ATMs Not Segmented
Severity Level: Priority 2
Category: Security / Infrastructure
Description:
ATMs lack network segmentation, allowing potential external attacks to pivot to the internal network if compromised.
Impact:
- Risk of data exfiltration or ransomware via ATM breaches as attackers could gain access to the internal network.
- Non-compliance with network security standards.
- Increased audit findings from poor segmentation.
FFIEC Reference:
- FFIEC IT Examination Handbook (November 2016):
- "Network segmentation reduces attack surface." (p. 37)
- "Critical systems like ATMs require isolation." (p. 39)
Recommendations:
- Segment ATMs: Place ATMs in an isolated VLAN.
- Restrict Access: Limit ATM network to essential functions.
- Audit Segmentation: Verify compliance with network standards.