The need to remain competitive in the face of increased local investment by global banks and the ever-present requirement for a secure banking environment are two important trends driving the information technology investment decisions of South Africa`s banks.
Developments in ATM technology have enhanced this utilitarian device`s potential for acquiring customer information, offering self-service functions and embarking on one-to-one marketing initiatives. This opens up a wealth of opportunities for banks to get to know their customers better, free up tellers for more personal, high-return customer interactions, and indeed have a physical presence in areas where no banking service has been before. But in South Africa, and indeed other parts of the world, un-manned machines that contain cash and offer access to individual bank accounts raise the all-important issue of safety.
Bytes Specialised Solutions (BSS) recently presented a road show featuring the latest ATM offerings from its technology partner, NCR, the global leader in ATM technology. During the road show, representatives of local banks were informed of BSS` and NCR`s holistic approach to security, and how this is enabled through a four-pronged view of ATM security that is the result of global research and best-of-breed hardware and software solutions that address the main security threats present in the ATM environment.
Physical security
A number of devices have been developed to promote the security of the person making use of the ATM and the information they provide. This includes "wings" on the side of the machine and over the keypad that shield the screen from anyone not directly in front of the machine, as well as the keypad when numbers are entered.
Biometric readers facilitate thumbprint access to the person`s account. A mirror is included on the machine to observe any activity behind the person making use of the ATM.
Cameras are integrated into the machine and controlled from a remote location. Camera footage is archived using a software system and can be accessed for policing purposes.
System security
The second level of security is for protection of the system at the ATM and from network-based attacks. Sophisticated ATM management tools generate alerts if there are suspicious incidents at the ATM.
The system uses rules-based logic that triggers a response if any trapping devices are detected. This response could be to take the ATM out of service, alert the ATM help desk or inform the authorities.
NCR ATM systems run on the OEM version of the Windows XP platform, in which all potential security holes are shut down. In addition, APTRA Security software is deployed, which only allows authorised code to run and protects good code from being tampered with or hijacked.
A new technology called Solidcore brings a complementary function that delivers security and IT control and regulatory compliance. A trusted environment is brought to the ATM by building on an evolving set of guidelines that are constantly updated as new threats emerge.
Cash security
NCR`s newer ATMs are constructed from metal and concrete at a greater thickness than previous models. While this protects the machine, and thus the cash, from a number of external threats, explosives could still cause damage to the machine. In this case the concept of "spoiling the prize" comes into play as the cash is stained with ink the moment machine damage is detected.
Machine security
Physical means to protect the machine include a card reader that remains firmly closed until a card is inserted. "Card skimmers" are a very real threat to ATM users. These are devices that are used by criminals to obtain electronic information from a consumer`s ATM card and visually record the PIN that is entered.
A stop-start motion "jitter" function on NCR ATMs means that cards are taken into the machine erratically making it difficult for information to be skimmed.
In addition, card slots are designed in such a way that it is difficult to insert a "skimmer" device effectively, and sensors can detect if a fraudulent device is keeping the shutter open. Intelligent Fraud Detection is a system of sensors that reside behind the facade of the ATM. It creates a capacity field that picks up any object in front of the ATM. If anything not considered appropriate to the normal use of the machine enters this field, a message is sent over the network alerting the monitors. Those monitoring the machine then have the option of remotely shutting down the machine until further investigation takes place. If more than one signal is triggered, the machine is shut down automatically.
Other options for securing the ATM include visuals on the screen that show what the card reader is supposed to look like, so users can immediately determine if anything is amiss.
There is a significant commitment from Bytes Specialised Solutions to understand and offer solutions to resolve the security risks facing banks in South Africa and much of what is being learned in this particularly security-threatened environment will advise future development of ATM solutions at NCR. ATMs have evolved as trusted and primary touch-points for a bank`s consumers. It is therefore essential that this trust be retained through banks implementing holistic security solutions and evolving these as new threats emerge.
Share