This document summarizes security issues related to banking and bookkeeping. It defines banking as accepting and saving customer money, and bookkeeping as recording and tracking financial transactions. It discusses security requirements like access control, vulnerability management, and network protection. Security incidents are categorized as programming issues, infrastructure problems, process flaws, and organizational vulnerabilities. Specific examples are given under each category, such as wrong PIN verification, physical credit card skimming, unverified address changes, and bank reset clerk authority abuse. The importance of security for banking and tackling electronic commerce fraud is also highlighted.

1. Banking and Bookkeeping
IF4033 Information Security and Assurance
Semester 2 2013/2014

2. Kelompok 16
 Yogi Salomo Mangontang Pratama
(13511059)
 Habibie Faried (13511069)
 Setyo Legowo (13511071)

3. Outline
 Definition
 Security Requirement
 Security Incident
◦ Programming
◦ Infrastructure
◦ Process
◦ Organizational
 Security Pitfall
 Why Important

4. Banking
 In simple words, Banking can be
defined as the business activity of
accepting and saving money owned
by customers.

5. Bookkeeping
 Record financial activity
 Tracking account transaction
 Verify accuracy of procedures used for
recording financial transaction

6. HISTORY OF
BOOKKEEPING

7. Why is this important?
 Tackling Broader Problem of
Electronic Commerce and Fraud
 Mainstay of Computer Industry
 Because Finance is an important
aspect of Human Life

8. Security Requirement
 Information Security Requirement
 Implement Strong Access Control
Measures
 Maintain a vulnerability management
program
 Build and maintain a secure network
 Protect cardholder data

9. Security Incident
 Programming
 Infrastructure
 Process
 Organization

10. Programming
 Wrong ATM Card's PIN Verification
 Same PIN to all customer
 Wrong Assumption
 Test System as Live System
 No Authentication Probable

11. Wrong Assumption
An assumption was made by bank programmers.
Here is the algorithm
Then, how about Inserted ATM’s PIN?. Simply
peek it out 

12. Infrastructure and Technology
 Physical Credit Card Skimmer
 Online Credit Card sniffing
 Smart Card Information Sniffing
 Not authenticated RFID Transaction
 SWIFT Wiretapping link from branch
to mainframe computer's bank

13. Not authenticated RFID
Transaction
 Simple Wireless-based transaction
 Put RFID reader near to RFID Card
location’s victim
 Get control over it (steal data, etc)
 Done? Time to get away 

14. Process
 Unverified Address Change Process
 Mules for Money Laundering
 Age Verification With Credit Card
Number
 Misuse of Bank's Suspense Account
 Shoulder Surfing

15. Shoulder Surfing
 Stone
 Process Attacked: usage of ATM.
 New York
 1990’s

16. How does it work?
Stand
behind
someone in
ATM and
Peek their
PIN
Take the
receipt they
have
thrown
away and
find the
account
information
Create
Duplicate
Key using
retrieved
information
Use The
Duplicated
Key to
Access
Account in
any ATM

17. Organizational
 Bank Reset Clerk Authority Abuse
 ATM Repairman accessibility
 SWIFT Bogus Transaction Message
 Traditional Banking Law and Practices
 Internal Control Failure

18. Bank Reset Clerk Authority
Abuse
 Paul Stubbs
 Bank Reset Clerk
 HSBC Bank, 2000’s
 $20 Million Loss

19. How does it work?
Paul Stubbs, as
Reset Password
Clerk change
the password of
AT&T Account
Using the New
Password, He
and comrades
Access the
Account of AT&T
and Transfer
$20 Million to
Offshore
Company
Return the
Password to its
initial so that the
account owner
doesn’t realize

20. Security Pitfall
 Bad Authentication in accessing
system
 Tamper-able Infrastructure
 Abuse of Power

21. Thank you