At Internet Security Auditors, we specialize in security audit processes and collaborate with financial institutions in the review of their security systems.
An ATM (Automated Teller Machine) audit is a technical and physical security assessment of an automated teller machine.
Internet Security Auditors has experience auditing ATMs for financial institutions, with systems from the main manufacturers on the market.
The tests performed include both ethical hacking tests and technical validations, and their results are useful for evaluating or maintaining compliance with PCI DSS/PA DSS standards or ISO 27001 certification.
It includes the actual ATMs dispersed throughout the office network, the network and communication devices, and the servers.
The following aspects are reviewed:
An incorrect operating system configuration can, at times, lead to security issues within the operating system itself or in any of the running applications.
Aspects such as the following are reviewed:
Review of the PCI DSS requirements to be met by the environment.
Review of the controls implemented to meet PCI DSS requirements following security assessment procedures.
Aspects related to the risk of illicit code execution will be reviewed, specifically contemplating tests aimed at corroborating or overcoming the protection provided by specific protection systems such as white-listing.
ATM systems have software components that must be updated regularly to ensure the correction of defects and security vulnerabilities as they arise.
In the case of automated teller machines, according to the requirements of standards such as PA-DSS, it is necessary to ensure that these processes guarantee the integrity of update files and the impossibility of carrying out an attack on traffic or sources that could alter the files used for updates to both the Operating System and the ATM application itself.
Anyone who gains possession of a hard drive used in an ATM (theft, reuse of the drive without proper data sanitization) could potentially analyze the drive's content, especially if cryptographic mechanisms are not used to protect it.
We evaluate the information that can be obtained from an ATM hard drive, not only from existing files but also from deleted files.
Searching for PAN, PINBLOCK, tracks, etc., on the hard drive to verify secure writing and/or erasure of data on the HD according to PCI DSS requirements.
Theoretical analysis of weaknesses that could be caused by the environment's remote management tools:
Review of the potential impact of inappropriate use of customer support processes:
It must be verified that in the current process, it is not possible to obtain the ATM's Master Key or the keys communicated to it.
It must be technically evidenced that by using the keys present in the ATM, it is not possible to decrypt data such as the PIN or track data when they are encrypted.
As a result of this audit, the following documentation is provided:
Scope of service
Architecture and protocols
ATMs, network and communication devices, servers, network visibility, external traffic, and communication protocol analysis.
Configuration and hardening
Operating system configuration (users, file system, services, personal firewall rules) and hardening according to PCI DSS.
PCI DSS Audit
Review of the PCI DSS requirements to be met by the environment and the implemented controls, following security assessment procedures.
ATM application
ATM and client application security, protections against illicit code execution, and white-listing.
Hard drive and remote management
Software update procedure, hard drive analysis (PAN, PINBLOCK, track), and remote monitoring and management tools.
Cryptography and results
Protection of the Master Key and ATM keys, and executive report with conceptual risk scenarios and technical results of the exploitation.
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in reinforcing our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in the maturity of our cybersecurity.
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.
As the CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner for the implementation of the requirements set by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the field of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and peace of mind that all our activity is aligned with GDPR compliance.
As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the fact that the PCI-CPP standard requires four internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company aims to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; for this reason, I recommend them without hesitation.
At Grupo Arbulu, we have worked closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
As CEO of Beruby, we worked with Internet Security Auditors when we urgently needed to conduct a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
At Grupo AR, we highly value the brand protection service from Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that may affect the AR Construcciones brand and its various companies.
FAQ
We have experience auditing systems from the largest manufacturers on the market. Our team is prepared to conduct audits on any ATM platform, regardless of the manufacturer.
Yes. The ATM audit requires physical access to the automated teller machines to perform ethical hacking tests and technical validations, so it is executed on the client's premises.
Yes. The audit results are useful for evaluating or maintaining compliance with PCI DSS and PA-DSS standards, as well as for ISO 27001 certification, by providing technical evidence of the ATMs' security status.
Tests are carefully planned to minimize any impact on ATM operations. Execution windows are coordinated with the client and rules of engagement are established before testing begins.
ATM auditing is a specialized service that combines ethical hacking tests with specific technical validations of the ATM environment, including analysis of the operating system, communications with the central host, dispensing software, and the physical and logical security controls inherent to these devices.
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)
