restrict traffic.
Anyone run into this? How do you handle?
M. Dante Mercurio
dante@webcti.com
Consulting Group Manager
Continental Technologies, Inc
www.webcti.com
---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the
skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------
---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:50 EDT