NCR ATM Security Assessment Service Datasheet

Get ahead of criminal activity and the risk of attack before it’s too late

The self-service channel is not immune to the increasing threats of card fraud and data breaches. As well as the hard cash losses associated with fraud, there is also the serious risk of impact on consumer confidence. Organized criminals with expert knowledge of the ATM are now even developing new breeds of malware specifically designed to attack ATM security. This type of “inside skimming” attack could sit unnoticed on the system for days, even weeks, and compromise hundreds or thousands of cardholder details. Proactive risk mitigation demands a multi-layered approach to security. To help you defend your self-service channel from attack, with a tailored security strategy, NCR is joining forces with Trustwave. Insight from the global leader in self-service and the experience of the world’s top name in ATM security and compliance consultancy combine in a vendor-neutral approach to risk mitigation that helps you address any vulnerabilities in your network and protect you from attack.

• ATM architecture review
  Implementing an effective security assessment and defense strategy starts with a thorough evaluation of your entire ATM environment. Exposing any potential vulnerability that leaves the channel exposed to attack also determines the launch point for penetration testing.
• Penetration testing
  Determine how resilient your network security policy and controls are to external or internal attacks. These tests evaluate a number of different classes of vulnerabilities at the data link (layer 2) and network (layer 3) layers. Examples of layer 2 attacks are Virtual Local Area Network (VLAN) Hopping, Address Resolution Protocol poisoning and switched architecture vulnerabilities related to trunking or failover protocols. Layer 3 examples are session hijacking or replay, network or operating system attacks, password capture and IP redirection. Other tests may include network hash passing, dynamic host configuration weaknesses, cryptography and data protection.