Penetration Testing mailing list archives
RE: Bank Audit Best practices
From: "Chuck Fullerton" <chuckf69 () ceinetworks com>
Date: Thu, 18 Mar 2004 16:40:31 -0500
My answer to this would be to check the policy and agreement between the two. If the bank Falls under GLBA the Audit team can request the Audit results pertaining to the link from the partner to include in their report as well. I am a strong believer in a strong policy. If you find that it is lacking give them the choice of securing the link or contractually forcing the remote side to secure it. In whatever they choose ensure that Management understands the risks involved in this link. Good luck. Sincerely, Chuck Fullerton CISSP, OPST, CSS1, CCNP, CCDA, CNA, A+ Founder, CEO Charles W. Fullerton Institute of Analysis www.cia-sec.com chuck () cia-sec com -----Original Message----- From: Dante Mercurio [mailto:Dante () webcti com] Sent: Wednesday, March 17, 2004 9:07 AM To: pen-test () securityfocus com Subject: Bank Audit Best practices I'm looking for some feedback from other people who conduct security audits and penetration tests on banks. One of the network aspects I come across a lot is a direct line to their transaction processor. This is often in the form of a point-to-point or frame line that is dropped onsite with a router controlled by the processor, not the bank. I always point out that this is a network security risk, as there is no control from the bank side regarding the access provided through that line, and recommend an ACL or departmental firewall at that point. As always, the administrators look at me like I recommended them selling their firstborn. The relationship between the bank and their processor is very symbiotic as the bank couldn't even exist without their services, yet my perspective is any outside system should go through some level of border security in order to monitor and restrict traffic. Anyone run into this? How do you handle? M. Dante Mercurio dante () webcti com Consulting Group Manager Continental Technologies, Inc www.webcti.com --------------------------------------------------------------------------- Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off any course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expert instructors. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html ---------------------------------------------------------------------------- --------------------------------------------------------------------------- Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off any course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expert instructors. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html ----------------------------------------------------------------------------
Current thread:
- Bank Audit Best practices Dante Mercurio (Mar 18)
- RE: Bank Audit Best practices Chuck Fullerton (Mar 19)
- RE: Bank Audit Best practices Pete Herzog (Mar 19)
- Re: Bank Audit Best practices Clint Bodungen (Mar 19)
- Re: Bank Audit Best practices Jeff Lumley (Mar 19)
- Re: [security] Bank Audit Best practices rsh (Mar 19)
- Re: Bank Audit Best practices wirepair (Mar 19)
- <Possible follow-ups>
- RE: Bank Audit Best practices Michael Bitow (Mar 19)
- Re: Bank Audit Best practices Mike Shaw (Mar 19)
- RE: Bank Audit Best practices Michael Iseyemi (Mar 19)
- RE: Bank Audit Best practices Keith Pachulski (Mar 22)
- RE: Bank Audit Best practices Mike Shaw (Mar 22)
(Thread continues...)