System Evaluation - Automatic Teller Machines
INLS 187: Information Security
Allyson Silver
Assignment 4
April 9, 2003
Identification and Description of System
As we move closer and closer to a cashless society,
Automatic Teller Machines and the use of ATM and debit cards are becoming
an everyday routine that many of us no longer recognize. However,
I am certain that most Americans rarely think about just how and ATM machine
works, much less how secure their money and transactions are via these
hi-tech systems that remove the need for the bank teller and the bank.
I strongly believe that the evaluation of Automated Teller Machines, as
well as other financial systems that are now used daily, is important to
insure that our account and financial security and privacy are being protected.
Evaluation Criteria
-
Ease of Usage for Customers - Can ATM's be used
by customers with ease? Is there any trouble or confusion with the
basic layout of ATM's? If there is any complication to the system,
how does this effect the security of the system?
-
Monitoring of the Money Dispensed - How does
the ATM monitor what bills are dispensed? Is there a log kept of
all transactions and if so, how is this recorded?
-
Quality of Bills Dispensed and Accepted - How does
the ATM determine that the money people deposit into an account is valid,
and not counterfeit? How does the ATM verify that it does not dispense
too many bills or bills that may be stuck together?
-
Verification of Funds in Accounts - How does the
ATM verify that the customer has the amount requested in his/her account?
-
Protection of Account and Customers - How safe
is the system? Are users account protected, and how? Is the
location of the system in a safe and secure environment?
Test and Findings
-
Ease of Usage for Customers - The standard system
is very basic. The screens are self explanatory and easy for most
customers to understand. On a basic ATM, parts include a card reader,
key pad, screen, receipt dispenser, and cash dispenser. From my own
usage, I have never had any trouble understanding how to execute transactions
on standard systems, and I think that overall my conclusion is that most
ATM user's have no trouble accessing the system functions.
Basic Parts of ATM
-
Monitoring of the Money Dispensed - After doing
some research, I found that the ATM does monitor and log all of the transactions
that are made everyday. ATM's have an "electric eye" that counts
all of the bills dispensed, and also logs this information along with other
transactions and data into a "journal". This record is printed daily
and kept in the computer system for two years. Thus, if a customer
has a dispute about a transaction or is the victim of financial fraud or
theft, he/she can contact their bank or local ATM machine to review the
transactions made on his/her account.
-
Quality of Bills Dispensed and Accepted - Through
further research, I found that ATM's have a sensor that verifies the thickness
of bills. This technology verifies that money being deposited is
real, and also makes sure that it does not give out too much money, by
checking that no bills are stuck together prior to dispensing. Bills
that are stuck together, worn, torn, or folded are considered reject bills,
and are not accepted or dispensed. This information is also recorded
in the log.
-
Verification of Funds in Accounts - The process
for verifying that a user has adequate funds is as follows. "When
a cardholder wants to do an ATM transaction, he or she provides the necessary
information by means of the card reader and keypad. The ATM forwards this
information to the host processor, which routes the transaction request
to the cardholder's bank or institution that issued the card. If the cardholder
is requesting cash, the host processor causes an electronic funds transfer
to take place from the customer's checking account to the host processor's
account. Once the funds are transferred to the host processor's bank account,
the processor sends an approval code to the ATM authorizing the machine
to dispense the cash. The processor then ACHs the cardholder's funds into
the merchant's bank account, usually the next bank business day. In this
way, the merchant is reimbursed for all funds dispensed by the ATM." (How
Stuff Works)
-
Protection of Account and Customers - ATM's protect
customers' accounts by having them enter a PIN number into the machine
prior to having access to the account and making any transactions.
Most banks and debit card companies give advice on securing you PIN and
selecting a PIN in order to help protect your financial security.
Some tips include - "Don't write down your PIN. If you must write it down,
do not store it in your wallet or purse. Make your PIN a series of letters
or numbers that you can easily remember, but that cannot easily be associated
with you personally. Avoid using birth dates, initials, house numbers or
your phone number."
-
Additionally, to protect customers, ATM's are usually
located in well lit areas or have some type of security camera in the system.
Also, by federal law, ATM receipts only print out the lsat four digits
of the customer's account on dispensed receipts for added information security.
Recommendations
Overall, I think that Automatic Teller Machines are relatively
secure machines. I learned a lot about these systems from this evaluation.
I honestly thought that ATM's were much less secure than the research that
I found stated. I think it would be helpful for banks to distribute
facts as I have found to its ATM card holders, just as an additional form
of education and awareness to information security. Additionally,
I think informing customers of the importance of PIN security and safety
at ATM's would help to secure users and to prevent any vulnerabilities
from the system occurring.