COMMERCE NOW

Summary:

In this podcast, Scott Harroff and Dave Phister spend some time looking back on some security related topics that transpired throughout 2018. Also, they touch on a few things that you might want to think about as you're heading into 2019; how to best protect you from organized criminals attacking your ATM fleets and more so your gas pumps.

 

Resources: 

Blog: Security: A Changing Industry Requires A Changed Approach

  COMMERCE NOW (Diebold Nixdorf Podcast)   Diebold Nixdorf Website

 

Transcription:

Scott Harroff:                     00:00                    

Hello again, I'm Scott Harroff, Chief Information Security Architect for Diebold Nixdorf. I'm your host for this episode of COMMERCE NOW. Today I'm joined by Dave Phister, Director of Security Solutions for Diebold Nixdorf. I'd like to spend a little bit of time here today, walking through some of the things towards the end of the year that we thought you might find to be interesting. And a few things that you might want to think about as you're heading into your new year. Dave, what surprised you in 2018?

Dave Phister:                     00:30                    

Well, I think the first thing that surprised me, Scott, is the emergence of you as the Diebold Nixdorf podcast hosts superstar. You splash on the scene here from an industry standpoint, and really take charge of the security topic, and help us talk through this very important topic for our industry. So that's first and foremost.

                                                                               

Second, realistically, nothing's really surprised, you or I, I don't think. We spend all our days focused on security anticipating forecasting. A couple of things do stand out certainly, as I think back through the year. We rang in the new year with a bang, certainly coming out of 2017, with the emergence of, of jackpotting and malware in the Americas. Certainly, not a new scenario to deal with, but in the Americas it was quite a surprise.

                                                                               

So certainly, the beginning of the year was focused on malware and specific to malware. Just a point to remind our listeners it really has exploded onto the scene as we've indicated in previous podcasts, the number of ATM malware variants is expanding almost on a daily basis.

                                                                               

As I indicated on our last podcast, this ATM malware, it's available for sale on the dark web. It's in the aisle right next to the stolen credit card information. So it's sold as a technology just like we're trying to sell technology to defend against it. So certainly, I think that's a key takeaway from this year, is really the explosion of ATM malware in this space.

                                                                               

Then secondly, Scott, I was pleased, very pleased to see a lot of collaboration this year between public and private industry. I know you have engagements with Secret Service, FBI and local law enforcement. But there were several communications that came out through the industry, the FBI warning. In August there was another warning and October, the fast cash hidden Cobra. I think you remember. I think it's a great example of what's happening not only in our industry, but other industries from an information security standpoint.

                                                                               

I think that type of collaboration, that type of awareness, that type of sharing a needs to continue because it's only going to help you and I. It's only going to help our customers, whether it's the banking of the retail space. So just a couple of things that I've taken away certainly from this year. What about you, Scott? Where do you see our industry struggling, let's say at this stage of 2018?

Scott Harroff:                     03:16                    

Well, first I want to thank you for acknowledging me as the king of podcasts in 2018, Dave, I appreciate that very much.

Dave Phister:                     03:24                    

It's my pleasure.

Scott Harroff:                     03:24                    

I have to then therefore knowledge you as the best co-host of these podcasts, and the second most popular person in the world. Thanks to all the other folks that have joined us on the back podcasts. They've really made this more than just a speaking conversation, but have made it very interesting and very dynamic. So thank you very much for that.

                                                                               

Relative to 2018, I wasn't really surprised that the organized criminals kept becoming more and more sophisticated. I think our industry, Dave, is struggling around how to share information. If we look at some very large financial institutions, I won't even pull names out of the air, but individual, large financial institution A knows a lot about the fraud that they see in their environments. Large financial institution B knows about theirs, but they really haven't shared anything with A. So even though they could've quote/unquote help each other, that really wasn't in place.

                                                                               

What you referred to with private and federal coming together, is really, I think very enlightening and very well received. I've talked to handfuls of financial institutions about this new alliance. By the way, for those that don't know what Dave and I are referring to, we're talking about, the National Cyber Forensics and Training Alliance. That is kind of a amalgamation between FBI and Secret Service and really almost any large financial institution, medium or small financial institution, that can give them data about what they're seeing, so they can do two things.

                                                                               

One, respond more quickly to what's happening. The sooner they know about a bad guy being in a certain area, the quicker they can react to the bad guy. And, hopefully either capture them, or at least reduce the losses that could be going on out there.

                                                                               

Another thing that I think that we're struggling with is really understanding the dynamics of the fraud. For example, everybody who has an ATM is all focused in on ATM skimming and ATM security issues. They're thinking, Oh, I've got to do all these things at my ATM to keep from being skimmed," quote/ unquote. But one of the things that we've learned, working through the International Association of Financial Crime Investigators as well as the NCFTA, is that guess what, gas pumps have taken the lead over ATMs.

                                                                               

Now our average loss on an ATM is somewhere in the neighborhood of $60,000 per skimming event. But if you manage to get a skimmer onto a gas pump and you're effective, you can get $100,000 to $200,000. In watching the videos and these attacks on gas pumps, it's even quicker and easier to install a skimmer on a gas pump. So yep, skimming on ATMs is still an issue, but it's migrating over to the gas pump channel, because it is twice as profitable for the bad guys, and apparently less likely to get caught.

                                                                               

So I think that's one of the things is, our industry is looking at itself, and it's not looking into the other channels, like gas pump and point of sale, gift cards, and things of that nature. I think if you're a fraud investigator for your financial institution, I think adding in those other things would be a really important thing to look into.

                                                                               

I talked a little bit about where we saw some success, local law enforcement and federal law enforcement cooperating The new exchanges coming out to share information. Some new techniques are coming out. Where have you seen success, Dave?

Dave Phister:                     07:02                     Y

eah, that's a good question. I believe that, as you know, crisis creates opportunity. Unfortunately, many times it takes crisis to increase awareness, get the visibility, and the recognition that's necessary. So certainly we've seen the jackpotting and the malware attacks that were very familiar with here in the last several months, create an awareness with our customers. That security is certainly very important.

                                                                               

We talked about during the ZEro Trust webinar that endpoint security is certainly important. The cash is sitting there off the end of the network, but some of those FBI, the fast cash hidden Cobra attack situation was really an attack at the payment application switch ... Or, actually, that's a masquerading or spoofing attack. That is an indication of the fact that security applies not just to the end point, but it has to apply all the way back to the host.

                                                                               

Every touchpoint is potentially vulnerable. I think that customer's users are understanding this now. Unfortunately, we're way behind in the industry from a technology standpoint, because we haven't maintained the technology. But certainly we do see many customers migrating to Windows 10 already, which is a good thing. With this Windows 10 migration, we're seeing technology refreshes being a much larger part of the investment strategy for many of the customers.

                                                                               

So I think as they look to migrate to Windows 10, to maintain current operating systems, maintain PCI compliance, they're looking to update much of their hardware. And certainly, hardware and software technology refresh are keys to enabling security controls that would defend against some of the attacks that we're seeing in the marketplace with newer technology. So just an example there.

                                                                               

I think, Scott, one thing that I would ask you is your opinion on the number one thing that banks should do to lock down their security in 2019? What would you say to our listeners, the number one thing should be?

Scott Harroff:                     09:41                    

We've been talking all year long about, there is no one silver bullet that you should have in your gun that you're going to pull out at the right time and stop the attack. It's all about layers. It's all about physical security. It's all about software updates, firmware updates, XFS updates, white listing, hard drive encryption, encryption of data in motion. There's all those different things that we've been talking about. But, if you said, "Scott, what's the one thing, if you only get to pick one thing out of the list?" I would say, "Get an incident response plan together."

                                                                               

Imagine that you've got your security controls in place, yet something goes wrong. Somehow a whole bunch of data got skimmed. Maybe it came off a gas pump, or maybe not an ATM, but all of a sudden you start getting all these fraudulent transactions coming back into your system. What are you going to do? Who are you going to call? What buttons are you going to push? What are you going to do to stop that incident now that you see it coming?

                                                                               

I think one of the reasons, Dave, I go there, is that there's attacks called, unlimited ATM cash out attacks. The FBI put out alerts earlier this year. It's really not about attacking an ATM in any way, shape, or form. It's really about the fact that some other system somewhere else was compromised. It could be like you were referring to, the host itself was compromised. Or the ATM transaction process was compromised. Or something somewhere in the middle was compromised.

                                                                               

But suddenly when dozens or hundreds or thousands of transactions all start flowing into your systems, can you see that huge spike and network activity coming into your core or your atm transaction processor? You might have a fantastic fraud system. You might have controls on the core. But just something as simple as you normally have this amount of network traffic coming in for approvals, and suddenly it doubles, triples, 10x increases. You ought to be able to see that, and you ought to be able to wrap very quickly.

                                                                               

For your response plan, what are you going to do? Are you going to immediately disable that account that's now handing out hundreds of thousands or millions of dollars? What happens if suddenly you start getting these transactions coming in from international locations? How many of our banks and credit unions suddenly have thousands of transactions coming in from outside of the United States against one, or a handful of accounts?

                                                                               

 

Think through all the different things that could go wrong, and start planning for who are you going to call? What are you going to do? So that if you happen to be unfortunate enough to be caught in one of these new attacks, you can react fast and limit damages. I think that would be my number one thing is, plan for incidents and make sure you know what to do so everybody's not in a panic when it actually starts to happen. That's Kinda what I would do. Looking ahead next year, Dave, what? What would you expect that we need to be looking out for?

Dave Phister:                     13:00                    

Certainly, I echo some of the things that you just mentioned. We need to be vigilant. We need to certainly ensure that security is top of mind. We very much would like to see customers in this industry and the other industries consider security as a vital part of their brand. I think if you do make that commitment, then certainly you have the C Suite visibility. Then the investment security investment strategies should flow from there. You can put yourself on a path to migrate your fleet to the protection levels that are necessary.

                                                                               

With regard to emphasizing any given security control, you're right, layers are certainly important. We talked about that in the Zero Trust webinar. We have to assume that the top hat will be accessed in an unauthorized manner. If we encrypt information, then we devalue the data, so I'd simply like to emphasize that once more. We talked about it, encrypt, encrypt, encrypt. Whether it's encrypting the hard drive. Whether it's encrypting the internal USB communications to prevent unauthorized access.

                                                                               

Whether it's encrypting card reader data from the read head. I think it's very, very important. In addition to encrypting all the way back to the host so that to prevent the man in the middle of the attack. Or a message manipulation all the way back to the transaction processor. So I think looking forward, I do believe that we will see an emphasis on encryption. I think that we will see an emphasis on technology refresh, as we moved through Windows 10, as we move through some of the PCI milestones.

                                                                               

Scott, there's a significant movement right now to migrate remote key loading to SHA-256 Hash Algorithm, that requires significant investment, significant partnership. Then along those lines, what I'd like to see moving forward is certainly an emphasis on dispenser security and end dispenser security. Having said that, that's my thoughts, as we look forward. What do you expect from the year ahead, Scott?

Scott Harroff:                     15:32                    

I'm with you, Dave. I think the word for 2019, is encryption. Whether it's encrypting the hard drive to make sure no one can add unapproved software to it by simply unplugging it. Hooking it up to a laptop, and changing it. Whether it's making sure that they can't just tap into the reed head of a card reader, and do what's called an eavesdropping attack. I think that was probably one of the biggest wake up calls to anybody that had a card reader that didn't use encrypted read heads.

                                                                               

These eavesdropping skimmers that you just cut a little hole through the front of the ATM. You add the skimmer inside the card reader, and you put a sticker over it,  really caught a lot of people by surprise. People that thought, "Well, I have a card protection plate in there. I'm good to go. Or I have some kind of jamming. I'm good to go. Or I have some other technology to look for devices around the front of the ATM. I'm good to go."

                                                                               

Now, suddenly, all this data is coming right off of the read head, or right off the circuit board, and you're kind of a deer in the headlights. Relative to now what do I do next? Of course, anybody who has Active Edge doesn't have to worry about that But, encryption of data, whether it's in motion or at rest, is of very, very old concept in the IT security space. We all worried about data in motion at rest, but it's just now becoming that important in the US market space, so I absolutely agree with you there.

                                                                               

But what all I look forward to? I look forward to folks taking their Windows 10 migration and their terminal software migration, as a point to really sit back, to really evaluate what they did for the last five years. And really use this as an opportunity to say, "Well, maybe I didn't change my [inaudible 00:17:22] password. Maybe I didn't change my Windows password. Maybe my security wasn't as good as it should have been." Really use this as a point in time to say, "Hey, I'm going to be making an investment here in one way, shape, or form, or another in the next one, two or three years just because of the what's going on in the industry."

                                                                               

Let's do it better this time. Let's make sure we have more of our security boxes ticked off. I think that's really an important that I see coming down the road. Again. I also really, really hope that the private and public sector and law enforcement spend a lot more time collaborating with each other and identifying and removing these bad guys. I think that would be huge. The fact that we got, law enforcement, the federal, and local level working together.

                                                                               

Once we saw how things were unfolding in the summer of 2017, with jackpotting, it spiked if you will, in the winter of 2017. Everybody got engaged, started sharing techniques, started working together, sharing information. And sure enough, in the spring of 2018 FBI, local law enforcement, Secret Service all got together and just basically shut down the jackpotting ring that was operating. Knock on wood, we haven't seen them since.

                                                                               

So, again, folks between now and the time these bad guys come back, use it as your point in time to do some planning, and to proactively update the fleet. So that when this does come back, and I have to say when it will come back, make sure you're more ready or at least you're in a position where you've got your response planning, know what's going to happen. I think that, Dave, is the way I'd wrap it up. Is there anything else you'd like to add, sir?

Dave Phister:                     19:01                    

No, I think the only thing I would say is certainly thanks to you. And echo your thanks earlier to all the other folks that engaged in these security conversations in the past year. A special thanks to the folks at Forrester and Merritt Maxim for the Zero Trust webinar. I think that was very well received. And wish everyone a happy holiday and happy new year and certainly, to you as well, Scott. Thanks for having me.

Scott Harroff:                     19:29                    

Thank you very much, Dave. I'd like to send a special call out to John Campbell over First Data Star for doing a fantastic webinar with us at Tag Picks. As well as First Data putting on their own security webinars and inviting us to work with them. I very much appreciated that opportunity as well. Dave, thank you for all that you've done as a product manager for security, to give your input and your insight to our customers.

                                                                               

Thanks for all the other people that have helped make this podcasts successful, from the marketing teams and everywhere else. With that, this is Scott Harroff, Chief Information Security Architect, Diebold Nixdorf signing off for the year. Please do go back to the COMMERCE NOW podcast. Listen to them all. If you have any questions, please feel free to reach out to your client account executives, or service managers, and I wish you all happy holidays.

 

Summary:

In this podcast on Zero Trust security; an encore to our November 15 webinar, during which, Dave and Merritt explored the architectural concept of Zero Trust and discussed how it can be leveraged by financial institutions to gain tighter control of ATM networks. Today, we want to take a deeper dive a few of the questions we received during the live webinar and actionable outcomes to consider when it comes to applying this concept to your operations.

Resources: 

Research Report:

The Forrester Tech Tide: Zero Trust Threat Prevention, recently published in the third quarter of 2018. Download a copy today.

Blog: Our Commitment to you as our security partner 

COMMERCE NOW (Diebold Nixdorf Podcast)   Diebold Nixdorf Website   Transcription: 

Scott:                                    00:00                    

Hello again, I'm Scott Harroff, chief information security architect for Diebold Nixdorf, and I'm your host for this episode of COMMERCE NOW.

                                                                              

Today I'm joined by Dave Phister, director of security solutions for Diebold Nixdorf, and guest speaker Merritt Maxim, principle analyst for Forrester. Today, we're going to discuss an interesting concept, zero trust security. This podcast is actually an encore to our November 15th webinar during which Dave and Merritt explored the architectural concept of zero trust, and discussed how it can be leveraged by financial institutions to gain tighter control of ATM networks.

                                                                               

Today, we want to take a deeper dive into a few of the questions we received during a live webinar, and in actionable outcome to consider when it comes to applying this concept to your operations. A link to the webinar replay can be found on the podcast show notes. If you'd like to learn more about this topic, we'll give you a little bit more about this in a few minutes.

                                                                               

With that, I'd like to welcome Dave and Merritt. We're happy to have you on the show today.

Dave:                                    01:04                     

Yeah, thanks Scott, excited to be here today as well, appreciate that. And also thanks to Merritt for being with us here again today to talk about zero trust and ATM security.

Merritt:                                01:15                    

Yeah, and thanks Scott and Dave for having me, I'm looking forward to our discussion here.

Scott:                                    01:19                    

Right, so let's dive right in. As I mentioned, there was a lot of useful information provided during our zero trust security webinar, but one question was asked by several webinar attendees, which was can you summarize, and give me bullet points, which would provide me a list of the key things I can do right now to help safe keep my ATMs?

                                                                               

So where we're going to focus our time today is in looking at that. And we're going to go through each of these individual bullet points. I know each of you have some areas you'd like to highlight. So let's get started with Merritt, and his thoughts on topic one, which is controlled access.

Merritt:                                02:02                    

Yeah, sure, thanks. So I think as kind of a backdrop to this, it's important to realize that although we are increasingly moving to a cashless society, ATMs are still a relevant part of our kind of daily lives, and we still use them, and have to rely on them for a variety of purposes. But because they're still relevant, it also means they're still active in the public, and they store cash, which is still a useful target for hackers. For all the talk about cyber attacks, and malware, and viruses, the reality is there still are numerous instances of people physically just trying to get access to an ATM to actually steal the cash out of it. A much more kind of low tech way to ... instead of trying to, say, steal credit card numbers or Social Security information online.

                                                                               

And what this means is that organizations do need to think about securing the physical asset itself. And this is increasingly, I'd say, problematic because the traditional model where the ATMs are only located within the branch is not necessarily a model now, they're located everywhere, they're in airports, they're in hotel lobbies, they're in convenience stores, or at gas stations, and those are all in the name of providing convenience, but that also means that those assets are now potentially more accessible to a greater part of the population, which may be inclined to try to steal the currency out of the ATM itself.

                                                                               

And so what this means is that as you distribute and extend your ATM network, you can't overlook the need to just control and manage physical access to the machine itself. So that can include everything from verifying who actually has access to the system, whether they're going there to do maintenance, or whether the part of the currier that actually is putting new currency, or reloading the ATM at some interval. And also looking at what kind of locking mechanisms do we now need to have in place to actually secure the head compartment of the ATM itself.

                                                                               

So again, these are all measures that have been in place for some period of time, and which companies have already been using, but it never hurts to stress the importance of doing this because the ATM is still a target. And from a IT side, you can also begin to look at logging all of your activity of maintenance on those machines as well. There's still the possibility of potential insider abuse, maybe if they actually have access to ATMs that perhaps they may be sharing that credential with somebody else in exchange for sharing the proceeds of a theft, and again, having logging and various analytic mechanisms in place to track and monitor the usage and alert when there is unauthorized access. So if you see a maintenance call on a device beyond, outside of its normal operating windows, you can flag and eventually block that device, and then maybe using the video analytics that are embedded into the ATM itself, use that for forensic purposes to follow up with law enforcement.

                                                                               

But these are all, I think, useful things and it never hurts to stress the importance of looking at what kind of measures you should be putting in place to actually control access to the asset itself, because that's ultimately going to help minimize the risk of fraud or attacks against the infrastructure.

Scott:                                    05:03                    

Excellent. So Merritt, I spent Wednesday and Thursday of last week it Pittsburgh with the Secret Service, FBI, and a lot of really high profile banks and credit unions, talking about the strategic and tactical points around ATM security, and skimming around ATMS, and gas stations, and a lot of different areas. So let's focus a little bit on talking about the end point security aspect. So Merritt, can you share a little bit with me around how end point security should be addressed?

Merritt:                                05:40                    

Yeah, absolutely. And it's a good point to raise. When we talk about threats to the ATM, we've certainly seen instances of card skimming, or card readers that are inserted into the terminals and used to capture credit card data. But also we're seeing scenarios, there was a large ring that was arrested or discovered last year, mostly in Europe, that were actually attacking the banks back office systems, and using that to actually issue, literally just to spew out cash at designated ATMs at certain periods of time for criminals to collect. So the point is that the ATM is connected to your network, it is a valued part of your network, but because it's connected to the network, it also means it's potentially vulnerable to exploitation, either through skimming type things at the end point itself, or through lateral movement from hackers who have gained access to your network elsewhere, and are trying to move either towards a specific ATM or class of ATMs, and use that to allow it to behave abnormally, that may allow users to them actually extract cash from that ATM.

                                                                               

And so this means you need to follow many of the same kind of best practices that you follow for traditional, say, desktop end point, whether it relates to keeping your operating systems up to date and patched, and making sure that you're not running a legacy or outdated code for which a zero day exploit may actually be available, and may be able to be utilized. You could also include at the ATM end point actually hardening the operating system. So there may be certain functionality in that operating system that is not necessary for the safe operation of that ATM, and therefore you may be able to reduce our remove some of that functionality which further reduces the potential vulnerabilities you may face at those systems.

                                                                               

And then also applying appropriate network controls, this can include firewalls, micro perimeters, network access control, things like that, to ensure that there's a trusted connection between the ATM and it's only authorized to interact with other trusted parts of the network, so that if it gets a phantom request from some other unknown device, it won't communicate with that, and therefore would minimize the risk of those devices being able to go in and extract information.

                                                                               

And lastly, there's ... we've been talking a lot about the technology aspect, but you need to accompany this with the process framework, right? In terms of how you do patches, how you test them, how you upgrade them, how you install them. And also, from a risk and vulnerability standpoint, having a vulnerability risk model in place so you can access based on a given vulnerability as it's identified, A, is this relevant to our organization? B, is it significant, and then C, what's our appropriate counter measure? Is this something that we don't deem to be a significant threat and we can put it as a lower priority, or is this something that requires immediate attention, and we're going to therefore deploy a team to go out and deal with that.

                                                                               

So you need to have those processes in place to accompany kind of your overall approach, because that's ultimately how you're going to better defend yourself against this kind of expanding attack surface.

Scott:                                    08:41                    

You know Merritt, I think you hit it right on the head with all the different points you touched on. And to your point, keeping the firmware up to date on your dispensers, keeping the XFS software up to date, keeping your operating system up to date, keeping your terminal software up to date, and having all this end point security controls in place is really, really important. And I can't agree with you more on all those different points.

                                                                               

But what I'd like to do is I'd like to touch just for a second on encryption. And for me, when I look at encryption, I look at two different things relative to anything that has card holder data, whether it's an ATM, whether it's a gas station, whether it's a point of sale terminal. For me, I look at how do we protect data at rest? Whether that's on a hard drive. How do we protect data in motion, whether that's between an ATM, or a gas pump, or a point of sale station, and whatever's actually approved in that transaction.

                                                                               

So Merritt, could you give me just a little bit of context around how you think about encryption around these devices?

Merritt:                                09:48                    

Yeah, sure. Encryption is ... it's not kind of dark magic that it may have been viewed back 15 or 20 years ago, this is a standard capability that can be used in lots of places. And traditionally there would often be a response, "Well, we can't use-"

 

Merritt:                                10:00                    

... fixes, and traditionally, there would often be a response, “Well, we can use encryption here because the network's too slow, or the hardware can't handle it.” That's not a really valid argument anywhere. You really need to be encrypting everywhere, at all possible, not just for data at rest, but also in transit. Again, the performance impact is pretty minimal, but the benefits of it should be pretty obvious, in terms of it protecting you against various breaches and ensuring that your data's being encrypted appropriately. This does require, just like in the previous section, this does require, still, some process in place around how you do, for instance, key lifecycle management. So, how the keys are created, how they're stored, how they're rolled over. Just saying, “We're going to encrypt everything and we're done with it,” that's a good first step, but you need to have this process in place. Includes, possibly, deploying hardware storage modules, or HSMs, to actually store the key material and having a dedicated team in place that actually manages that key, because encryption is really only as strong as the underlying key managing processes. If you've got poor key management processes, and the keys are just stored on a USB drive in someone's desk, the value of the encryption is considerably reduced. That really puts a premium on making sure that you've got these various types of hardware mechanisms in place, and that you need to have that host ATM encryption, using things like TLS with a message authentication code to prevent against man-in-the-middle attacks.

                                                                               

These are all, I think, pretty standard processes, but always worth reiterating, because encryption is a very powerful tool that provides us a lot of value in preventing against these types of attacks.

Scott:                                    11:40                    

Yeah, Merritt, you've completely nailed it, and I think that anyone listening to Commerce Now should think about contacting whoever does the transaction process for their ATMs. They should really ask their transaction processor, “How do we encrypt the data between our ATMs and the transaction processor?” And, likewise, I think everybody should ask the OEMs, “How do you encrypt data at rest on the ATMs?” That's incredibly important. It shouldn't be overlooked and everybody should understand how that works.

                                                                               

What I want to do, right now, is I want to switch a little bit over to Dave. Dave, what I'd like to do is just spend a little bit of time and ask you about, now that we've encrypted data on the hard drive, now that we've encrypted data between ATMs, or all these other point-of-sale, or gas pumps, or everything else, to the hosts that actually drive them. Give me a little bit of your thoughts on runtime integrity. How do we make sure that the software that's running on these devices actually is doing what it's supposed to do?

Dave:                                    12:51                    

Yeah, absolutely, Scott. It's a great point and Merritt talked earlier about endpoint security. This runtime integrity really becomes a sophisticated version of endpoint security. It's another layer of security that is really an expansion area, in our opinion, in the ATM space. The rest of the world is moving to heuristics and behavioral endpoint monitoring, and this will, eventually, occur in the ATM space, as well. It's already beginning to. Merritt talked about zero-day malware. We talked about that during the webinar, as well. This is ATM specific malware. This is some pretty nasty stuff. We need to move away from solely relying on antivirus. We have to move away from relying antivirus and signatures, and focus on intended behavior.

                                                                               

Scott, if we can predefine and authorize ATM behavior, now, that requires us to understand what the expected behavior should be. We can deploy that to the endpoint and then monitor that behavior in real time. We can, actually, detect this ATM zero-day malware without a signature, by detecting this unauthorized behavior. If we take that one step further, tie that post-event operations into the security policy, how they output into an alarm, then, now, we begin to have some real time alarming notification and response capability to defend against the threat.

                                                                               

This clearly requires adjusting the framework and processes to avoid attacks that would take controls of the lower level software, that might allow privileges to be escalated and to remove these security policies. But, again, this type of sophisticated application layer security that monitors the actual behavior on the ATM could go a long way to defending the endpoint from some of this zero-day malware that we're seeing continue to evolve in the marketplace, Scott.

Scott:                                    14:56                    

Dave, I think what you just touched on is really, really important. Because, to me, when I look at an application, again, whether it's on an ATM, whether it's a gas pump, whether it's a point-of-sale terminal, to me, what the whole monitoring concept is all about is in looking at this application saying, “I expect you to do A, B, C, D, E, F, G, and that's all.” At the end of the day, if, suddenly, as opposed to doing A, B, C, D, E, F, G, you do H, I, J, K, L, M, N, O, P, there's a real issue going on.

                                                                               

For me, what I want to understand is, when we have an application that supposed to behave in a certain way, and we define criteria for that behavior, and something happens outside of that criteria, for me, what I want to have happen is, I want you, the ATM transaction processor, or I want to have the backend credit unit, the backend financial institution, I want them to understand that something has happened outside of what we consider to be normal, and I want them to do something different.

                                                                               

Give me a little bit of context, Dave. Help me understand, from your thought, how we do analytics? How do we determine that something unusual is happening? How do we determine that something unusual is going on and how do we respond to that? And then do something different. Help me frame analytics.

Dave:                                    16:35                    

Yeah. It's a great point, Scott. Again, another area beyond encryption and runtime integrity where, I believe, the market is expanding. This is all really focused on gathering the data. First of all, we need to have access to the data. So there has to be some centralization. We have to have the components, the clients, the infrastructure, in place to be able to centralize the data. Then we need to focus on correlating that behavior, that expected behavior, A, B, and C, that you talked about earlier, and turning that into a flow, a sequence, if you will, a pattern that we can match.

                                                                               

If we see patterns that don't match, then, certainly, the sensors are going to trigger. And if we've established the security appropriately within the security policy, we can, perhaps, stop the next critical operation at the endpoint, whether it's ATM, whether it's in the retail space, as well. We can launch an alert, a notification, if you will. If we are in an infrastructure where we have an alarming capability, and that alarming capability can be tied to a centralized infrastructure, then we begin to piece together a real time monitoring capability that can take a look at transaction flows, use cases. Gather all this data, correlate it, and recognize when an endpoint is doing something that it wasn't originally intended to do.

                                                                               

As we move forward, the modules, themselves, the software that you talked about, the transaction area, the hosts, they will begin to include these data components, and the analytics, so that we can do a better job of, not just monitoring the operation of the endpoints, from an availability, or an asset, perspective. Certainly, being able to better understand what's happening from a threat perspective and be able to respond as quickly, as possible. Every operational environment is different, Merritt, touched on that. So it's not a one size fits all, by any stretch of the imagination, but, I think, if we put physical and digital monitoring in place, and we have access to that data, we certainly can do a great deal more to protect the endpoint.

Scott:                                    19:18                    

I think you really hit it there. When I look at our ecosystem of financial institutions, and retailers, and government bodies, and commercial level entities, I look at a large variation. I look at folks from your large, large, large financial institution has 10,000 ATMs across North America. I think about how that extends all the way down into the small credit union, if you will, that has one or two branches, and one or two ATMs. I think there's a huge variation in how people manage their infrastructure. How they manage their devices. How they handle the monitoring. How they manage the endpoint security and-

 

Scott:                                    20:00                    

How they handle the monitoring, and how they manage the endpoint security, and encryption, and everything else. And to me, I look at it from the standpoint of I might be this huge, huge financial institution that has 50 people that does nothing more than from eight to five, work on my point of sale terminals, my ATMs, or my different kinds of devices, all the way down to this small institution that just wants to have their name on an ATM, sitting in the corner of parking lot somewhere. So help me understand a little bit.

                                                                               

When I move from someone that has a financial infrastructure down to somebody that just wants to have their brand on something, help me understand how I can look at ATM as a Service, as something where I just want to have somebody do everything for me, versus somebody that wants this huge environment of controls, and infrastructure, and people wrapped around this thing called an ATM.

Dave:                                    20:57                    

Yeah, it certainly can be a daunting task, depending on certainly your position in the market and your capabilities. It can be overwhelming from an asset and availability management standpoint, configuration management, typical information security standpoints, not to mention overwhelming from a security policy management, incident management, having to pay attention to what's happening at the endpoint from an anti-skimming standpoint, and what's happening perhaps in the channel with regard to malware prevention, attacks against the host, it can be extremely overwhelming for those entities that really only have a couple of endpoints in operation.

                                                                               

And the reality, Scott, and I'm sure Merritt you would agree, technology is moving too quickly. And if we don't maintain pace with technology, then certainly there will be vulnerabilities. And the fact of the matter is, there are experts out there and advantages to subscribing to a managed-service or an ATM as a Service, not only from an availability standpoint, but also from a security standpoint. Merritt, you touched earlier on, when we were talking to Scott about encryption, the key management aspect of it, this is something that is a specialized skillset.

                                                                               

It's critical to encryption and if you don't do it right, then you might as well not have deployed encryption to devalue the data. Another area where ATM as a Service, a managed-service provider can fill that skillset, that capability, can manage the keys, manage the infrastructure that's in place to deliver the service with trust. So certainly, larger institutions have the assets, they have the wherewithal, they have the partnerships in place to be able to do this, but many do not. And if they don't, it can be daunting, overwhelming, that's when vulnerabilities start to come into play and attacks occur.

                                                                               

And ATM as a Service, it exists out there, and we certainly encourage those entities to subscribe or consider that. What I like to say, Scott, is know what you do and know what you do best. And do that, and if you don't do something well, then you should seek out those who are experts, who do do it well and see if they can't help you.

Scott:                                    23:31                    

Dave, you've just completely finished my sentence for me, if you will. One of the things that I'd really like the folks that are listening to COMMERCE NOW to understand is, we're talking about all these security controls. We're talking about all these different ways to protect your assets.

                                                                               

And what I'd really like to do, is to frame this up from the perspective of, "What am I going to do if something bad happens, when there is an incident, whether I get skimmed, or whether there's some kind of a compromise, that data arrest or data in motion, what's my incident response? What am I going to do? Who am I going to call? What are my next steps?"

                                                                               

Because at the end of the day, we can all put all these different controls in place, and these defenses that we're talking about are what I'll legacy or they're aging defenses. But what we really need to do, is we really need to start becoming proactive. We really need to start focusing on what our vulnerabilities are and what our responses are. So anything else, Dave, that you or Merritt like to touch on that could help our audience understand, that if something happens, what am I going to do next? Who am I going to call? What am in going to do next? Can you guys help me out with that?

Merritt:                                24:58                    

Yeah, I would add, and make this common to all of our clients, is as perhaps morbid as it may seem, is you actually need to practice and plan an incident response. Just like you have a fire drill every year in your building to verify your evaluation plans, the same thing needs to be held, whether it relates to any data breach of your system. So that means, you actually have a documented procedure in place, you have a team identified to actually handle that. So if and when you actually have a breach in some part of the ATM network, you actually know what to do. A lot of companies think, "Well, either we're not going to be hacked and we don't have to worry about it." Or, the worst case, they also create a policy, and they just put it in a three-ring binder, and everyone kind of forgets about it. So I really encourage you emphasize a kind of practice and the human element is to really understand and make sure you've figured out, just like for disaster preparedness. This is something that has impact to your business and your brand, and if you have a plan in place, if and when something happens, you're much better able to respond to it.

                                                                               

And more importantly, your customers will be much more forgiving of you if you show that you've got, you're ahead of the issue, and you've got a good handle in place. If it takes you three weeks to get back to responding to this specific incident, that doesn't endear customer loyalty or trust. So I think the need to do drills and plan your teams, at maybe once or twice a year, I think, is definitely good advice to take in your organizations, particularly as you look ahead into your 2019 planning.

Dave:                                    26:27                    

Yeah, I couldn't agree with you more, Merritt, that the incident management component is often overlooked, certainly by many. We're so focused on the threat and preparing for the threat. Merritt, you and I talked during the webinar about this issue of threats becoming increasing a question of, "When, not if a breach or a compromise will occur?" We don't focus enough on when it occurs, what will we do about it, and I think establishing an appropriate risk management framework is key here, putting the processes in place, as you talked about, Merritt.

                                                                               

Testing these processes, recognizing what's at risk when an incident or a breach does occur, so that you know what the risk mitigation steps are and what the appropriate sequence is for those steps to minimize any damages. Ultimately, that is the key to protecting the endpoint, first and foremost, the users and the customers, and then certainly the brand, as well. So incident management is a critical component to any risk management approach to information security. And again, Scott, another component, just to bring this full circle. That is possible from an ATM as a Service prospective on the managed side of things.

Scott:                                    27:56                    

Again, I'd really like to thank Dave and Merritt for joining us today, and helping us talk about this really important topic. And I'd really also like to thank our listeners for tuning in to this episode of COMMERCE NOW. To learn more about this topic, please download a copy of the research report, The Forrester Tech Tide, Zero Trust Threat Prevention, recently published in the third quarter of 2018. Please visit DieboldNixdorf.com/ zerotrust to download a copy today.

Until next time, keep checking back on iTunes or your PodCal system channel for new topics on COMMERCE NOW. Thank you again and have a great day.

 

 

 

Summary:

Devon Watson and Michael Engel discuss all things Connected Commerce. In this episode, both touch on the unparalleled services and technology that are essential to evolve in an 'always on' and changing consumer landscape.

Resources: 

Blog:
Connected Commerce: It’s Not Just for Retailers

Exploring the Path to Connected Commerce

Advertorial:
Michael Engel on Pymnts.com

COMMERCE NOW (Diebold Nixdorf Podcast)   Diebold Nixdorf Website   Transcription:   

Devon Watson:           This is commerce now. My name is Devon Watson, chief marketing officer for Diebold Nixdorf. Really excited this week. We have Michael Engel here with me. We're in Phuket, Thailand, meeting with our Asia Pacific team and talking about all things connected commerce. So Michael, if you could please just give us a quick intro, tell us a little bit about what you do with the company. You and I bumped into each other all over the world. Uh, give us, uh, just kind of quick background, who you are, what you do.

Michael Engel:           Well, my background has been in suffer all my life more or less professional life, um, and in banking. So, um, I've been traveling around the world talking to different customers and my job is officially being responsible for our software sales globally in banking. But the nice side effect of that is that you can talk to customers and you listen to customers and having that privilege, getting so much knowledge from the different geographies and then being able to consolidate all of that and drive that back into our R and d organization. That is the fun part really of the job. So really getting to know what is happening in the market, where the concerns of our customers, but also see the different cultures, the different drivers in those markets really bring together that knowledge that we can then utilize and transformed that into innovations and products and solutions so that that's what it's basically all about.

Devon Watson:           Yeah. So you're, you're kind of a really important glue between the customer base and the product slash r and d organization, which is just a fantastic place to be in. You obviously are in a global role. So I imagine that you might have a fantastic frequent flyer mile account. Do you know how many miles he did last year meeting with customers?

Michael Engel:           A bunch. So accumulated there probably in the seven digit number. So I'm not truly sure if that's a good number. Yeah,

Devon Watson:           it's kind of like winning the, uh, the race that you never wanted to enter. Exactly. Exactly. Well, so this customer connectivity, right? The amount of time that you spend around the world meeting with customers. Can you give us a little bit of flavor about the Fintech Revolution? Right. So, uh, I think last year there was some like $26,000,000,000 went into financial technology, startups and innovation and a lot of the customers that I talked to at conferences and in my travels they're wrestling with how do they respond to that? How do they incorporate that? Can you tell us a little bit about, you know, what you're hearing around the world.

Michael Engel:           Well, I strongly believed that fintechs are positive disruption of our industry. The reason why I say this is banks are there to provide the element of trust which very good and very important. However, in the past you to regulations and also the tendency to stick as human beings to the known and that's also in business and the business processes created an environment where although bangs for very sound, organizations that were also very hard to move. And if we look into our society today, then technology has made an amazing seeing happen. And that is the cadence and speed of innovation that we see today. So if you look into the past then you had like every hundred years and major invention then every 50 years, every 20 years, every year, and now we're not talking years anymore. It's really down to months or weeks or even days when you see the new and next thing coming up.

Michael Engel:           So that speed of innovation at the same time is a very good thing because it's enabling us today was utilizing that technology. So just think about what you do today with your smartphone or your tablet in terms of ordering your ticket for coming here, checking in, organizing transportation to the hotel, getting recommendations were to die and where to stay. So you basically organize everything that took in the past couple of weeks to prepare that trip. You do that and a couple of clicks. So that enablement is what people like today, this is what people want, but that is also what they know because in every commercial transaction there's this financial element involved. Now expect also from the bank to support that. So this is the big challenge where now these fintechs are coming in and say, okay, here is little sweet spot and we create based on that technology, a solution for that particular sweet spot, which is good because that gives some or bring some dynamic into this whole world at the same time it starts a thought process within the bank to say, okay, we need to be in a similar way like those fintechs. So how can we embrace the results coming out of the Fintech, how can we integrate that into our own it environment and how can we even leverage our strengths of the element of trust being a sound financial organization and that speed of innovation and bring all of that together. That's

Devon Watson:           the real trick, right? So, so at a, at a corporate level, you know, we've engaged some different ways in this wave ourselves. So we're a, we're a member of Fintech 71, which is a selarator primarily for financial technology companies, uh, bringing together a bunch of different innovation hubs in the U. S we're also a member of workbench, which is a venture capital and startup, a innovation fund in New York City, and we're working with startup companies and large companies as well in R and d portfolio. Clearly. So, you know, we're engaged in it. The banks are engaged in it. When you talk to a customer for the, you know, for the bankers listening to us, you know, what would your advice be on how our customers and dibels next door can work together to kind of ride this wave navigated as partners?

Michael Engel:           Yeah. You mentioned the term glue in the beginning in terms of how we transform, um, so to speak knowledge that we pick up from the market and bring that back into our own organization. If I'm in a certain way, bangs need similar glue because on the one side they, they sit on a wealth of data and information about what we do as customers was any financial transaction that we execute. Well, leveraging that information is still yet to come. Um, second thing is you have all this existing financial, uh, information including the business processes sitting in different core banking systems, but they're very much siloed, so there's not much connectivity between data in one bucket to the data turn, another bucket, and if you think about the evolution of the IT industry is all about taking data, taking processes that are manual today and automate them and really bringing this together as the fundamental idea of what we do in connected commerce.

Michael Engel:           So we're kind of the glue bringing all of these elements together and bring that to the end consumer because that's the important thing. So how can we get better, more automated processes to a customer because to me it's beyond the traditional view of you have a bank and you have a Fintech, the Fintech as the innovator that shakes things up and let you think to innovate and to thrive. Now some of the technologies that are used in there, like the whole idea of the API economy, blockchain, all of that. These are just enablers, but these enablers go beyond the financial industry per se. It involves us as a consumer. It involves every solution provider or retailer or merchant that's out there because in any transaction we don't think banking. We think buying a car, getting a new house, I'm traveling to book it now. That is what we want to do and if this consumer customer journey, we need to involve a sort of financial transaction, whether that's buying flight ticket or whether it's getting the mortgage for the house.

Michael Engel:           If we bring those elements together through an API economy, that is what really consumers are expecting from us and this is where I also see as the role of the bank being that aggregator, being that glue and as Sdi service provider, we need to provide the frameworks, the components that make that process faster so banks will not start from scratch building that way. So they are looking to guys like us to say, okay, is there something in the box that is open source technology that are prebuilt components that are frameworks, that are tools that are interfaces precertified based on all the government regulations that you have from the world. Services that you can give me to gain more speed to accelerate, to be in the best meaning of the word. More Agile.

Devon Watson:           No, that's very helpful. And I think one of the things that I'm hearing kind of loud and clear, you know, talking to clients, talking to you know, our subject matter experts and thought leaders like yourself is this mind shift from thinking in terms of channel silos to now thinking in terms of more holistic consumer journey and how to enable that end to end and play a larger role in that kind of commerce supply chain if you will. Well this has been a great conversation. I always love learning from, you know, our guys that are out there with the customers on the front lines talking to customers around the world and I think that ability to take knowledge from one place transpose it on a global basis is probably one of the more powerful things that we bring to the market. So like kindle. Thank you very, very much.

Michael Engel:           Maybe one last word on that. I'm traveling around the world has two aspects to it. On the one side, you'll see all the variety and differences in the different geos and is important for us to understand that there is no one size fits all on the one side. However, there are certain similarities and fundamental elements that we need to provide and to really find a balance of how much standardization infrastructure of frameworks that can be reused globally do we need to provide, which is important for r and d organization, but how can we also be very flexible to put in the regional flavors, what is really needed in a certain society, in a given economical environment. I think that is what we've learned out of history that no, there is not a one size fits all, that we drive from the US, from Europe, from wherever into the world is really understanding the local needs while bringing that together in a standardized set of components and frameworks and that is represented in the whole connected commerce idea.

Devon Watson:           Fantastic. No great stuff. Really appreciate the time. This was a fun conversation. I hope. I hope our listeners are learning from these and uh, look forward to seeing you again somewhere else around the world. Thanks.

 

 

Summary:

Physical and cyber attacks against ATMs receive a lot of coverage, but they are not the only ways in which criminals can empty an ATM of cash. Transaction reversal fraud is one example of a manipulation of loopholes in transaction processing rules to steal cash, but it requires little to no tampering with the terminal. This episode will cover the latest process/communication manipulation fraud methods and news, as well as how to stop these attacks. 

Resources: 

Blog:
Changing Risk, Risking Change: Security at the ATM
A look at how ATM Security has Changed....and how it hasn't

Whitepaper:
Managing ATM Security

COMMERCE NOW (Diebold Nixdorf Podcast)   Diebold Nixdorf Website   Transcription:   

Amy Lombardo:                00:00                    

Physical and cyber attacks against ATMs receive a lot of coverage, but they are not the only ways in which criminals can empty an ATM of cash. Transaction reversal fraud is one example of a manipulation of loopholes in transaction processing rules to steal cash, but it requires little to no tampering with the terminal. This episode will cover the latest process and communication manipulation fraud methods and news, as well as how to stop these attacks. I'm Amy Lombardo, and this is COMMERCE NOW.

Scott Harroff:                     00:43                    

Hello, again. I am Scott Harroff, Chief Information Security Architect at Diebold Nixdorf and your host for this episode of COMMERCE NOW. Today, we are live from the TAG PIX event in Las Vegas. I'm joined today by a very special guest from First Data, Mr. John Campbell, Director of STAR ATM Acceptance.                                                                              

Welcome, John. I hope your experience here at TAG PIX has been a good one so far?

John Campbell:                 01:04                    

Yes, it's always a pleasure to be here at TAG's hut. This is actually my 13th year, and I look forward to it every year to get some great information from the vendors and the clients themselves.

Scott Harroff:                     01:15                    

Yeah. I think I've been coming here, John, for about 15 years. I've probably bumped into you one of those first early sessions. Great seeing you here every year for all those years, year over year. Hey, before we dive into some questions on reducing ATM related fraud, tell us a little bit about your background, positions you've held. What are doing these days?

John Campbell:                 01:36                    

I spent about 15 years working at Virginia Credit Union. I was a longtime TAG member. In a previous life, I was an accountant who actually settled the debit networks before jumping into ATM operations back in 2005. TAG attendee for 11 years. During those times, presenter and director on the TAG board from 2010 to 2015. Back in those days, I was responsible for the ATMs and debit processing for the credit union. These days, I work for First Data in Atlanta. I'm Director of STAR ATM acceptance for the STAR network and work closely with First Data processing ATM requiring side of the business, [ISOs 00:02:09] and [FIs 00:02:12]. I am currently a member of ATMIA, US Payments Forum ATM Work Group, and the National ATM Council.

Scott Harroff:                     02:17                    

So what you're saying, John, is you've been around a little while and you've seen a few things when it comes to ATM fraud?

John Campbell:                 02:22                    

A couple.

Scott Harroff:                     02:23                    

All right. Having been on both the FI side and now working for a transaction processor, how would you describe the state of ATM security today?

John Campbell:                 02:32                    

Fluctuating, evolving, and sometimes growing. We are better at what we used to do, but so are the bad guys. When I started in ATMs in the early 2000s, the biggest scares we had were the occasional ram raid and the old webanese loop capturing cards at ATMs before DIP readers came into existence. The move from OS/2 to Windows started bringing all sorts of different degrees of cyber attacks and logical attacks on software that we had never seen. But they were still sporadic and slow. But now it seems that even after all the security enhancements we've done, EMV, encrypted hard drives, point-to-point encryption, the attacks seem almost constant and even renewed. I think some of that's also from the fact that criminals are not just attacking the ATMs logically, but they've gone back to the low-hanging fruit and ram raids and cash trapping. The cashouts that made a lot of news the last couple weeks in the FBI. A lot of it were from best practices just not being followed that had been out there for years. It's still a very fluid environment.

Scott Harroff:                     03:40                    

Yeah. That's about the same thing I'm seeing. When you say EMVs out there, I just got done talking to customers where they were charged back several hundred thousand dollars, because they had made the decision, "Maybe I won't implement EMV. What's the worst that could happen if I don't spend all that money to do the upgrade to EMV?" I've had quite of few of them where they didn't spend the money, and now what's happening is larger financial institutions are coming back. They're saying, "Hey, we detected this fraud. The only thing in common is your ATM, so why are getting all these non-EMV transactions from our customers that have EMV cards off your ATMs?"

                                                                               

It's the same thing with TLS, John. I've watched TLS roll out. Your network was one of the early adopters of rolling out the TLS protocol. But at the same time, there was some really big FIs that are out there that still haven't turned it on. There's some big networks that haven't turned it on. It's interesting to me that some folks are really thought leaders in the industry and gets stuff done, and some others tend to be a little bit more of a laggard.

                                                                               

What security risk do you see as they pertain to FIs and processors, or even processes in communication protocols?

John Campbell:                 04:53                    

Well, I think, first, as an industry, what's really been hampering us is the fact that we have no problem jumping on the barbarian at the gate, but then we go back to sleep behind the walls. We're seeing that over and over again with skimming and then EMV. We ramp up, a lot of the earlier adopters go, and then we seem to just get lulled back into sleep.

                                                                               

I take it back to Ploutus coming out with the malware when those were rearing its head in the 2013 timeframe. Diebold and other industry leaders came out and said, "Here's best practices. This is what you need to implement to protect yourself." And it got quiet. In early 2018, suddenly a variant, Ploutus-D, comes out. It hits some ATMs in the country, and everyone's panicking. Everybody's freaking out. "What do I need to do?" And you're sitting there thinking, "The best practices that would have protected you were put out there five years ago, and you just didn't do it." And some of them were physical, of top hat security, and some of them were logical, just default passwords. Somehow, here we are in 2018, and it's still a problem. That really blows my mind and that.

                                                                               

But one of the bigger steps I've seen that's actually moving the ATM industry in good spot is, as you were saying, that point-to-point encryption of the data between the ATM and the host to prevent man-in-the-middle attacks. Folks forget that, even in an EMV environment, there's still data that's visible out there. I mean, we're still in a US market that's routing by BIN tables, even though you have EMV protocol having it in the ATM. So whether it's an ISO ATM or a FI, you can still do man-in-the-middle attacks, still attack the data. So seeing MPLS communications at the routers and hosts was great, but now we need to protect those small spots where the criminals are still attacking. Because even with EMV, MFA, and tokenized PAN, there is no reason we should be sending any data in the clear anymore, and it's still happening. Those that have been, before, what you said, First Data and STAR, it's starting to pick up, but I'd like to see it pick up at a faster pace.

                                                                               

The ones that's bypassing all these security protocols is account takeover. It's still a real problem, and it truly does bypass that onsite security, whether it's logical or physical. I equate it to ... It's you can have all these gates and cameras and barbed wire, but if you still, through social engineering, allow someone to steal the proverbial guard's coat, they're still getting inside the fortress. They're still getting out. You don't have to beat the technology. You're beating the human element, and that's still a big problem for us.

Scott Harroff:                     07:28                    

Yeah. Speaking of human elements and things that have been out there for a long time. With all the technology that everybody puts out there, I still get phone calls. I wouldn't say on a regular basis. But every month or so I get a phone call about some institution would have done a transaction reversal at the ATM. They'll be balancing their journal, and they'll be looking at their host logs. And, "Why am I out $300 of cash? It shouldn't have been gone." What do you see at the network as far as transaction reversal best practices? Because, John, in my mind, it's something that, between the ATM and the transaction processor, we should have been able to get rid of a long time ago. But I still get customers calling me on this.

John Campbell:                 08:12                    

Well, we still have ... In the industry, it's always been cardholder customer-centric. How do I protect the cardholder? Reg E is built all around that. And of course, that's what the criminals are manipulating. The TRF is a very low-tech scam. The criminal manipulates the ATM into thinking there's a fault while simultaneously breaching the dispenser shutter to grab the cash. But the way that the networks and the ATMs are set up, all it knows is there is a fault. "I don't think I've actually dispensed cash or I can, and, therefor, I need to reverse the transaction." So the debit is reversed, the bad guy walks away with the cash, and then can continue on with this fraud that they're probably getting at ATM and ATM.

                                                                               

We've heard a lot about this from the European market more, especially in 2015, but it's creeping in again. Just like Ploutus and other sorts of attacks, they start other parts of the country, and the US continues to be the soft underbelly. So the current SOP for conducting this fraud is defined. Deployers who've gotten motorized ATMs, they are to set up for card before cash. And of course, the industry did this in response for EMV. I don't want the cardholder to leave their card, so I'm going to make sure the cardholder takes their card before I can give them their cash. I'll stage it behind the shutter. And then, as soon as they take it, I'll give them their cash. The bad guys know this. They test out ATMs. They can hear the dispenser cranking out. They can hear the money behind the shutter. Ant then, it doesn't take a whole lot for them to go manipulate the hardware and then obtain the cash. It's reversed again, as we were talking about before. And then, they run to the next ATM, or they just do the transaction multiple times.

Scott Harroff:                     09:53                    

Yeah. I look at the problem pretty much the same way you do, John. We've released XFS updates that would minimize the impact to the customer. I know First Data and a lot of other networks that are out there can turn on things inside the configuration and say, "If this occurs, then let's hold this for 24 hours, so we can verify whether the cash has been withdrawn back in. If it's been withdrawn back in, did we get all of it? Or did we just get a receipt that came back and looking like a piece of cash?"

                                                                               

I know that we have a lot of technology. One of things I wonder about is, how can the industry as a whole, through events like TAG PIX, educate these customers on all the things about the deployers can do, as well as the networks. It would be interesting, I think, to get together a group of people that could really sit down and communicate this is a way that everybody understands the problem and everybody understands some solutions before something bad happens and they come back to us. I know what we can do as Diebold. What do you think processors might need to do differently to help prevent these kinds of attacks?

John Campbell:                 10:57                    

Well, I know that a lot of ATM deployers have actively monitored transactions reversals and card jams. They've put in some logic. But I relate it to what we're seeing. And fallbacks, as well. There's no consistent idea of what's the best way to combat the fraud. You have some FIs on fallbacks who go and decide, "I'm declining them all." Some, "If it's under 100." So you see the same thing with these transactional reversals. There's no unified idea of what's the best way to combat it.

                                                                               

I think that these acquirers and issuers need to go back to what they were doing with skimming, which was regularly inspecting their shutters for damage, monitoring velocity of reversals. Issuers, education their issuers. Because the processors can help by, when they're implementing these ATMs, educate. I don't think they can just leave it up to the manufacturers. I don't they can leave it up to PCI. I think, we as processors, we as networks, need to be advocates. We can't just be rails that the transactions are running on. We need to actually be advocates for the issuers and acquirers to help them almost help themselves when it comes to these types of fraud.

Scott Harroff:                     12:15                    

Yep, I agree with you, John, 100%. We talked about a lot of different kinds of fraud events that are out there. Are there any other kinds of fraud attacks that you're seeing recently? Any other kind of things that the folks out there listening, Commerce Now, should really be thinking about?

John Campbell:                 12:31                    

A lot of what we're seeing now is the criminals trying to figure out, "How do I get around the security that's becoming more inherent at the ATM channels?" So they're going back to, "Let me attack lower security at certain financial institution's banking core. Let me go after mobile apps that were deployed years ago and haven't kept up with third-party authentication."

                                                                               

There was an article a little ago that talked about cardless transactions and fraud. The way it worded, you almost thought that the transaction, the ATM interaction, was the problem. When you read in depth, that's not the case. It really was social engineering. Again, the human element. These accounts getting taken over. They're importing a new phone number, a new email address, and then, they don't have to get around the security. They've taken over the entity. They've taken over the person. The cardless transaction now is just a funnel for them. They don't have to beat the ATM. They don't have to beat the networks. They don't have to beat the processor. They beat the human. By doing so, they're bypassing all this wonderful security we've put into place in EMV and firewalls. They don't. They've gone back to, truly, stealing an identity. They've just done it in a cyber fashion.

Scott Harroff:                     13:47                    

Yeah. We spent a little bit of time talking about technology. We've spent a little bit of time talking about processes. You just spent some time talking about social engineering defeating the human element. There's another area that everybody likes to hear about. What is happening with regulatory compliance or new standards that you think might actually reduce fraud at an ATM or on an ATM network?

John Campbell:                 14:11                    

This industry is definitely closely watching the increasing move of state regulatory initiatives. Obviously, the constituents complain to their legislature about fraud hitting the local bank, the local credit union. They have taken it upon themselves to start introducing legislation. They feel, "Well, Federal Government's not doing enough." Or, "The industry's not doing enough. Fine. We'll put in some rules." Whether it's physical security, about cameras and vestibule locks.

                                                                               

One of the ones that we've seen recently was a skimming sticker being put on ATMs, which, as soon as I saw it, being a former deployer, I just cringed to think, "We've spent a decade trying to get surcharge stickers off of ATMs, and now a state wants to have one on every ATM, fine people for it." Any ATM deployer knows issuers are not reading stickers. You can put, "Don't insert coin," on a deposit automation ATM, and I had someone tape four quarters to a piece of paper one time.

                                                                               

So stickers aren't the issue or the solution. What you really want is, "Fine. You want to help us, states? Then help us do some education programs between the FIs themselves, the cardholders." We have PSAs out there. Let's educate them about fraud and skimming, but let's do it on things they're looking at, social media, out on TV. My gosh, we're a country that's glued to binging on Netflix. Let's put something on there and educate on the things to look for. Legislating it and punishing the acquirers is not the way to go. It's educating the public to be more diligent when they actually visit ATMs.

Scott Harroff:                     15:50                    

Yeah, I agree with you. I get all kinds of questions from about 1,300 customers around the United States that are small to medium-sized and handfuls of large ones that come back and say, "What have you heard about this?" And, "What have you heard about that?" Often, the regulations or the standards or a bill that somebody has generated is the subject of that.

                                                                               

I remember a certain state where they decided to resurrect the old things of, "Well, if you're at an ATM and someone's about to hijack you, put your PIN in backwards, and that will summon law enforcement and save the day." John, have you ever seen any host actually responding to putting a PIN in backwards as an emergency signal?

John Campbell:                 16:34                    

Yeah, that's one of my favorite. Whether it's Facebook, Instagram, an email, I'll see this. I've actually saved on my phone a picture with a big, red X through it that has this warning. And it's always someone who's trying to do good. They're trying to inform their friends. And then, I have to go repost on Facebook or some other media of, "This is an urban myth. You cannot do this." I'll even explain the history of it. "There was a programmer in '90s. He wrote this." And I also explain, "We also had panic alarms at ATMs in the '80s, and all of law enforcement was changing around ghosts and came back."

                                                                               

If you actually the 2010 Card Act, there's a line item. I think it's the last one where the government said, "We have to do a study on reverse PIN." It had gotten to the point where people believed it enough where it became a line item in a bill. They gave them 13 months. It came back. Like we all know, the industry, law enforcement, the processors, hardware, all went, "We can't do this. This doesn't make sense. You're going to hurt people." Most folks can't remember their PIN going forward if you asked them that. Much less, I have to remember in reverse when someone's pointing a gun at me. By the way, what do you do when the PIN is 1441? We have a problem there.

                                                                               

It's one of those. It's a great idea. But when you put into the context of human beings, multiprocessors, multi-nodal networks, and by the way, the police still have to respond to it. It's just not the way to go. But, yes, whenever I see that, I start laughing, because it's one of those, "Okay, let me update this same post I've done every six months for the last 10 years."

Scott Harroff:                     18:06                    

Yeah. Thanks, John, for spending time with us here today. Thanks for all your valuable information, both as a customer and now as a ATM transaction processor. Thanks so much for being here today with us at TAG PIX.

                                                                               

And thank you to the listeners for tuning in to this episode of Commerce Now. To learn more about reducing ATM fraud and how financial institutions can better protect themselves against these attacks, log in to DieboldNixdorf.com. Until next time, keep checking back on iTunes or your podcast listening channel for new topics on COMMERCE NOW.

 

 

 

Overview:

In this episode we will discuss how Financial Institutions can bridge the physical and digital worlds to create a convenient, unique experience for their customers.

Resources: 

Blog:

COMMERCE NOW (Diebold Nixdorf Podcast)   Diebold Nixdorf Website

Transcription:

Amy Lombardo:                00:00                    

Hello again, this is Amy Lombardo, your host for this episode of COMMERCE NOW. Our title is cleverly named Human Vs. Machine: How Can They Coexist? And I'm joined by Chris Gill, our Senior Director of Global Advisory Services. We are going to have a conversation all around the concept of the human interaction and how it finds that balance with the ATM. Hey, Chris.

Chris Gill:                             00:00                    

Hey, Amy.

Amy Lombardo:                00:28                     

Thanks for joining me.

Chris Gill:                             00:29                    

Glad to be here.

Amy Lombardo:                00:30                    

Before we start with our questions, let's just talk about the term "branch transformation," okay? It's been the buzzword in the financial industry for, what, 10 plus years?

Chris Gill:                             00:41                    

Mm-hmm (affirmative), mm-hmm (affirmative).

Amy Lombardo:                00:43                    

In 2018, what does branch transformation mean for bankers?

Chris Gill:                             00:48                    

Well, I think increasingly it really means the transformation between the physical as well as the digital channels. I mean, 10 years ago, if you thought about branch transformation, we didn't have the adoption of mobile banking back then and as much online banking, and the sophistication of what you can offer on a self-service device today. Branch transformation today means, I think, something different than it did 10 years ago. It's really about that connection of the human versus the physical channels in a branch environment, and how you transform not only the technology, but also the way you engage with customers and the experience that you provide is really part of what branch transformation is all about today.

Amy Lombardo:                01:30                    

Even though it means something different, it's still relevant, right?

Chris Gill:                             01:35                    

Yes.

Amy Lombardo:                01:36                    

You're still having the number of conversations that you would have had 10 years ago, it's still the same now, right? It's just bankers are asking for maybe different solutions, different recommendations?

Chris Gill:                             01:48                    

Well, the reason why it's still relevant is still that a significant percentage of institutions have not yet transformed their branches. Because there are a lot of legacy branches, older branches where it's not as easy to transform those as opposed to newer locations. If everyone had transformed their branches, we wouldn't be having this discussion today, but a lot of institutions still haven't made the difficult decisions to really change the way their branches operate today.

Amy Lombardo:                02:17                    

If they haven't made those decisions, is it because of the size, the number of locations that they have? Does that play into it as well?

Chris Gill:                             02:27                    

Well, for some institutions that maybe have a lot more branches, that could be a factor. I do think a lot of it is around the leadership of the organization and the strategy they want to pursue ...

Amy Lombardo:                02:38                    

Got it.

Chris Gill:                             02:38                    

... and their willingness to make some hard decisions and move forward with a new program. There's a lot of inertia in the banking industry that just leads to the pace of change taking a long time. Also too, there are a lot of legacy systems that impact your ability to transform your branch, and making changes to those is very time consuming, so a number of different factors.

Amy Lombardo:                03:00                    

Got it. Okay, so you and I, we're sitting together, we're here in Las Vegas. We happen to be running this podcast live from our TAG picks event. I'm looking over some of the content of a presentation that you had given, and we're talking about an FI's having a comprehensive analysis to help understand their branch technology roadmap. You are talking about four steps in this technology roadmap. Can you walk-

Chris Gill:                             03:29                    

Sure.

Amy Lombardo:                03:29                    

... our listeners through what those for are and what it means?

Chris Gill:                             03:33                    

A successful branch transformation plan really requires upfront analysis around your client segments. How do they transact with each day? How is it different from one branch to the next? Understanding your markets and the characteristics of consumers and businesses in those markets. Then from there, it's really understanding how your branches operate today, and what kinds of transactions are your customers doing in your branches? Because that will have an impact on What kind of technology you need to deploy and the kind of functionality that you offer as part of that, so understanding branch operations is important.

                                                                               

Then from there, once you've done the in-depth analytics, you can really identify key opportunities to move forward with to transform your branch and digital channels, and understand which of those are higher priority to implement than others. Then the fourth step is then, develop really a multi-year roadmap on how to move forward in kind of what order. Then looking at the return on investment on the plan that you've come up.

Amy Lombardo:                04:32                    

All right, so let's talk a little bit about the analysis part that you mentioned, that first part. Can you review some options that FIs have when they're executing a transition to different types of branch technology?

Chris Gill:                             04:45                    

I think most institutions do not really understand that there are some customers that are more self-service oriented and there are others that are more branch oriented, and how that varies from one branch to the next. Because if you have a branch or in a market area where you have a high concentration of, or self-service oriented kinds of consumers, then your strategy in a market like that needs to be different than in a market where you have a lot of people that only come into the branch and don't use self-service. The kind of technology you deploy and the kind of people you want to have in those different branches needs to be different. You need to have that in-depth understanding of your customers and their transaction characteristics in order to come up with that strategy.

Amy Lombardo:                05:29                    

Okay.

Chris Gill:                             05:30                    

Because if you don't have that, then the risk you run is you're deploying new technology in a market where your customers are not ready for it. Then you don't get the adoption and return on that investment. Or you roll out one new technology in a market, but those customers at that market also use another branch that doesn't have that technology. It creates this customer confusion, and is an inconsistent experience from one location or one ATM to another. It's important to really understand how customers use different locations.

Amy Lombardo:                06:08                    

Right. How would you mitigate that risk then of, I would almost say, call it consumer confusion of what they need to do when they walk into a branch or they go up to an ATM?

Chris Gill:                             06:20                    

Well, I think the key is, number one, doing the in-depth analytics to know and understand your customers in a greater level of detail so that you have the right plan that addresses that cross- branch, cross-ATM usage. Then secondly, from an implementation point of view, you need to have the programs in place so that the people in one location are doing the same, demonstrating the same behaviors and the same processes that they do in another location. I mean, no different than walking into a fast food restaurant or chain and you have a different experience in one part of town than you do in another. That would not be a good experience. Certainly in banking, you want to have a similar experience across locations.

Amy Lombardo:                07:03                    

We've talked about it a little bit from the consumer side to say, "Okay, consumers have different ways to engage with the channels," but take a step back from the operational side. What are the benefits to the actual financial institution by going through a branch transformation strategy?

Chris Gill:                             07:22                    

Well, there are obviously several. Obviously, number one is better managing your costs. I mean, if you look at branches overall, for most institutions, the branch represents anywhere from 60 to 70% of their total operating costs. In a very competitive environment where growing revenue can be challenging, better managing the cost base is key. I think costs are one. Secondly, if by enhancing the customer experience, you're going to potentially differentiate yourself against the other institutions in the market, and that can lead to helping you acquire more customers or strengthening the relationship that you have with the customers that you have.

Amy Lombardo:                07:59                    

Right.

Chris Gill:                             07:59                    

It's a combination of those two things, and costs and the enhanced experience leading to more revenue.

Amy Lombardo:                08:06                    

Got it? Yep. It's interesting, with all the social media that we have out there, I'll occasionally see posts where someone says, "Boycott these kiosks. Boycott this," whatever piece of self-service technology. "It's cutting jobs."  Really, what you're talking about here is that it's an opportunity to move people around, give different roles. Because that person who may have been operating that teller line maybe could be more suited for someone who's more in a universal banker role, right?

Chris Gill:                             08:34                    

Right, exactly. Well, and that's a question that often comes up where the branch staff may perceive that the technology is a risk to their jobs.

Amy Lombardo:                08:43                    

Yes.

Chris Gill:                             08:44                    

Why would they tell a customer to go use an ATM, "Because then they're not going to come see me, and then therefore I'll be out of a job," but it's your job ... What you need to tell the teller or the banker is that, "Your job is going to change, and we want you to spend more time talking to customers, and more time understanding their needs so that we can become a trusted advisor for the customer and not just doing it from a transactional point of view."

Amy Lombardo:                09:10                    

Right.

Chris Gill:                             09:10                    

Because ultimately, loyalty to a financial institution is going to be much more around the relationship and the value that the institution provides in managing your finances, than it is going to be for doing a transaction and making a deposit. That's not a loyalty generating type of interaction.

Amy Lombardo:                09:30                    

Chris, why don't you tell me a little bit now about some of the specific technologies that banks can deploy that can enhance that experience, but also find that balance between the human and the terminal itself.

Chris Gill:                             09:42                    

Sure. I think there are really three technologies that institutions are looking at to really leverage technology, but with that kind of human touch, human interaction. Some institutions are moving more to this assisted service kind of model where they have in-lobby, self-service devices that provide more advanced functionality, and they have a person in the lobby who would greet a customer and then show them how to do their transaction on the self-service terminal. No different than at the airline, at the airport where at an airport, a gate agent is going to show you how to use the kiosk-

Amy Lombardo:                10:20                    

Use the kiosk, to check it. Yeah.

Chris Gill:                             10:21                    

... Or in a fast food restaurant where they have a self-service ordering, where there's someone there to help you.

Amy Lombardo:                10:26                    

You know what? Sorry to interrupt you for a second, but I made that connection in my head that there are so many of these retailers, almost, they're like indirectly helping train-

Chris Gill:                             10:39                    

Exactly, exactly.

Amy Lombardo:                10:39                    

... banking consumers, because that technology might not be as relevant or as often seen in branches, but any McDonald's you go into now you've got the kiosk.

Chris Gill:                             10:52                    

Well that's the thing. Like you go into any Home Depot, any Lowe's, any Giant Eagle or whatever supermarket, they have the self-service technology-

Amy Lombardo:                11:00                    

Scan and go.

Chris Gill:                             11:01                    

They've got four to six kiosks and they have someone there. If you're having a problem swiping your lettuce, they can come in and put in the code. I mean, so these other industries are really paving the way for banks and creating ways to do things differently.

Amy Lombardo:                11:15                    

Have you found that to help you then in your consultation services, that the bankers can make that connection to these other industry examples?

Chris Gill:                             11:26                    

Well, and again, I think there's all the bankers you talk to, they get that because they see that in their daily lives, but making the leap from that to changing your branch is a big chasm.

Amy Lombardo:                11:39                    

Right.

Chris Gill:                             11:40                    

Because a lot of people ... Well, that's going to require changing a lot of things. Because Sally, the teller, that's working in that branch today may not be the right person to be in that branch and, "We may have to make some personnel decisions, and we may need to remodel the branch, and change some of our policies," and so on and so forth, "Change the facilities ..."

Amy Lombardo:                12:00                    

That's a good point, yeah. 

Chris Gill:                             12:01                    

There's a lot of ... Branch transformation is not easy. It's funny though, because it just seems like, it just seems logical that we ought to do that then.

Amy Lombardo:                12:08                    

Or people just think, "I'll just swap this piece of technology, and then it'll work."

Chris Gill:                             12:12                    

Right. 

Amy Lombardo:                12:13                    

There's, yeah ...

Chris Gill:                             12:13                    

Yeah.

Amy Lombardo:                12:14                    

It's a fine line, It's a balance, right?

Chris Gill:                             12:16                    

Right, right. Yeah.

Amy Lombardo:                12:17                    

Okay, so you were giving me some examples. So ...

Chris Gill:                             12:20                    

Right, so ...

Amy Lombardo:                12:21                    

We went on the tangent about the kiosk.

Chris Gill:                             12:23                    

Right, so there are in-lobby, self-service devices that are in the lobby of a branch. Customers come in and they're greeted, and then the branch staff can walk a customer over there and show them how to do the transaction in a self-service fashion. One of the things that we've learned are, consumers like to learn from someone that they trust that can, who can enthusiastically show them how to do things a new way. If you just point someone to an ATM and say, "Oh, just do it over there," the rate of adoption is going to be much lower. If you have a well-educated, a knowledgeable, enthusiastic employee who can talk about the new way of doing things, that makes that level of adoption that much higher.

                                                                               

One model you'll see in the lobby, self-service. Another would be upgrading ATMs to more advanced functionality, whether it be check imaging, so removing the envelope. Or personalized screens, so you can select your fast cash amount and not have to change that every time. There are a number of things you can do there. Then the third thing is adding a video dimension on an in-lobby or an ATM, so that you can talk to a video agent in a call center if you need help doing a transaction. Or in some cases, they can do the transaction for you.

Amy Lombardo:                13:36                    

Okay, so video is my like hot topic, because I had a conversation with a gentleman this morning and asked him his view on video. Now, you share with me the Chris Gill view on, to a video at the ATM. Is it here to stay? Is it ... What's our value prop there?

Chris Gill:                             13:58                    

The most successful institutions with video to date, video has been a key component and it's been well integrated into their overall delivery strategy. There's one institution that basically eliminated tellers at all of their locations and replaced them with video, and that was a key part of their strategy. What doesn't work is what I would call "lemming behavior," where just because another institution in the market has video means you need to add video. That is not a recipe for success. Again, going back to the beginning of the podcast where we talked about having a strategy and figuring out what makes the most sense for your network based upon your customers and the markets and your branches, you have to do the same thing when you're thinking about video.

Amy Lombardo:                14:45                    

Got it.

Chris Gill:                             14:45                    

Because if you have, if you operate in a market where you have a high concentration of younger consumers that are more likely to be amenable to video, as opposed to an area with a lot of older consumers that are the least likely to want to use video, then you need to know that going in, rather than just making ... Video is not a one size fits all, do it everywhere kind of solution.

Amy Lombardo:                15:09                    

Got it.

Chris Gill:                             15:10                    

Okay. Then, so there are some specific use cases that we think are more relevant. For example, video in the drive-up. Converting all the video or all the pneumatic tubes to video lanes, and you'll have a consistent video transactional experience in their drive-through can help improve efficiency and reduce the costs. Or if you are building a newer branch and you don't want to have five staff there, you could have video terminals doing the transactions, and you have two or three staff there that are there for account opening and the like. There are different use cases for it, but we would argue that there are other enhancements in self-service that would drive a better return. Things like denomination selection, in core integration and personalization. Enabling check cashing, tablet integration, that would enable other transactions like over the limit withdrawals and such. If we're looking at it from an ROI basis, we would suggest there are other options that would drive a better return than video, in most cases.

Amy Lombardo:                16:17                    

Got it. Had to ask you on the video. All the technologies that you've talked about here, you've worked with the institution, they've defined some of these steps and they're going into the actual implementation. Talk a little bit about the staff side of it now, and how you kind of define that ideal experience then.

Chris Gill:                             16:40                    

Well, when you're deploying new self-service technology, there a number of key factors that you need to be thinking about. One is really around the whole experience you want to provide in a branch that's got different self-service elements, and defining the experience, defining the customer journeys, and then creating the appropriate lobby management strategies so you're engaging customers when they walk in. There's a whole experience in process element. Secondly, is really around preparing the employees for that new environment. The third is around where you place the technology, and what kind of functionality is available on those devices.

                                                                               

Just speaking about the employing readiness specifically, what we have found is that way more often than not, branch staff do not use the technologies that the financial institution actually offers, whether it be using the ATM for depositing, or making a mobile deposit, or doing person-to-person payment.

Amy Lombardo:                17:35                    

Really?

Chris Gill:                             17:35                    

It is shockingly low, the incidence of branch staff actually using those technologies. My team, we've actually done surveys, starting a project to branch staff, and we found like 80 to 90% of branch staff have never made a deposit on an ATM.

Amy Lombardo:                17:52                    

Wow.

Chris Gill:                             17:54                    

Yet, this institution is rolling out-

Amy Lombardo:                17:56                    

They're trying to introduce this.

Chris Gill:                             17:58                    

They've already rolled it out-

Amy Lombardo:                17:59                    

Oh, boy.

Chris Gill:                             17:59                    

... and their staff still 80 to 90% don't use it. Or there's another bank that we work with that told us that only 1% of their branch staff ever made a deposit on the mobile phone, on their bank's app. Again, the branch staff are the biggest drivers of customer adoption of your new solutions. If they can't, they don't use it and can't explain it, then how are they going to talk to a customer about it?

Amy Lombardo:                18:25                    

It's like putting a fancy stand mixer in your home, but you've never made cookies before.

Chris Gill:                             18:30                    

Right.

Amy Lombardo:                18:30                    

Right?

Chris Gill:                             18:30                    

Right. Exactly, exactly. Multiple things to consider here. Number one is, how do you use, how do you do the transaction? What's the Screen flow? First you put the check in, then it's going to give you an image on the screen. You confirm, so on and so forth. You have to understand that. The other thing is you need to understand, what if there's a problem? Like what if the check were to jam or the cash jams, what happens there? Because if the branch staff are uncomfortable in how to resolve the issue, then they may not be comfortable talking about it at all. They need to be comfortable with both the functionality, the troubleshooting and then also importantly, they need to understand you can't talk about technology in the same way to a millennial that you talk about it to a 70-year-old person.

Amy Lombardo:                18:30                    

Yes.

Chris Gill:                             19:16                    

You need to have a different way of explaining the technology. A lot of these branch staff that are more millennials, they can't talk to you about the technology in the same way they would talk about it with one of their parents. Again, I think it's imperative that number one, you train the branch staff on how to engage with customers. How to leverage the technology and how to deliver it in such a way that you're not forcing them to use the technology, but you're providing a value add so that the customer feels like you're adding value to their relationship. Beyond that, it's also important, you want to make sure you have the right people in the branch with the right skillset. Right?

Amy Lombardo:                19:59                    

Yes.

Chris Gill:                             20:01                    

One of the things we advise our clients is that ... One of the key job requirements in a job description needs to be, "Must be knowledgeable in ATM, online and mobile banking." You'd be surprised at how few job descriptions we come across actually have that as a job requirement.

Amy Lombardo:                20:16                    

Oh, that's a good point.

Chris Gill:                             20:17                    

Right?

Amy Lombardo:                20:17                    

Right?

Chris Gill:                             20:18                    

Yeah.

Amy Lombardo:                20:19                    

Or, likes to talk to people.

Chris Gill:                             20:21                    

Right, right. Then just another side note, interesting. As a leader of the bank and the credit union challenge the leaders to actually ask their staff, "To what extent do you use ..." The leaders on their team, "To what extent do you use these technologies?" Because we've heard stories of the head of retail banking asking his direct reports to show their mobile bank's mobile app and most of them could not do that.

Amy Lombardo:                20:47                    

Oh, ouch.

Chris Gill:                             20:48                    

If the leadership don't use your app then-

Amy Lombardo:                20:51                    

Yeah, sure. Leads by example, right?

Chris Gill:                             20:52                    

... It's not sending a message, an example for the rest of the organization.

Amy Lombardo:                20:55                    

Right.

Chris Gill:                             20:56                    

I also think we need to be thinking about customer journeys. It's one thing to talk about delivering a great experience, but what does a great, what does a customer journey look like? It's one thing to talk about customer experience at a high level, but it's important to really think through like, "What are some of the more important journeys that your customers engage with you on?" Coming into the branch, make a check deposit, and what does that journey look like from the time they enter, to the time they do the transaction, to the time they leave? What does that look like today versus what would you like that to look like in the future? Then, what are the people, process, design and technology requirements to deliver that journey? It's important to really map that out.

Amy Lombardo:                21:35                    

I think that's probably a good way to close this conversation. The people, the process, the technology .... I lost the fourth one.

Chris Gill:                             21:35                    

Design.

Amy Lombardo:                21:42                    

There we go, design. That you really need to consider all those components here when when you're looking to engage on a branch transformation project.

Chris Gill:                             21:51                    

Exactly.

Amy Lombardo:                21:51                    

Thank you, Chris, for joining me. Happy birthday to you.

Chris Gill:                             21:51                    

I thank you, thank you.

Amy Lombardo:                21:55                    

I just learned that as people are walking by. They're wishing you a happy birthday, so you're in Vegas. You can go live it up tonight.

For more information on branch transformation, go to DieboldNixdorf.com, and keep checking in for next episodes of COMMERCE NOW.

 

Overview: 

As the tax against self service endpoints evolve to be more complex, and many financial institutions struggle to keep up, there's a growing demand for security management services in the industry. In this podcast, you will hear about this trend and what it means for financial institutions. 

Resources: 

Blog:

A look at how ATM security has changed … and how it hasn’t

ATM Security Management: Know Your Options

COMMERCE NOW (Diebold Nixdorf Podcast)   Diebold Nixdorf Website

Transcription:

Amy Lombardo:                00:00                    

Hello again, and thank you for joining us on this episode of Commerce Now. As the tax against self service endpoints evolve to be more complex, and many financial institutions struggle to keep up, there's a growing demand for security management services in the industry. Today I have the pleasure of being joined by Julie Osborne, our Global Vice President of Diebold Nixdorf's Service Portfolio, and Martin Nearhos, Principal Security Architect for the Global Services Portfolio Division as well. We're going to hear about this trend and what it means for financial institutions. So, hello Julie and Martin. Thanks for being with me here today.

Julie Osborne:                   00:38                    

Thanks Amy, it's a pleasure. Thanks for having me.

Martin Nearhos:               00:41                    

Yeah, thanks Amy. Happy to be here.

Amy Lombardo:                00:44                    

Okay. I'm really excited here, because I'm based here in the US, but I'm talking to two subject matter experts who are in our Singapore office. It's great to just have this global view on this security topic. So, let's dive in here. Let's start with just a high level question on why do you think financial institutions are having difficulty managing their self service security?

Martin Nearhos:               01:10                    

That's a good question. Maintaining the security of the customers' assets and information has always been a high priority for the industry, but threats against the self service banking channel have evolved. It's now much harder to keep up. A tax against ATMs have traditionally been isolated to geographic regions, and slow moving out of those regions, but this is no longer the case. We're now seeing increasingly complex attacks, such as various forms of jackpotting, taking place across the globe, and at the same time the threat of traditional physical attacks hasn't really gone away. It's a lot to combat.

Julie Osborne:                   01:47                    

If I might just add to what Martin said, financial institutions usually don't have the time or in-house expertise to keep security measures up to date. As retail banking paradigms shift, banks and credit unions are under a lot of pressure to do more with less, and even if financial institutions wanted to hire in-house security specialists, as businesses and governments fight cyber security threats, these resources tend to be really expensive and in high demand. Also, as we all know, this constant pressure to stay compliant with security regulations and industry standards, ATM security service providers can help relieve the burden of staying on top of changes and staying protected against attacks.

Amy Lombardo:                02:28                    

Okay. Got it. Martin, if I can ask this to you before we jump into this whole idea of doing more with less, since you're located in the Asia Pacific region, are there certain types of attacks that you're seeing on the rise today? We talked a lot about jackpotting in the Americas, but could you give us an idea of maybe what you're seeing over in your region?

Martin Nearhos:               02:51                    

The Asia Pacific region is quite diverse. You've got many different markets at many levels of maturity, so it varies. Locally you won't get, say Singapore, there's a certain limit to attacks, whereas in other countries very close by, you've got a much broader range of attacks. It's complex and it doesn't move.

Amy Lombardo:                03:15                    

Got it. Yeah. It sounds like no matter where you are, just keeping on top of that security is always going to be top of mind here.

Martin Nearhos:               03:22                    

Yep.

Amy Lombardo:                03:23                    

Okay. Let's talk about this idea of doing a little more with less. When we're looking at it from a financial institution standpoint, can we talk a little bit about why they should be looking into outsourcing their ATM service and management?

Julie Osborne:                   03:37                    

Oh, absolutely Amy. I might take that one. It's becoming increasingly popular for FIs to work with organizations that have intimate knowledge of the ATM channel, and offer specialized security services as part of ATM fleet management arrangements. They will want someone who can offer 24/7 secure operation centers for monitoring, and who can also take care of all necessary maintenance, hardware and software upgrades, and updates for them. Some FIs don't have the capability in house to reliably maintain secure ATM environments, and others would just simply rather have someone else handle it because it is a specialist capability, as I said. So, if FIs are looking to take the burden off themselves and effectively manage the security services of the ATM  fleet, with an ATM security service provider such as Diebold Nixdorf, they should look for a provider who can deliver the following three things.

                                                                               

First, you'd want optimized security through 24/7 monitoring, proactive threat elimination, and an in depth understanding of emerging threats, to try and protect against attackers.

Second, you'd want increased efficiency, freeing the FI from day to day ATM security management responsibilities, or streamlining processes.

Third, you want a service that will effectively manage operational risk, to provide real time threat insights, and offer remote troubleshooting, and has a deep understanding of the industry requirements. Ultimately, I think the best approach is a multilayered security protection approach that offers real time information to ensure ATM networks are protected and available, whilst also providing the information FIs need for a [inaudible 00:05:17] ATM security audits.

Amy Lombardo:                05:19                    

Okay, got it. Those three points were really helpful here, especially in looking to determine your outsourcing, your Managed Security Services, but what does an engagement actually look like for an financial institution? What are some of the specific options, and what would it take to get a program like this up and running?

Martin Nearhos:               05:41                    

I can take that. If you're an existing customer, and you're already ready using sort of self service fleet management, which is just a suite of services designed to run multi-vendor self service devices cost effectively, the customer can sort of decide what level of protection makes sense for their organization, based on their risk profile and their operational risk. If you're a new customer, we'd look at all the fleet details that required. The ATM make, the model, physical location, that would all be analyzed. Then the customer would select the appropriate security service, and again, it's based on their business and operational risk. We suggest that whatever FIs choose is a core security service. The services offered should, at the very least, provide everything needed to comply with industry standards and requirements such as those developed by the Payment Card Industry Security Standards Council.

                                                                               

It should also include the hardening of various aspects of the ATM with remote monitoring and software patch deployment. It would also include things like device monitoring, secure connectivity, managed firewall, peripheral device control, anti malware, antivirus, and of course intrusion detection and prevention. Then the FI can have the option to build upon that basic level of services for such things as protection against complex logical system attacks. Although I would recommend this sort of protection to everyone, we know that financial institutions want to prioritize their investments in advanced security, and they just can't do it all at once. With these types of services, FIs can then rely on the security service provider to proactively monitor the ATM for suspicious activity, protecting terminals more effectively in real time, responding quickly when attacks are detected, and engage with customers to resolve the incident, and take the burden of managing the self service fleet off the FI, who, as we've already said, may be stretched pretty thin on resources.

Amy Lombardo:                07:42                    

So Martin, if I can ask you a question here just based off of the compliance portion, the regulation portion of what you mentioned, I would think that's pretty important, almost as a value added services as well, that your security partner could provide you almost with the consultation, the education, on what all these requirements might mean for your institution. Am I thinking about that the right way?

Martin Nearhos:               08:11                    

You are. There's some industry standards that, across everywhere, but what happens is you get into regional areas. Some have slightly different requirements, so as a global offering, it's quite difficult, but we have specialists in all the major regions that could offer that service.

Amy Lombardo:                08:29                    

Okay. Thank you. Okay, so to close out this topic, have you heard how customers are responding to these types of Managed Security Services in the industry today? Are they able to focus more on their customers without the burden of managing their own ATM security services then internally? Julie, how about you take that one?

Julie Osborne:                   08:51                    

Thanks Amy. Actually we have. We've seen some very positive results from the financial industry. Threats against the self service channel aren't going away anytime soon, but with Managed Security Services, financial institutions can spend less time trying to prevent attacks, and spend more time with their customers growing their businesses, and ultimately that's where we want them to be.

Martin Nearhos:               09:11                    

And, just as the FI is focusing on on their customer, the security service provider, but it's got to focus on continuing to evolve and develop, because the expectations will continue to rise, and FIs will expect to be offered more value in the future as well.

Amy Lombardo:                09:29                    

Well great. This sounds like a no-brainer to me. I would want to stay protected and just not have that burden internally. Thanks Julia and Martin for being with me here today, and to our listeners for tuning into this episode of Commerce Now to learn more about Managed Security Services, and how FIs can better protect themselves. Log Onto DieboldNixdorf.com. Until next time, keep checking back on iTunes or your favorite podcast listening channel for new topics on Commerce Now.

 

 

Today, in so many of the headlines, retail technology is taking over and not only with digital purchases, but in the physical brick and mortar locations as well.  Retailers are looking for that “golden ticket” on how to give their consumers a better retail experience. Attending events with the newest technologies are key to staying ahead of the competition. We will discuss our overall impressions from last week’s shop.org event and what really knocked our socks off!

Podcast Summary:

No other crime is more romanticized by pop culture than the bank robbery, and no type of criminal more than the thief. Think Bonnie and Clyde, John Dillinger, the Sundance Kid and Butch Cassidy. What comes to mind? Tunneling under the bank, cracking safes, elaborate escapes, and adrenaline-filled action. However you feel about them, one thing is certain; those type of heists, no matter how notorious and exciting, are slipping in to antiquity.

We’ll probably never have another fated criminal couple like Bonnie and Clyde, or another escape artist and thief like John Dillinger, for the simple fact that their methods are outdated. Today’s criminal is more apt to attack from their home computer than at the teller window. They crack codes, not safes, and the only mining they’re doing involves data. In this episode, Scott Harroff and Dave Phister talk about cyber security, cyber criminals, and how industries can protect their data, their software, and overall – their cash.

Resources:

Blog: https://blog.dieboldnixdorf.com/our-commitment-to-you-as-your-security-partner/. 

DN website: www.dieboldnixdorf.com

COMMERCE NOW website: www.commercenow.libsyn.com

Transcription: 

Amy Lombardo:                00:00                    
No other crime is more romanticized by pop culture than the bank robbery, and no type of criminal, more than the thief. Think Bonnie and Clyde, John Dillinger, the Sundance Kid, and Butch Cassidy. What comes to mind? Tunneling under the bank, cracking safes, elaborate escapes, and adrenaline filled action. However you feel about them, one thing is certain: those types of heists, no matter how notorious and exciting, are slipping into antiquity. We'll probably never have another fated criminal couple like Bonnie and Clyde, or another escape artist and thief like John Dillinger, for the simple fact that their methods are outdated. Today's criminal is more apt to attack from their home computer than at the teller window. They crack codes, not safes, and the only mining they're doing involves data.

                                                                               
In this episode Scott Harroff and Dave Phister talk about cyber security, cyber criminals, and how industries can protect their data, their software, and overall, their cash. I'm Amy Lombardo, and this is COMMERCE NOW.

Scott Harroff:                     01:19                    
Hello again. This is Scott Harroff, your host for this episode of Commerce Now. The last time I was on this podcast I spoke with Bernd Redecker on what jackpotting could teach us. You'll find that episode on www.commercenow.libsyn.com iTunes or however else you listen to your podcasts. Today, I'm joined by Dave Phister, Director and product manager responsible for security at Diebold Nixdorf. Today we're going to talk about cyber security and touch on exactly what cyber security is from our perspective and how criminals are turning to digital means to acquire things like money and data.

                                                                               
Hello, Dave, and welcome. Thanks for joining today.

Dave Phister:                     01:56                    
It's a pleasure, Scott. Thanks for having me. I've been honored here since you're becoming a bit of a podcast regular, for you.

Scott Harroff:                     02:04                    
Well, thank you very much. I never knew being a podcast star was in my history, but I'm happy to roll with it. As I said, today our focus is on cyber security, and when you and I hear this term, we have a pretty good understanding of what it means between you and I, but a lot of times people think that it's all about foreign hackers stealing secrets. Can you give a little bit of color around our definition of cyber security.

Dave Phister:                     02:29                    
Yeah, I sure can. It's a great question, Scott, and a great point. I think simply stated, cyber is anything related to computers or computer networks. That could of course, include the internet, so then cyber security would be the measures taken to protect the computer or computer system against unauthorized access or attack. In our industry, that's typically been referred to as logical attacks, but they're really just attacks on the digital components of the ATM. As you know, the ATM contains a computer, a hard drive, uses a Windows operating system, has USB ports. It's a, amongst other things, a computer client hanging off of a network, much like a desktop computer at work. It just happens to be controlling a safe full of cash.

                                                                               
Strictly from a computing standpoint, the security controls required to defend the computing aspect are really no different than any other network, whether it's a national security system protecting those secrets, or essential server in a fortune 500 retail data center. The tools, tactics, techniques, and procedures to compromise, or hack, the components, are the same everywhere we look. So additional to a firewall, it needs other cyber security like encrypted hard drives, digital signatures, access controls, proper patch management.

                                                                               
I think this is where the industry has let down their defenses a bit. OEMs and financial institutions haven't taken enough care to maintain current technology and protect the software and computing assets of the ATM. In addition to protecting the cash, as you mentioned, data must be equally protected, specifically the computing components that process that data, else compromise is a matter of when, not if. I think one perception is that cyber security defends against a hack originating from cyber space, which would mean something remote. Though ATM networks are not connected to the internet, they still connect to a bank network somewhere, and I would remind our listeners that as recently as 2016, we witnessed an ATM attack. It was launched solely from a remote network, in this case the voice recording network was breached in Europe, the hackers navigated their way to the ATM segment, pushed malware down to the ATMs, and the mules were waiting for cash to dispense. Anything is possible as commerce, payments, and channels connect, Scott. More and more every day.

Scott Harroff:                     04:40                    
Great. Now that our listeners understand what cyber security is when we use that word, what sort of cyber security threats do our customers face, and what do you think the biggest risks are?

Dave Phister:                     04:50                    
As you discussed, Scott, with our colleague Bernd Redecker in the previous podcast, the jackpotting attacks we've seen recently in the Americas, they can all be categorized as cyber attacks. The January jackpot attack where they removed the hard disk, loaded malware, and replaced it was possible because the customer didn't employ hard disk encryption. It's a fundamental cyber control. Earlier attack took advantage of a weakness in a very old USB security protocol and would have not have been possible had the customer deployed the latest AAES USB security encryption.

                                                                               
Then as I mentioned, 2016 attack in the AP regions clearly executed remotely. There was no behavioral monitoring software installed, like a McAfee or Symantec or Bit 9, Binamic, so finally, one point here, Scott, financial institutions are continuing to see cyber attacks in the internet and the mobile arena as well. The mobile device is now a connected component to the ATM and now we're seeing financial institutions have cyber attacks against the mobile wallets in the internet banking services. Though the fraud redemption's occurring at the ATM, there's nothing the ATM can do to prevent it. It looks like a valid mobile EMV NFC connection, but the transaction is actually fraudulent.

                                                                               
What are the risks? Systems mostly in unattended operating environments. Systems that don't improve their top hat security with better locks, intrusion sensors. Anything with outdated hardware and software, old unpatched operating systems are the biggest risks. The example I like to give is there are so many ATMs out there running Windows XP. That's a very old, outdated operating system. Systems with no sign or encrypted software, or hard disk encryption, or just encryption in general. Anything that lacks access control and authentication enabled to protect the internal computing system. Lastly, as Bernd mentioned in the previous conversation you had with him, Scott, behavioral monitoring software. If it's not on systems today, systems certainly can be at risk. I think, Scott, you'd agree that a branch lobby system that's mostly attended may not need the same protections as a lesser attended system at convenience store, but on average we're simply not making it hard enough on the criminals, regardless.

Scott Harroff:                     06:59                    
Yeah, I completely agree with you on the thought of a lobby ATM being different than an ATM on a remote location, and since financial institutions don't have unlimited funds, the idea of I have to do all my security the same everywhere on every ATM is probably not the right approach. There's probably ways to do a better job of allocating resources. You've talked a lot about ATMs and ATM security, but at the same time, I look at it more of an ecosystem where the ATM is interacting with other things, especially as we move into the world of ATMs connecting into not only the ATM transaction processing system, but now they're connecting into cores and they're connecting into web servers and interacting with databases on a customer's network, and just as recently as last week I saw an alert coming out from the FBI where they're talking about now there's cyber attacks against financial institutions where the hackers are not really attacking the ATM in any way, shape or form. They're going in, they're attacking the core system, they're changing account balances, they're changing daily withdraw limits, and they're just using the ATM as a mechanism to get the cash out.

                                                                               
That's a cyber attack against something completely different that impacts the ATM, so I'm kind of wondering about your thoughts on how do you protect the end to end channel?

Dave Phister:                     08:18                    
Yeah. It's a great question. Certainly, as you indicated, there are many end points, or there are many attack points in the chain of the transaction sequence. You really have to identify the critical components, categorize those assets, and identify the risks, and then deploy the appropriate controls. Ideally, end to end security would protect the connection from the host all the way down to the ATM, as you know Scott, end to end security is certainly complex in itself. Requires additional support and resources from not only the ATM but from the host itself in the way of key management. I think ideally, in that world, we'll get to one day, but right now I think we have to focus on setting controls on the operating system, setting controls on the system software, setting application security software, setting the firewalls, and doing all the fundamental components at the ATM to protect the endpoint as we then focus on how the network now begins to converge into this world of connected commerce introducing mobile devices and other components in the ecosystem.

Scott Harroff:                     09:32                    
Completely agree with you, Dave. I think one of the other things that a lot of customers should look at, is not only their protective controls, and not only their detective controls, but what do I do when something does happen? What's my instant response plan. I've talked to a lot of customers in the last couple weeks where they're relying on something to protect them, but when they notice something bad going on, and I say, "Well, what's your instant response plan? How are you going to turn that account off? Who's going to do it at two in the morning? How quickly can you turn it off?"

                                                                               
All of a sudden I'm getting customers that are saying, "Wow, I really haven't thought about how we're going to handle everything after the event starts." I think having an instant response plan is also a really important part of this. Now that we now what the threats are facing our customers, let's touch on how FIs can combat those risks over all. Can you expand a little bit on this and talk about how FIs should be protecting them against physical, cyber, and fraud threats this year and next?

Dave Phister:                     10:29                    
Yeah, absolutely. I think certainly the comments you just offered with regard to having an incident response plan in place is certainly critical, by every stretch of the imagination. FIs certainly need to be focusing on that in the ATM space. At it's highest level, I think it starts in the boardroom, Scott. Security is a foundational part of the customer's user experience, and the trust in the brand, so an investment strategy must include security [inaudible 00:10:59] component. On average, that hasn't necessarily been the strategy. Don't get me wrong. We have plenty of customers, as you know, that do have progressive security investment strategies, but they're the minority by far, so it has to become a recurring percentage of revenue operation.

                                                                               
Second, technology refresh, it must become a normal recurring commitment. It changes to rapidly. We have to do a better job of deploying the latest software and hardware, because it's this software and hardware that enables the latest security features with the latest technology that the hackers, as you know, are definitely taking advantage of the latest technology, so we have to put ourselves in a position to defend against that pace. I think we need to recognize that from a funding and a budget perspective, criminals do have access to the funds, so we can no longer make that argument. We have to provide the funds and we have to maintain configurations in a current fashion.

                                                                               
Third, customers need to embrace a zero trust model and deploy layers of security. Prevent physical access to the top hat with proper intrusion prevention. That's layer one. Then deploy access controls to reduce privileges and force authentication. Layer two. Then encrypt communications and data that's flowing within the system. Then finally, as Bernd suggested, start deploying behavioral based security software that could detect abnormal behavior and respond appropriately in the event that one of those three earlier layers was circumvented and malware may be running on the machine.

                                                                               
I think in the end, these three components are how we can get the customers to improve their protections in the future, Scott.

Scott Harroff:                     12:50                    
Yeah. I agree completely. That's a lot of great information on how the financial institutions can protect themselves from attack. To wrap up our conversation Dave, let's talk about what's next. What developments have you excited on the security front?

Dave Phister:                     13:05                    
I believe there is an emphasis now on analytics in the industry. I think it's a long time coming. I think financial institutions can harness this ATM data sensing and respond to not only operational aspects of the ATM, but security risks as well. I think this working in accommodation with an ATM behavioral monitoring capability as an example, could certainly transform security at the ATM.

                                                                               
There's a movement on the mobile security front. We talk a lot about mobile interaction with the ATM. This is the next big user interface and the component to the ATM, certainly PCI has posted guidance, and deployments using mobile devices are happening today. We're seeing a lot of that usage increase, so we certainly need to focus on security around mobile devices. Then, the standards bodies are doing work as well, which I think is important. PCI is pressing for stronger cryptography to be used, like TLS instead of SSL, AES instead of Triple DES. I think maintaining current cryptography certainly will help defend the systems of the future, certainly when we consider that the attackers have access to the technology that could be used against it.

                                                                               
Biometrics is slowly making it's way to the conversation. I think we expect more in that space in the future, especially as it pertains to data privacy controls, so again, a lot of areas where I'm excited with regard to the industry, and then areas where security is a vital component in the industry as well.

Scott Harroff:                     14:47                    
Yeah, I agree, and I look forward to a time when the security controls and mechanisms are widely supported across all the platforms. Some of the networks that we work with are outstanding at security, and they have TLS implemented, and they have great fraud systems, and some of the others aren't quite there yet. I look forward to having a nice common platform where everybody's really on the same playing field and everybody's working together against fraud versus maybe institutions one, two, and three are doing their own thing, institutions four, five and six are doing something different. That's one of the things I look forward to seeing.

                                                                               
Is there anything else that our listeners should take away with today, regarding our conversation?

Dave Phister:                     15:28                    
Yeah, a couple final thoughts, Scott. First and foremost is communicate and share. We're in a global fight against crime, whether it's communication with PCI, East, ATMIA, secret service or the FBI, certainly we can talk about the latest FBI alert that we've seen in the news here in the last week or so. I think that's just another indication of sharing from the government side to the private side. This information, if shared, can be used in the global fight against fraud.

                                                                               
Then, secondly, I'm a big fan of the National Institutes of Standards and Technology. Many believe work like the NIST risk management framework applies only to federal systems, but that's not true. This work translates into the critical infrastructure in the banking industry, and their cyber security framework is the policy framework of computer security guidance for how private sector can asses and improve their abilities to prevent, detect and respond to cyber attacks.

                                                                               
Again, there's a lot of great work being done that can be embraced in the private industry by financial institutions. Then, I also encourage our listeners to visit the East security page and take a look at the cyber attack mitigation link. Very insightful information and guidance on cyber security beyond just the firewalls.

Scott Harroff:                     16:51                    
Again, thank you Dave for being here today, and to our listeners for tuning in to this episode of COMMERCE NOW. To learn more about cyber security and how financial institutions can protect themselves against these types of attacks on digital systems, log into DieboldNixdorf.com.

                                                                               
Until next time, keep checking back on iTunes or your podcast listening channel, for new topics on COMMERCE NOW.

 

Podcast Summary: 

Procrastination. It’s a mysterious, sometimes crippling force that allows us to avoid undertaking and completing important tasks. And we’re all guilty of it on some level. Sometimes it’s due to anxiety. We’re anxious about the workload, or we’re unsure how we, or others, will feel about the finished product. It can also be due to perfectionism. We expect so much of ourselves that we delay a task as long as possible because we’re scared that, once it’s completed, it won’t be to our standards. Or it can simply come down to our emotions. We just aren’t in the mood to take on the task today, so we put it off.

Normally, procrastination is harmless. The work gets done, eventually, right? But when it comes to financial institutions and their software, the art of procrastination has some serious drawbacks. From security issues to a lackluster customer experience, neglecting to update their operating systems until the last minute can cause a bigger headache than they bargained for.

On today’s podcast, we’ll be talking about the upcoming Windows 10 software migration, and how financial institutions can look at this event not as an obstacle, but rather as an opportunity, and how banks, credit unions, and other FI’s can leverage the migration to their advantage.

Resources: 

Blog:

Windows 10 - An opportunity not an obsacle - 
https://blog.dieboldnixdorf.com/windows-10-an-opportunity-not-an-obstacle/

Windows 10: Your Migration FAQ - https://blog.dieboldnixdorf.com/windows-10-migration-faq/#.W2SlqChKjIU

How to Win with Windows 10 - https://blog.dieboldnixdorf.com/win-windows-10/#.W2Sl_ihKjIU 

White Paper: https://www.atmmarketplace.com/whitepapers/windows-10-an-opportunity-not-an-obstacle/

Webinar: https://www.atmmarketplace.com/whitepapers/webinar-windows-10-a-financial-institutions-roadmap-to-2020/

DN website: www.dieboldnixdorf.com

COMMERCE NOW website: www.commercenow.libsyn.com

Transcription:

Podcast Summary:

Black box attacks. Cyber attacks. Malware. Manipulation of the hard drive. There are so many factors and variations when it comes to jackpotting attacks that it can make your head spin. These attacks are constantly evolving in their sophistication, but that doesn’t mean you should give up the security ghost. Every attack teaches us something new – from the preferred ATM target to the preferred type of malware. Studying these attacks and closely scrutinizing every aspect of a jackpotting attempt allows us to get ahead of the attacks and become proactive instead of reactive.

In this episode, our security gurus Scott Harroff and Bernd Redecker will discuss the lessons and takeaways banks can learn from jackpotting and security, and how they can get ahead of the problem BEFORE it costs them.

Resources:

Blog: 

https://blog.dieboldnixdorf.com/what-recent-jackpotting-attacks-can-teach-us/

Sign-up for Security Alerts: http://pages.e.dieboldnixdorf.com/ATM-Alert-Subscription?_ga=2.241321483.882907520.1533304320-1846737074.1524590636

DN website: www.dieboldnixdorf.com

COMMERCE NOW website: www.commercenow.libsyn.com

Transcription:

Amy Lombardo:                00:01                    

Black box attacks, cyber-attacks, malware, manipulation of the hard drive, there are so many factors and variations when it comes to jackpotting attacks that can make your head spin. These attacks are constantly evolving in their sophistication. But that doesn't mean you should give up the security ghost. Every attack teaches us something new, from the preferred ATM target to the preferred type of malware. Studying these attacks and closely scrutinizing every aspect of a jackpotting attempt allows us to get ahead of the attacks and become proactive instead of being reactive. In this episode, you'll hear from two security gurus, Scott Harroff and Bernd Redecker. They'll discuss the lessons and takeaways banks can learn from jackpotting and how they can get ahead of the problem. I am Amy Lombardo and this is COMMERCE NOW.

Scott Harroff:                     01:05                    

Hello again, and I'm Scott Harroff, your host for this episode of COMMERCE NOW. If you recall, Amy Lombardo and I had a great conversation on jackpotting a few weeks ago. And today I'm joined by Bernd Redecker, Diebold Nixdorf's Director of Corporate Product and Solution Security, and we will take a deeper dive into what recent jackpotting attacks can teach all of us and the best ways to protect against them. Thanks for joining me today Bernd.

Bernd Redecker:              01:29                    

Scott, it's a pleasure to be here. And thanks for the opportunity.

Scott Harroff:                     01:32                    

Okay, so let's recap a little from the last jackpotting podcast. First, we've seen an expansion of jackpotting attacks in 2018, especially in the Americas. Secondly, while these attacks don't feature brut force, they combine aspects of physical and logical manipulation of ATMs. And then looking back at four ATM security alerts from this year, it's clear that protecting yourself requires a holistic security approach. So, diving right in Bernd, can you remind our audience that although there is no one type of jackpotting attack, what are some of the major types of jackpotting that can occur.

Bernd Redecker:              02:07                    

Scott, thank you very much. The term jackpotting, first of all, basically refers to getting money out of an ATM. And jackpotting is coming from the gambling machines, basically you win the jackpot. Jackpotting as such, the term has been defined or it has been created already some years ago. There is a general distinction between different verines. One is called a black box jackpotting and black box simply means that the attacker brings his own electronics. As you already said, jackpotting is always a combination of a physical and a logical breach. When this is done on-sight, like with a black box, the attacker has to open the machine, he brings his own processor, his own CPU, connects the cash hunting device of the ATM with his box and then has the machine paying out money. Of course it's not as easy as it sounds at the moment. They will have to circle then security measurements. They will have to break security measures which are there, which are in place or which should better be in place. But I guess we'll talk about that a little bit later.

                                                                               

There's another attack vector. And that comes with all the equipment which is already present at the machine. So the second one would be attacking the hard disk drive of the existing CPU in the ATM. We see several cases where they rip off the disk of the ATM, take it back to their car, infect it with malicious software, put it back in again and then jackpot the machine. And that, again, has different verines. Some of them have malware, some of them have even modified legal applications. And we can go through that as we touch the different alerts. And especially this year we have seen a [inaudible 00:04:04] of that. I guess we are going to touch now, right?

Scott Harroff:                     04:08                    

Yeah. And these attacks are really only across the four alerts that we just talked about. And I know there's other types of jackpotting. And as we've seen recently, these attacks continue to evolve very quickly. So it really is crucial to stay up to date and know what's going on. Can you talk about the January 25 alert and give us some specific takeaways?

Bernd Redecker:              04:29                    

Yeah, the January 25 alert ... And by the way, if you would like to, please register for our security alerts, can find them on our home page. Alert from January 25th refers to, again, a combination of both attacks. It was HD a replacement attack. However, it was also using physical manipulation in the ATM, which means they did a combination of both to be able to get to the cash. And the challenge here is looking at outdated stuff, looking at outdated protections may open potential attack factor which the attackers then exploit, which means we definitely have to take care that protection is checked and verified over the time, machines are updated in a timely manner, and policies which are on the machine get updated.

Scott Harroff:                     05:22                    

Yeah. And I'll tell you, as I keep looking at what goes on, our original alerts on the Diebold side having XFS 4139 and then 4141, then 4146 and 4148, it just seems like these guys ... You close one door and turn the lock so they can't open it, and they turn right around and they start looking for the next door as soon as you finish turning the lock on the first door. So help us understand a little bit about how the May alert is different than the January alert.

Bernd Redecker:              05:53                    

In that case, the attackers brought their own laptop. So the difference there is January it was disk infected, in May they brought their own computer in case it was infected. It was a small notebook. They disconnected the original PC, which means all of a sudden all logical countermeasures are completely obsolete, they can't help any longer. They connected directly to the dispenser and then they have been using physical measurements to trick the whole machine into communicating with a second notebook. That's the bad thing about it, we are seeing these combinations of physical and logical attacks more and more, taking advantage of processes.

                                                                               

The bad thing is it doesn't help any longer to build another fence, to build another protection mechanism, which they are then starting to re-engineer. We have to change completely the way we protect the machines. And what has shown good progress is going to a model where we have more behavioral situation. And basically that's what we did in the May topic. However, please keep in mind, of course you will have to update the machines. We have machines out there, we just have been involved in an investigation with a customer with the average age of the machine, was 17 years unpatched, never updated. These machines are liable for attacks or can fall into attacks just because they are that old and that outdated. If we update them regularly, if we maintain them regularly, on a regular base, we can protect them. But of course the attackers, as soon as we close a door, are going to try and find another one.

Scott Harroff:                     07:45                    

Yeah, and there's something I really want to drill in on there a little bit, Bernd, because I'm in front of a lot of customers here in the US and I get this perception, especially from some of our larger financial institutions, that they've got the opinion that I'm running, I won't mention product names, but I'm running Vendor X antivirus product or I'm running Vendor Y whitelisting product or I'm running Vendor Z super security product on my hard drive, and because I've got all these products protecting me from a security standpoint, from the yellow vendor and the red vendor and the blue vendor and everybody else, because I've got all this security on my hard drive I don't need to do software updates. And what I think I just heard you clearly say is that's not the case. If you've got the greatest security running on your hard drive but you're missing this firmware update, you're vulnerable, right?

Bernd Redecker:              08:42                    

It depends. Of course it depends. You are right, there is no silver bullet. There is no bulletproof solution. What we have to take into consideration is protection on let's call it three layers, interconnected layers or interconnected levels. One is against what we would refer to as IT or cyber attacks, like malware trying to reach the ATM PC or we have to provide protection against malicious users and we have to think about protection when the machine is being switched off. That is very often forgotten. That would cover attacks directly against the devices. There is no difference, from a logical point of view there is no difference, whether I switch off the machine, the PC, or whether I directly connect to the dispenser. But if we do not offer protection or if we do not consider protection on all of these layers, then there is room for attacks. If there is a gap somewhere, there is room for attacks. If we don't encompass, and that's what I see as upcoming attacks, processes, there is room for attacks.

                                                                               

What is also a little bit misleading, and again, like you Scott, I don't want to talk about product X, Y or Zed, the ATM in most cases is running a little bit specialized but more or less standard PC, which means we are looking at a standard operating system which you know from your office environment. So why the heck don't we deploy office protection tools? The biggest difference is, think about your computer, when you switch it on, well maybe not in your home environment but definitely in your office environment, the first thing you will have to do is you will have to enter a password, even before the operating system starts. Well, here, with ATMs or with POS systems, we are looking at machines, and especially with ATMs, we are looking at machines which are out in the wild 24/7, there is no dedicated user on it who would be able to put in a password when you boot it, which means you will need dedicated security measurements for exactly these environments.

                                                                               

If you start deploying standard office environments to these areas, you can think about that, in reality from my experience it has never been a very good solution because there has to be a trade off. When you look at standard antivirus, for instance, your machines or your pattern on your home PC gets updated, well at least hourly. You can't do that with an ATM. It will spoil the bandwidth, it will spoil potentially availability of the machine. So you have to think about other measurements dedicated for self-service machines, dedicated for 24/7, machines running unattended. So we have to take a different perspective on this to be able to offer protection.

Scott Harroff:                     11:46                    

Yeah, I agree. I think that when you look at an ATM environment there's a lot of different aspects that you need to look at relative to jackpotting. If you've got an ATM that's sitting in the middle of your lobby, maybe you haven't updated the software for 17 years. With it sitting in the middle of your lobby and the doors are only open from eight in the morning until five at night and people are paying attention to what's happening at the ATM, you've got a lot of vulnerabilities on that ATM possibly but what's the likelihood, if you will, of somebody walking into that branch and opening up the ATM and standing there for the next hour taking notes out of the front of the machine and putting it into a great big bag they have on the floor? It's just not likely to happen. It could. But it's just not really likely. And then you move from there and do a drive-up lane, and depending on how it's configured you got a little bit more risk. It's out there 27 by 7 and maybe the lighting's not as great as it could be. And then you go to the other extreme, maybe I've got an ATM at a gas station or an off-site government building or in a college campus and now you've got an ATM that from a physical standpoint's very exposed. Your likelihood goes up.

                                                                               

So I think the other thing, in addition to the tools running on the ATM itself, I think customers really need to look at the physical environment and the risk factors around each ATM and use that as a way to help model what their total exposure is and figure out what to do there and not overlook physical security. I can't tell you the number of customers I've talked to where all their remote ATMs have exactly the same key that they were shipped with from the factory and they have no alarms on the top hat and no one's monitoring to see if the ATMs up or down. So I really agree with you, it's a comprehensive solution that really you've got to look at everything together all at once.

Bernd Redecker:              13:33                    

Like you said, having something like the same key in all machines is never a good solution. Normally security does not come from obscurity, it comes from secrets you have and you possess and you can use in the field, but not from having just something which you think the other one doesn't have. That's impossible. Just one comment on the environment. You're absolutely right, especially when we look at not only the logical attacks, when we look at attacks in total, there are different areas, there are different regions where attacks, some kind of attacks, are more likely than others. Unfortunately, this also applies vice versa. And just because your ATM is in a lobby may help if you think about a bank environment, may help when you're, for instance, in Europe or in North America. We have also seen attacks especially in Latin America where it's not especially a lobby but it's supermarket scenarios where there are ATMs and they have been jackpotted while the store was open.

                                                                               

So the crooks have developed patterns where they really don't care who's looking at them, again, depending on the region, depending on the environment, where they simply don't care whether they are being seen, where they try to disguise. We have seen full operations where they even come with their own protection, not armored but in terms of distracting anybody who goes out there and tries to talk with the one who's currently jackpotting the machine. And of course it never looks like what you would expect jackpotting. It's not cloak and daggers, it's not people with raincoats and black hats. It's always people looking absolutely, in these scenarios, it's always people looking absolutely normal, pretending to do normal transactions. And you can tell from the lock files of the ATM and you can tell from the videos that in fact they were cashing out money instead of really doing a normal withdrawal.

Scott Harroff:                     15:29                    

Yeah, and we've seen the same thing here in the US. We've had big box retailers with ATMs very close to the main entrances and you've got all those people walking in and out of the big box retailer and your point of sale line is right over there. And of course you've got all those surveillance cameras. And right there in the middle of it for an hour they're jackpotting. Hey, let's talk a little bit about the difference between the May alert and the July alert. So they're both black box attacks. Why don't you give our audience a little bit of information around the differences between the July and May alert just to clarify that.

Bernd Redecker:              16:06                    

Well, the main reason we published another alert on jackpotting and black boxing in July was, first of all it was a wave over here in Germany and with also seeing something similar happening in Latin, but what was really astonishing and what was new at that point and time was a way of organization. So we know that the majority of the jackpotting cases, we do have organized crime, we do have organizations in place who do the jackpotting. In that case the biggest difference was that the guys who were in front of the machines, the guys who did the transport, had absolutely no idea what they were doing. They have been hired completely, well, underground style. So they had no clue why they were transporting a notebook from one country to another one.

                                                                               

They didn't have a clue what to do with that in front of the machine other than the description, "Okay, open the machine or break the machine here, there and there. Connect this and then here you go". So that was basically the biggest difference we saw in that. And that it hit in two regions in parallel led us to issue this warning. Again, if the machines are properly updated this should have not been possible. And we have also seen attacks which were unsuccessful due to full protection, at least against known attack vectors. So this proves to help. In this case, the machines were not upgraded. But the main reason for this was the organization grate behind that.

Scott Harroff:                     17:48                    

When we look at these attacks, sometimes when we do our forensics it's a very complicated multi-step process that requires ... You have this version of this and this version of that and you're missing this countermeasure and you're missing that countermeasure. And it's really perfect storm of all these things coming together in conjunction with a technical person at the ATM that's really, really smart. What I think I just heard you say is we can go all the way to the other extreme of you have a not sophisticated person that sort of, kind of just pulls out a hard drive and you're missing a patch and they use that as a way to impact the hard drive and put it back in. That's kind of what happened in the July alert, right? Could you elaborate on that a little bit?

Bernd Redecker:              18:36                    

Basically, the guys who are in front of the machine, in that case, are not really aware of that there is a missing patch. What they have is they have typically a device or an instruction or a USB stick or whatever it is for this given attack plus a description. Again, breaks machine here, unlocks a hook there, plugs this in there, and then press a button. And that's all they know and all they need to do. They have no clue that a Microsoft patch was missing or the firmware wasn't on the latest release whatsoever. And that's the world we are moving into where the money mules have absolutely no idea on why they are doing what they are doing. They just know it works.

                                                                               

You can also tell that from the controls which are getting embedded into the malware, which is used either in the disk replacement scenarios or in notebooks if we get into re-engineering of them, most of them if we talk about notebooks, most of them have remote connection. If we talk about software and substitution, there is a control embedded where these guys are remotely controlled in terms of the brain who gave them the notebook knows exactly, knows later on exactly how much money is in the machine and how much the mule would have to deliver. But the person on-site does not know that there is a, again, a patch missing. He's not the brains. And they simply hire them and they have reached a level now where they hire them completely anonymously.

Scott Harroff:                     20:13                    

Well, I think the good news here and the bad news here are all wrapped up in the same sentence. We build ATMs to last. They are not something that you put out there and in a year or two or three you replace with a brand new ATM. There's ATMs that have been out there for 10, 20 plus years. And, at the same time, that's a good thing because the customer has a piece of hardware that is very reliable and it's out there running. But on the other side of the coin, a lot of these older ATMs are in an environment where the customer really hasn't done the things that you talked about, Bernd, to keep it up to date. They haven't kept the operating system up to date, they don't have signatures up to date, they don't have whitelisting in place, they don't have encryption in place. They might not have the physical security around the ATM. So you've got a combination of older units with not enough security being one of the main drivers of why organized crime has focused in on that.

                                                                               

These attacks, also they're evolving really, really quickly. So you can't just take the defenses that you've got today and make the assumption that those same exact defenses are going to be perfect for protecting you tomorrow. You've got to keep up on top of this stuff, you've got to keep up with updates and upgrades. And if you don't, then the criminals will find a vulnerability somewhere in a platform and try to target it.

                                                                               

Bernd, is there anything else you want our listeners to take away with today regarding our conversation?

Bernd Redecker:              21:34                    

Yeah, just perfect statement, Scott, just to emphasize on that. Even if the customers don't get attacked, leaving the machine on the old state makes it even more difficult to upgrade them if something happens. So maintenance is nothing you should do only when something happens, you should do it on a regular base. And you can even do that for the old machines. Of course there is an end of life at some time, but until then ... Typical lifespan, when we look at life cycles of machines of software, that is clearly above seven years to some extent. So that shouldn't be a problem to patch and update them over the lifetime.

                                                                               

The other thing I would like to point out or I would like to hint to is we've been talking a little bit about physical protection, we've been talking a lot about logical protection. As we mentioned one or two times, the attacks we are seeing at the moment are also a combination of logical and physical. And what we are seeing, and again on a global scale, it simply doesn't matter where you're looking, to which geography you're looking to. Some are more advanced in the negative way than other regions. But, nevertheless, what we are seeing is that the crooks are also starting to take advantage of banks processes. There is an attack called transaction reversal. There are other attacks where the crooks know exactly that the bank will, in one or the other case for instance, refund cash. And while this is not literally jackpotting but the result is the same, they trick the whole process in a way where it refunds any withdrawals immediately meaning they can withdraw until the machine is empty. And the result of that is very near to a jackpotting again. So if we think about protecting the machines, it is the physical protection, it's the logical protection, protection when the machine is switched off, we have to consider processes. And of course, if we do all these things, we also have to properly monitor the machines. Because it doesn't help at all if the machine sits out there, and again 24/7, lobby, drive-ups, remote locations, whatever we have, it doesn't make any sense if the machine sits out there, it's protected to some effect, knows that it's currently being attacked, cries for help and nobody's listening.

Scott Harroff:                     24:06                    

Yeah, that's a great example Bernd. We're talking about jackpotting and so many times you think about it, and to your point of the outcome is all the cash is gone and the method had nothing to do with a black box or malware, it was just that reversal attack that just kept right on going. So I think one of the things that a lot of our financial institutions should do is really sit down with an expert on security and really walk through all the different things that you and I talked about today and really put a plan together for where are we today, ideally where do we want to be, and what are all the steps that we need to put in place to go from where we are to where we need to be, and then how do we keep up to date once we get to where we want to be?

                                                                               

So Bernd, thanks so much for being here today. It's always great to have someone of your level of expertise and knowledge available to talk to the financial institutions about what's going on in the channel. I want to thank the listeners today for tuning into this episode of Commerce Now. To learn more about jackpotting and how you can better defend your ATM fleet against these evolving attacks, please log on to dieboldnixdorf.com. And, until next time, keep checking back on iTunes or your podcast listening channel for new topics on COMMERCE NOW. And thank you very much again for everybody's attendance today.