Security Guidelines for Product Categories- Automated Teller Machines (ATMs) Security Measures Review Practice Guide- Analyzing Crime Incidents and Formulating
Countermeasures -Ver. 1.00

CCDS Security Guidelines WG
ATM SWG

Revision History
VersionDate of Revision

Ver.1.0

2017/05/29

Description
New edition■Trademarks
・ All company and product names mentioned in this book are company trademarks or trademarks registered.

■Further notices
・ All information provided in this book is stated at the time of publication and may change without notice.
・ Any copying or reprinting of the contents of this document without obtaining permission from CCDS is prohibited.

© 2017 Connected Consumer Device Security Council Proprietary

CONTENTS
1

INTRODUCTION .................................................................................... 42

SECURITY MEASURE FORMULATION PROCEDURES ........................ 6

2.1

Analyze Crime Incidents and List Proposed measures ........................................... 8

2.2

Analyze the Impact of Security Measures upon ATM operations ...........................132.2.1 (Analysis Step) Analyze the possible impact of the listed security measures ............ 15
2.2.2 (Analysis Step II) Analyze the Control Workload of the Listed Security Measures ..... 21
2.3

Evaluate Proposed Measures Comparatively .........................................................26

2.4

Extending Application to Crimes Yet to be Committed ..........................................29

3

CONCLUSION ...................................................................................... 30

APPENDIX RISK RATING FORMULA ........................................................... 31
Appendix 1 CVSS (Common Vulnerability Scoring System) v3 Method [3] ......................... 31
Appendix 2 Modified CCDS Method [4] .............................................................................. 40
Appendix 3 Event Tree and Defense Tree Combined Method (EDC) Method [5] ................ 42
Appendix 4 Annualized Loss Expectancy (ALE) Method [8][9][8][9] ................................... 44
Appendix 5 The OWASP Risk Rating Methodology [10][11] ............................................... 45

REFERENCES .............................................................................................. 49

Figure 2-1 Outline of a Fraudulent Withdrawal Assisted by Malware (Physical Intrusion) 10
Figure 2-2 Procedures for Analyzing the Possible Impact of the Listed Security Measuresupon Existing Transactions ........................................................................................... 14
Figure 2-3 Typical Classifications of Management Areas Associated with ATM Operations.................................................................................................................................... 18
Figure 2-4 Example of Breaking Down Cash In Transit Work into Work Steps andClassifying Management Areas ..................................................................................... 191

Figure a3-1 Scheme of Risk Value Calculation by the EDC Method ............................... 43

Table 2-1 Security Measure Formulation Procedures ...................................................... 7
Table 2-2 Examples of Protected Assets Listed ............................................................... 8
Table 2-3 Typical Crime Incidents Targeting Protected Assets ......................................... 9
Table 2-4 Attack Steps of a Fraudulent Withdrawal Assisted by Malware (PhysicalIntrusion) ..................................................................................................................... 10
Table 2-5 List of Measures to Protect against attack steps of a Fraudulent Withdrawal
Assisted by Malware ..................................................................................................... 11
Table 2-6 Work Items Relevant to ATM Operations and Examples of Work Required ..... 15
Table 2-7 Examples of Ideal Form of Management Tasks When Work Events Occur ...... 20
Table 2-8 Examples of Ideal Form of Management Tasks to Routinely Occurring Control
work ............................................................................................................................. 21
Table 2-9 Examples of Estimates of Assumed Control Workload by Management Area .. 22
Table 2-10 Examples of Management Areas Relevant to Measures (EUROPOL
Requirements ............................................................................................................... 25
Table 2-11 Examples of Risk Assessment Methods ....................................................... 27
Table 2-12 Measures Associated with Management Areas (EUROPOL Requirements) .. 28

Table a1-1 Metrics Required for Calculating Impacts..................................................... 32
Table a1-2 Metrics Required for Calculating the Ease of Exploit .................................... 33
Table a1-3 Metrics Required for Calculating Temporal Scores ....................................... 34
Table a1-4 Target System Security Requirements (CR, IR and AR: Security Requirements).................................................................................................................................... 36
Table a1-5 Reassessing Base Metrics with Environmental Conditions Taken into Account(Modified Base Metrics) 1 ............................................................................................. 37
Table a1-6 Reassessing Base Metrics with Environmental Conditions Taken into Account(Modified Base Metrics) 2 ............................................................................................. 37
Table a1-7 Qualitative Severity Rating Scale ................................................................ 39

Table a2-1 Difficulty Criteria ......................................................................................... 40
Table a2-2 Impact Criteria ............................................................................................ 40
2

Table a2-3 Attacker’s Motivation Criteria ....................................................................... 40
Table a2-4 Risk Value Rank Criteria ............................................................................. 41

Table a5-1 Threat Agent Factors ................................................................................... 46
Table a5-2 Vulnerability Factors.................................................................................... 46
Table a5-3 Technical Impact Factors ............................................................................. 47
Table a5-4 Business Impact Factors ............................................................................. 47
Table a5-5 Risk Levels ................................................................................................. 48
Table a5-6 Overall Risk Severities ................................................................................ 48

3

1 Introduction
Criminal groups possibly lurking behind ATM cyber physical crime incidents arepresumed to be developing malware and associated hardware while being exposed to therisks of being apprehended. The rate of return on risk should be of concern to the criminalgroups. While a successful attack technique works well, attackers are possibly inclined tostick to the same technique, changing target countries and financial institutions. There are
actually numerous variants of malwarederived from the same origin to attack ATMs.
In adopting ATM security measures, one should think that crimes actually happened in
the past can accordingly be regarded as more risky than threats that are identified throughgeneral analyses. You should prioritize security measures intended to defend against them.
This guide, the practice part of the Security Guidelines for Product Categories: AutomatedTeller Machines (ATMs) [1]cites typical techniques used in crime incidents that occurredin the past. This guide accordingly introduces analysis procedures and concepts of what
security measures to take, for implementing defense in depth to prevent these techniques.
The analysis approach in this guide is to decompose a crime technique into several crime
steps and explains what and how should be protected from defense in depth point of viewat each individual crime step. These analysis procedures can be applied to those crime
techniques yet to beexploited.
It is important to consider characteristics unique to ATMs in analyzing defense in depth.
Some systems such as electric power systems and rail transport systems are securely
other systems which are comprised of consumer devices suchas smart home gateways and other smart home appliances are not. ATMs should
essentially be viewed as a securely managed system because they are managed byfinancial institutions, trustworthy entities, together with dependable cash-in-transit (CIT)
companies and maintenance contractors under legitimate contracts.
The ATM crime incidents committed in countries other than JAPAN, however, suggest the
aspects of an uncontrolled system with poorly managed ATMs being targeted by attackers.
There are accordingly two options in considering security measures for ATMs: one is toprotect assets by enforcing stringent management in operation, the other is to protect themby using some mechanisms (e.g. encryption) similar to ones used in consumer devices
regarding ATMs as unmanaged devices.
Each option has its own advantages and disadvantages. A financial institution will needto consider possible impacts of a security measure on existing ATM operations. This is why
there is no simple way to tell which is the better option. This guide, therefore, provides
4

clues to making decisions on whether to use a scheme of management or that of a systemsuch as cryptographic technologies. What should deserve foremost consideration in thisguide is the size of control workload. Security guidelines have already been released by anumber of nations and public institutions, whether publicly or nonpublicly. None of these
releases of guidelines, however, mentions the size of operational control workload possibly
increased after recommending/mandating the security measures are implemented.
For example, criminals often illicitly withdrew money from ATMs by installing malware
after opening the ATM maintenance doors with physical keys. Against such crime incidents,"Guidance and recommendations regarding logical attacks on ATMs" [2] , released by
European Union Agency for Law Enforcement Cooperation (EUROPOL), recommends thefollowing countermeasures: changing the physical locks of ATM maintenance doors withunique ones, demanding rigid personal authentication on those gaining access to the ATM
maintenance doors and setting a unique password to log in as an OS administrator to each
ATM.
The emergence of these guidelines has been motivated by concerns over a lack of proper
management practices: a maintenance doors of every ATM could be opened with a single
physical key, or the same OS administrator password was used for every ATM, whicheasily enabled criminals to install malware in the cases outlined above. Existing guidelines
recommend a lot of stringent management in a bid to make up for such a lack of proper
management. Financial institutions are forced to introduce excessive control workload,
which might rather increase security risks because of possible incomplete management
practices or possible default of due administrative tasks.
In certain countries, some ATMs are located in sites so far (e.g. half a day's distance)from their maintenance contractor. If a unique lock is used for the maintenance door to an
ATM, for example, the ATM would be inaccessible for maintenance when the maintenancepersonnel failed to bring the correct physical key with them. As a result, the maintenancecontractor would be accused by the financial institution because they could not perform a
specified maintenance. In addition, the extended period of ATM inavailability would causeinconvenience to ATM users. Their ATM services being social infrastructures, financial
institutions have obligations to provide consistent services to the society. This is one
reason why security is not a foremost priority for financial institutions.
To ensure that the maintenance personnel will bring the correct key with them, additional
aspects of management would be needed. Overdependence on management could resultin a negative spiral of cyclic management hassles. If the introduction of a security measureis expected to have a major impact on the control workload, a security mechanism (e.g.
5encryption) would be another option. Assume, for example, a crime technique that installs
Personal Identification Number (PIN)-stealing malware in an ATM. One countermeasureagainst this threat, for example, might be equiping the ATM with a device, called“encrypting PIN pad,” to encrypt a PIN within the device, instead of strictly restricting thosehaving access to the ATM to prevent malware from being installed in the ATM.
Since all PINs output from an encrypting PIN pad are encrypted, it would be extremely
difficult to abuse them even if they could be stolen by means of malware installed inside
the ATM. Encrypting PIN pads, a security mechanism, thus help avoid criticalconsequences when ATMs cannot be placed under stringent access control, which would
consequently lightened financial institutions' management burdens without sacrificing ATM
user convenience.
In this way, if a security mechanism (e.g. encryption) is in place, it might lighten
management burdens, reducing the chances of the maintenance personnel being unable
to fix ATM failures because of the wrong physical key they carried. The result would be
operational stability of ATMs. Because financial institutions need to make decisions onwhether to depend on management or security mechanism (e.g. encryption) in exploring
the security measures to implement, criteria in making such decisions are also included inthis practice guide.

2 Security Measure Formulation Procedures
Table 2-1 outlines the procedural steps to formulate security measures for ATMs. Steps(1) to (4) are the ones where to analyze crime incidents and list proposed measures from aperspective of defense in depth. Steps (5) to (7) are the ones where to give a comparative
review to the proposed measures thus listed. Step (8) is the one where to apply the
proposed measures to crime incidents yet to be committed.
In (1), protected assets are listed first and their priorities are defined. Next, in (2), typicalcrime incidents targeting protected assets are collected. This is because typical crime
techniques taken in the past are believed most likely risky. Criminals are thought to have atendency to stick to a successful crime technique while making minor changes to it. In (3),the crime technique taken in each individual crime incident collected is broken down into
attack steps. In (4), proposed measures for defending against the individual attack steps
are listed with defense in depth taken into consideration.
In (5) to (7), the effectiveness of each individual measure is evaluated from a viewpoint of
the control workload. Even though a financial institution introduces a security measure, if it
6

involves an excessive control workload on the institution, inadequate perfection ofmanagement, it could result in incomplete management practice, omission or default to
detract the usefulness of the security measure. Hence, the control workload needs to beanalyzed to assess the practical usefulness of security measures in operation and to findout in which attack step they should prove most useful as defense. In step (5), theoperations that may be impacted by the introduction of the proposed measures are listed
to estimate the control workload arising from the affected operations. In step (6), risk
values required for comparison purposes are derived from the estimates of the control
workload with risk rating methodologies. In the last step, (7), the proposed measures arecompared in terms of their practical usefulness on the basis of their risk values estimatedin (6) to find out in which attack step they should be taken to prove most effective.
In step (8), analyses done in steps (1) to (7) are applied to crimes yet to be committed toestimate effective measures.

A detailed description of the step procedures by classification follows.

Table 2-1 Security Measure Formulation Procedures
SectionClassification

Item
(1)

2.1

Analyze crime
incidents and list
proposedmeasures2.2

Analyze the impactof security
measures upon
operations

2.3

Evaluate proposed
measures to selectadequatemeasures

2.4

Extend application
to crimes yet to becommitted(2)(3)

Security Measure Formulation Procedure
List protected assets
Collect typical crime incidents targeting theprotected assets
Break down the crime incidents into attack
steps

(4)

List measures to defend against attack steps(withdefense
in
depth
taken
into
consideration)(5)

Analyze the possible impact of the listed
security measures upon existing operations(from a viewpoint of operational control
workload).

(6)

(7)

(8)

Estimate the practical usefulness of the
proposed measures with their impact upon
existing operations taken into consideration.
Compare and select proposed measures withtheirpractical
usefulness
taken
into
consideration.
Estimate effective measures through analysesin (1) to (7) above and extend their application
to crimes yet to be committed.
72.1

Analyze Crime Incidents and List Proposed measures

This section describes the four steps, (1) to (4), given in Table 2-1 Security Measure
Formulation Procedures.
(1) List assets to be protected
Table 2-2 lists the protected assets along with their levels of importance. The level ofimportance of an asset is determined from the magnitude of the impact attacks on that
asset may have upon banking transactions and the size of profit the malicious group may
gain. According to standards, such as PCI DSS or PCI PTS POI formulated and releasedby the PCI Security Standards Council, PINs and magnetic card track data have thehighest level of importance followed by card numbers (primary account numbers).
On the other hand, among all assets that are not protected under existing standards,
those linked to cash have a high degree of importance. For example, a cash dispensing
command that gets cash out of a bill handling module is an information asset often
targeted by malicious groups for its close linkage to cash. Although no cases have beenreported as yet, there could be an attack in which the results of loading bills into an ATM
and counting the amounts of deposits in deposit transactions are disguised to pile them up
in a fraudulent account.
There have been no reports of the practice of such attacks so far, because criminals haveto add attack steps in which unauthorized deposit amounts are built up in a given accountin fraudulent deposit transactions before the criminals can withdraw cash from the accountin normal withdrawal transactions. However, once countermeasures against fraudulent
withdrawal attacks prevail, attackers could target deposit transactions.

Table 2-2 Examples of Protected Assets Listed
Importance

High

Asset
Protected
underExisting
Standards
orFrameworks- PINsMagnetic
card
track
data

8

Asset Not
Protected under
Existing
Standards orFrameworks- Cash (bills,
coins)- Withdrawal
command
Deposit/withdrawal
slot shutter open
command- Deposit counting
data- Deposit(remittance)
destinationaccount number

MediumCardnumbers(including
log data that
contains
card
numbers)- Card data (onmemory in ATM
applications)- Card media-

Log data, etc. that
does not containthe above

Low* Payment Card Industry standard, etc.

It is necessary, therefore, to raise the priorities of those assets that can be easily targetedby attackers and that have a major impact on banking transactions.

(2) Collect typical crime incidents targeting protected assets
As explained in 1, “Introduction,” because ATMs are considered prone to the risk of
iterations of past crime practices, typical practices of past crime incidents that target the“protected assets” extracted in Step (1) will be collected to aid in the formulation of
security measures. Crime incidents that target the protected assets are listed in Table 2-3.

Table 2-3 Typical Crime Incidents Targeting Protected Assets#

Import-Category

ance
1

High

Protected

Crime Incident

Asset
PIN

PINs

2

MediumCard holder
data

Card holder
data(memory inATMapplications)

3

High

Cash (bills)

Cashdispensing
command9

PINs, if not encrypted, might be stolen
by malware or the like.
Malware could steal Primary AccountNumbers from the RAM of an ATM
control unit. Malware intruding into the
ATM control unit would be distributed
from the software distribution server as
authorizedsoftware,sothatwhitelist-based anti-malware protection
may not work.
a) Fraudulent withdrawals assisted bymalware that is physically intruded via
media.
b) Fraudulent withdrawals assisted bymalware that is intruded from thefinancial institution’s intranet.

-

-

-

-

-

-

10

being dispensed from the ATM.
Detailed steps:
The on-site criminal transmits a QR code or a scramble code
appearing in the ATM screen to a remote commander (server) using
a cellular phone, SMS mail or the like (1).
The on-site criminal receives an authorization code on its cellular
phone in reply (2) and enters it into the malware using the PIN padon the ATM (3). This allows the malware to send cash dispensing
commands to the bill handling unit and dispense bills (4).
(5)

Recovery ofbills

The on-site criminal collects the bills dispenseed from the ATM.

(4) List measures to protect against attack steps (with defense in depth taken into
consideration)
Once typical crime incidents are broken down into attack steps, the next step is to list
measures to protect against the individual steps. Table 2-5 describes the individual attack
steps of a fraudulent withdrawal case assisted by malware, with various action
requirements outlined in “Guidance and recommendations regarding logical attacks on
ATMs” [2]released by EUROPOL applied to them, with defense in depth in mind. In thetable, boldface underscored in red identifies a requirement that possibly involves extensive
control workload with the introduction of a measure. The table classifies those measuresthat frequently require manual logging, visual work checks and verifications or password
management as “control workload-intensive measures” and other measures as “control
workload-saving measures.”

Table 2-5 List of Measures to Protect against attack steps of a Fraudulent Withdrawal
Assisted by Malware(1) Maintenancedoor unlocking

First roundPhysicalaccess(2) Malware install(3) Malware
activation(1) Personal
identification(2) Maintenancedoor key
management(3) Surveillancemonitoring

Secondround
Offlinedefense(4) BIOS password
management(5) Hard disk encryption
(*1)

Third
round
Onlinedefense(6) OS hardening(7) Anti-malware basedon “whitelisting”(8) USB protection

11(6) OS
hardening(7)
Anti-malware(4) Withdrawal
transaction

based on“whitelisting”
Fourthround
Additional
measures(11) Fraud monitoring(12) ATM monitoring(13) Segregation ofduties(11) Fraudmonitoring(12) ATM
monitoring(14) Cashrefilling cycles* Boldface underscored in red identifies a requirement that possibly involves much control workload with
the introduction of a measure.
*1 If measures involve the use of passwords for encryption key management, they are classified ascontrol workload-intensive measures.

12

2.2 Analyze the Impact of Security Measures upon ATM op
erations
This section describes Step (5) in Table 2-1.

(5) Analyze the possible impact of the listed security measures upon existingtransactions
The implementation of security measures required for defense in depth could impact
existing operations more or less, and/or create new management jobs. Too much impact
on existing operations or burden on control work might impede thorough perfection of the
management practices associated with security measures, adversely affecting theirpractical usefulness. Boldface underscored in red in Table 2-5 designates an action itemthat possibly impacts operational control workload, so that its practical usefulness is ofconcern. The following estimations are important to evaluate the effective strength of asecurity measure. One is what kinds of management items are involved in theimplementation of the security measure

the other is how much associated control

workload is involved in the implementation.
Figure 2-2 shows the procedures for analyzing the possible impact of the listed security
measures upon existing operations. These procedures are organized into two analysis
steps, which are further divided into six and three substeps, respectively, as outlined
below.

13

--Impacted ATM
operations

Work step 1

Management AreaＢWork step 2

Management AreaＣ

frequency

Work step 3

Management AreaＢWork item 2Work step 1

Management AreaＡWork step 2

Management AreaＢWork item 1

Listed security
measureEstimate work



-





-

-

-

Ⅰ-

-

-

-

-

-

14



2.2.1 (Analysis Step) Analyze the possible impact of the listed
security measures
I-(1) Identify work items relevant to the ATM operations impacted by the
implementation

of

the

listedsecurity

measuresandassumework

frequencies per year.
To begin with, find out what existing operations will be impacted by the implementationof the security measures listed and identity such existing operations as work items. In
order for a newly implemented security measure to work successfully, some kind of control
work is required. For example, consider introducing a setting that disables AUTORUN toprevent malware from being installed in the ATM control unit through a USB memory
device plugged into its USB port. In this case, a new management task, such as monitoring
the workers’ behavior to ensure keep that AUTORUN is disabled, would be needed as awork item. It would also be necessary to estimate the frequency with which that work item
is carried out per year. Table 2-6 lists typical items of work relevant to ATM operations.

Table 2-6 Work Items Relevant to ATM Operations and Examples of Work Required
Work Item

Work Descriptiona) CIT work

A CIT company’s employees or a bank’s clerks collect extra cash from an
ATM or replenish an ATM with wanting cash. Because the cash stored in an
ATM is guarded by means of physical protection, such as a safe door, CIT
work involves not only unlocking the ATM maintenance door but also
unlocking the means of physical protection, such as a safe door. Financial
institutions usually do not permit accessing cash alone at an ATM. They
require more than one person in this case.
In cash cassette installation and collection work, cash in an ATM may beexchanged using cash cassettes or may be replenished and collectedwithout using cash cassettes. Recycling ATMs are in common service inJapan. Frequencies of CIT works vary depending on the financial institution
or the branch office, because they depend on the balance between theamount of cash deposited and that of cash withdrawn.
CIT works are the most frequently conducted among works gaining
access to the inside of an ATM. Frequencies of CIT works are usuallyagreed upon between a financial institution and its CIT company to someextent, and the average frequency needs to be heard from the financial
institution.

b) Periodic
cleaningwork

The inside of an ATM is cleaned periodically to remove dust that isaccumulated inside as bills move. The dust could lead to troubles, such as
bill jams. Because cleaning is carried out in the bill handling unit as well,
the cleaning work arises to unlock the means of physical protection such asa safe door, as well as the ATM maintenance door. When accessing to thebill handling unit, it is normally carried out by a team of two or more workers
to ensure security.
Frequencies of cleaning works depend on how often the ATMs are used,15

how many bills are stored in the ATMs and what are the conditions of thebills like. To estimate work frequencies, therefore, it is necessary to verify
the work records by checking with the financial institution concerned.

c) Software
updatework

With ATMs, software update work arises to improve ATM services. The
work covers updating application, changing configuration, and renewing adcontent in the ATMs and so on.
The work of updating software involves developing updates at thesoftware development site and testing them at a financial institution’s test
site, in addition to installing them in ATMs. Moreover, the work includes
transporting the media containing software between these sites andtransporting install media from media stock sites to the location of eachATM.
If software is distributed from a software distribution server to individualATMs through a network, control works are needed to prevent information
leakage as the software is transported from the test site to the software
distribution server site or transmitted through the network.
Frequencies of the work vary from one financial institution to another. To
find out how many updates are expected a year and to estimate the work
frequencies, therefore, it is necessary to check with the financial institution
concerned.
If a problem, such as a jam, occurs while bills are moving in an ATM
service, fault recovery work is required. If a problem occurs outside thesafe, or outside the bill handling unit, maintenance personnel would comed) Fault
recoveryworke) Supplies
replenish
ment andparts
replacement work

maintenance door with a physical key to allow maintenance personnel to fix
the problem.
If a problem occurs within the bill handling unit, it involves access to the
cash to fix it. Hence, access control by a team of two or more workers is
required.
Japan has fewer occurrences of ATM failures than other nations, but they
could still happen and there is no deciding the frequencies with which tocarry out recover work beforehand. It is necessary, therefore, to verify thework records by checking with the financial institutions concerned and thenestimate expectations for the work frequencies under reasonableassumptions.
Work involving access to the inside of the ATM arises as supplies, such as
operation slip print forms and passbook printer inks, are replenished andexpendable parts, such as rubber rollers and belts, are replaced.
Because the work of replacing rubber rollers, belts and other parts
required for conveying bills sometimes requires access to cash stored
inside, two or more workers working in a team, as in the case of CIT work,
would be required as an access control practice.
Frequencies with which the work needs to be carried out for ATMs
depend on how often the ATMs are used, how many bills are conveyed andwhat their conditions are like. To estimate work frequencies, therefore, it isnecessary to verify the work records by checking with the financial
institution concerned.

16

I-(2) Break down each work item identified into a sequence of work steps.
After the work items that are impacted by the implementation of the listed security
measures have been identified, break down each work item into a sequence of work steps
and then identify the control work required for each of these work steps. Because theintroduction of new security requirements could impact existing control work as well, theidentification of control work required for the work steps helps size up their impact. Since
financial institutions conduct operations that involve access to cash and other important
assets, they are assumed to have certain management rules in place under which toensure security in the implementation of the individual tasks procedures. These
procedures also need to be broken down into work steps and the control work per step
identified.

I-(3) Define management areas for ATM operations and apply a work step to each.
This document introduces the concept “management area” to ease the work of estimating
the requirements for the control workload for introducing security measures. A
management area consists of a group of work steps to make the control workload easier toestimate. Figure 2-3 shows an example of using physical boundaries as management
areas to classify the control workload involved in the individual work steps. In this example,
management areas are grouped into six: (m1) management at other sites, (m2) banking
office outside in-transit management, (m3) banking office inside management, (m4) ATM
maintenance door inside management, (m5) safe door inside management and (m6)monitoring center inside management. The work of moving from a site remote from thebanking office in question to gain physical access to the inside (safe) of an ATM installed inthat banking office, for example, would involve moving to that other site remote from thebanking office, then from that site to the banking office, and moving for access within thebanking office, inside the ATM maintenance door and inside the ATM safe door in this order.
When the work is done, move and access will occur in reverse order. Different levels ofcontrol work by management area would be required at the same time. If surveillancecameras are available for capturing internal views of ATM booths, monitoring work at themonitoring center needs to be added as a management area.

17

-

-



18

-

-

-

19

therefore, to identify the management tasks necessary to realize the ideal form ofmanagement to maximize the security effects of the listed security measures.
Table 2-7 describes how the management tasks needed to achieve the ideal form ofmanagement can be applied to management areas upon occurrence of work events
targeting an ATM. If a physical key to an ATM maintenance door is to be brought out, it
should be placed under rigid management at its checkout, usage and return. Further, if an
ATM installed at an unstaffed office is to be serviced, the management of a physical key intransit to the branch (for example, a measure to keep the key from being duplicated bymalicious staff) would be needed in addition. The ideal form of management in thisexample might include, for example, two staffs moving in a pair to check each other’s
behavior.

Table 2-7 Examples of Ideal Form of Management Tasks When Work Events Occur# Management

AssumedManagement Tasks Required for Ideal Form of

SceneManagement

Whenreleased- Management while transporting media (management
by two staffs working in pairs, etc.)- Management while transporting media andpasswords (management by two staffs working inpairs, etc.)- Key checkout/return management, proper usage
management- For branches, in-transit management (management
by two staffs working in pairs, etc.)- Work-in-process fraud monitoring (management by
two staffs working in pairs, etc.)

Area
1 (m2) Banking
office outside
in-transit
2
management(m3) Banking
3 office inside
management(m4) ATM
maintenance4
door inside
management(m6)
Monitoring
5
center inside
management

When
servicingWhen
servicingWhen
servicing

Periodicchecking- Check booth surveillance camera images periodicallyfor problems.

I-(6) In addition to I-(5) above, identify the routinely occurring management tasksneeded to meet individual requirements, regardless of whether work items
occur or not.
Even for the case where an actual work does not occur as to listed security measures, it
still is necessary to identify routinely occurring control work from the moment of theirimplementation and explore tasks needed to achieve the ideal form of management. Table20

2-8 exemplifies ideal form of management tasks to routinely occurring control work bymanagement area.
Physical keys used to unlock ATM maintenance doors need to be placed under access
control not only when maintenance works are conducted accompanying accessing inside
ATMs but also 24/7 even while maintenance work does not occur. The physical keys
should be managed constantly so that malicious people do not pick up the keys without
permission and so that malicious people make an impression of the keys to duplicate them.
Even though unique locks are introduced as a security measure, if their keys are poorly
managed, there will be no defending against malicious attacks. Accordingly, allmanagement tasks that are liable to attack risks should be listed completely to preclude
management flaws.

Table 2-8 Examples of Ideal Form of Management Tasks to Routinely Occurring
Control work#

Management Area

Assumed Scene

Management Tasks
Required for Ideal Form ofManagement1(m3) Banking office inside
management

Constantly(24hX365 days)
Constantly during
development(24h X 365 days)

2(m1) Management atother sites
Constantly(24h X 365 days)

34(m6) Monitoring center
inside management

Constantly(24h X 365 days)- Access control at physicalkey storage places(biometric authentication,etc.)- Access control ormaintenance management
for a development or
evaluation environment- Medium and password
access control (biometricauthentication, etc.)- For remote distribution,
server or network security
management (access
control biometricauthentication, etc.)- Check for ATM malfunctions
or unexpected shutdowns
constantly.
- Check booth surveillancecamera video data
periodically for problems.

2.2.2 (Analysis Step II) Analyze the Control Workload of the Listed21

Security Measures
When the impact analyses of the administrative works are completed for the listed
security measures, the next step is to estimate how much workload each administrative
work will produce concretely. Human psychological aspects of the administrative works
should be taken into account in this estimation. If the control works are intolerably high forstaffs, they could omit or neglect some of necessary procedures, which could eventuallylead to managerial vulnerabilities. Hence, the detailed load of management works involved
is estimated in further depth. This step is broken into three analysis substeps as described
below.

II-(1) Estimate the workload of the control work in each work step and accumulate
the estimates by work item. In addition, estimate the workload of routinely
occurring control work.
Estimate how much workload will be required per service for a work item on the basis of
the analysis results gained in step II-(1). For example, a control work that physical keys to
the ATM maintenance doors are lent to a maintenance person will involve the following:
personal identification and recording in a management ledger when lending the keys, andthe same when returning the keys. Even though no maintenance work occurs, access
control to the physical keys is required 24/7 to keep them from unauthorized accesses bymalicious individuals. Such control works could occur routinely. What kinds ofmanagement ways should be assumed are to be determined in consultation with thefinancial institution concerned.

Table 2-9 Examples of Estimates of Assumed Control Workload by Management Area#

Management
Area

Assumed
Scene

Management Tasks Required
for Ideal Form of Management

Assumed Control
Workload1(m2) banking
office outside
in-transit
management

When
servicing- Management while transporting
media and passwords(management by two staffs
working in pairs, etc.)

Labor unit cost x 2
workers x travel time /occurrence / banking
officeKey checkout/returnprocedure hours /occurrence / banking
officeLabor unit cost x 2 staffs
x travel hours /occurrence / banking
office2(m3) Banking
office inside
management3

Whenservicing- Key checkout/return
management, proper usage
management- For branches, in-transit
management (management by
two staffs working in pairs, etc.)
22

4

5

(m4)
ATM
maintenancedoor
insidemanagement(m6)
Monitoring
center inside
management

When
servicing- Work-in-process fraud
monitoring (management by two
workers working in pairs, etc.)

Periodicchecking- Check booth surveillancecamera images periodically for
problems.

Labor unit cost x 2 staffs
x work hours /occurrence / ATMVideo verification work
hours / occurrence /week / office

One example of the management might be using a surveillance camera to constantly
capture those gaining access to the physical keys. In this case, the names and times
recorded in the management ledger can be verified against the images of the individuals
and times captured on the surveillance camera. Once per week of video-recorded data
might be played back at fast speed to verify in one hour, for example. In this way, it isnecessary to estimate how much control workload will be needed so that listed measures
work effectively under relevant assumptions. Table 2-9 exemplifies calculations to estimate
the workload required for the ideal control work by management area. The estimation
requires the number of staffs involved, their working time per occurrence, the number ofbanking offices and so on.

II-(2) Calculate the product of the workload of the control work accumulated bywork item by the frequency of each work item in Ⅰ-(1). Add the workload ofroutinely occurring control work to the product. Then, accumulate the sums
across all work items.
Multiply the control workload required for a work item occurring as estimated in II-(1) by
the frequency estimated in I-(1) to estimate how much control workload will occur per year.
Add estimates of the control workload that occurs routinely, regardless of whether work
items occur or not, to the product. Because the control workload also varies depending on
the number of ATMs installed, that of banking offices,and/or that of development sites, itneeds to be proportionalized according to these kinds of factors. Assuming that CIT work
occurs at a frequency of once a week, for example, it should occur 52 times a year.
Assuming that the ad content in ATMs is renewed every season, then the software update
work occurs four times a year. Regarding periodically occurring control work, if it isrequired, for example, to capture internal views of ATM booths with surveillance cameras
and to verify the video data once each week, it should occur 52 times a year.
In this way, if the product of each work item by its frequency is calculated and thenaccumulated across all work items, then the annual control workload can be estimated forone measure listed.
23

II-(3)Carry out II-(1) and II-(2) above for each security measure listed. Even
though a listed measure gives rise to a totally new work item, perform
Analysis Steps I and II as well.

If two or more measures have been listed, the work outlined in II-(1) and II-(2) needs tobe carried out for each measure. In practice, the requirements for control workload foreach listed security measure are collectively estimated in groups, such as management
areas. For example, if a listed security measure involves the work of setting a BIOS
password and that of setting an OS administrator password, control work necessary to
prevent these passwords from being stolen or abused will be required at the same time.
Two workers must always work in a pair to check each other if setting at least either a
BIOS password or a OS administrator password is introduced.
Thus, control work would become necessary if any requirement is involved in the work to
be carried out inside maintenance doors, rather than separate control work will become
required for each security measure to be implemented.
It follows, therefore, that, the job of estimating the control workload requirements can be
conducted easier by grouping each of the listed security measures with a particularmanagement area.
Table 2-10 outlines how each measure can be applied to a management area, without
breaking the measure into work steps, to gain a preliminary estimate of the extent of its
impact. As explained above, boldface underscored in red designates a requirement thatpossibly involves high operational control workload in the implementation of a measure. Itroughly suggests which management area includes less control workload.
If a control work is newly introduced, additional control works should be considered. For
example, if biometric authentication is introduced for access control of physical keys to
ATM maintenance doors, the additional control work is verifying the biometricauthentication logs or visually verifying the status of access to physical keys constantly
captured by surveillance cameras. For these additional control works, Analysis of Steps I
and II must be carried out as well.

24

Table 2-10 Examples of Management Areas Relevant to Measures (EUROPOL
Requirements#

1

AttackMeasure (EUROPOL

Step

Requirement)(1)
Maintenancedoor unlocking(1) Personal identification(2) Maintenance door key
management(3) Surveillance camera(m3) Banking office inside
management(4) BIOS password
protection(5) Hard disk encryption(including password andencryption key
management)(m1) Management at other sites(m2) banking office outside
in-transit management(m3) Banking office inside
management(m4) ATM maintenance door
inside management

2

3

(2)
Malwareinstall456(13) Division of duties(3)
Malwareactivation

78(6) OS hardening(7) Whitelist(8) USB device defense(11) Software behavior
monitoring(12) ATM equipment
monitoring(unexpected reboot)(4) Withdrawal
transaction(6) OS hardening(7) Whitelist(11) Software behavior
monitoring(12) ATM equipment
monitoring(14) Cash replenishment
amount/interval
optimization

25

Management Area(m4) ATM maintenance door
inside management(m6) Monitoring center inside
management(m3) Banking office inside
management(m4) ATM maintenance door
inside management(m6) Monitoring center inside
management(m5) Safe door inside
management

2.3

Evaluate Proposed Measures Comparatively

This section describes Steps (6) to (7) in Table 2-1.
(6) Estimate the practical effectiveness of the proposed measures with theirimpact upon existing operations.
Estimate how the security risks will vary before and after the implementation of thelisted security measures, using a risk assessment formula. A number of risk assessment
methods are available. Table 2-11 lists some typical risk assessment methods. The CVSS
method is the most commonly used, whereby risk values are assessed from viewpoints of
the impact of attacks and the ease of exploit.The CCDS prototype method is a simplified
version of the CVSS method. The EDC method is a method estimating risk values withcombination of an event tree and a defense tree. Risk values are estimated based on an
event-driven of attacks, whereby an event whether an attack succeds or fails determines
the subsequent attack steps or defense steps.
The ALE (annualized loss expectancy) method estimates a risk value in terms of anannualized loss amount. The annualized loss expectancy is calculated as the product of
the single loss expectancy and the annualized rate of occurrence. The more an
implemented security measure involves control workload, the more it would be prone tohuman mistakes or negligence, which might be exploited by attackers. Therefore, thecontrol workload can be substituted for the annualized rate of occurrence with anappropriate equation. For example, human work errors are said to have an occurrence
probability of 1% or so. If 1% of the 1% leaves solid blocks of exploitation time available forattackers, one 10,000th of the control workload (time) can be viewed as a time open to
attacks. This estimate is just an example and appropriate risk assessment. Suitable risk
values should be assessed based on an insight into the actual operating conditions of thefinancial institution.
OWASP (Open Web Application Security Project) is an open community dedicated toenabling organizations to conceive, develop, acquire, operate, and maintain applications
that can be trusted. The OWASP Risk Rating Methodology (OWASP method) is a risk
rating methodology developed by the OWASP. It is characterized by financial damages andreputation damages, being included in the risk factors. Overall likelihood and overall
impact are evaluated on the basis of their average values of many factors. So each factor
does not significantly impact the overall values.
Discussions above have reviewed the substantive effects of the listed security
measures with risk assessment methods. The substantive effects of the measure can be26compared in terms of the size of control workload involved as well. Too high control
workload could incur omissions at work or defaults in the worst case, detracting thepractical effectiveness of the measures. The lower the control workload is, the less risk themeasure has and the more securely it works.

Table 2-11 Examples of Risk Assessment Methods
Assessment

Equation

MethodBase score = RoundUp1 (min [(impact＋Ease of exploit), 10])
impact = 1 - (1 - C) * (1 - I) * (1 - A)ease of exploit = 8.22 * AV * AC * PR * UICVSS method
C: Confidentiality Impact, I: Integrity Impact, A: Availability Impact
AV: Attack Vector, AC: Attack Complexity, PR: Privileges Required,
UI: User Interaction
Risk score = (Exploitability subscore + Impact subscore) * Attacker’s
CCDS

motivation

Prototype

Difficulty = 4 ranks (multiple conditions, single condition, one or moremethodconditions, no need for conditions)
impact = 4 ranks (minor, medium, serious, destructive)
EDC: Event tree and Defense tree combined method
Total risk value= Add up risk values by time-series event

Risk value by time-series event = Attack failure probability at that
EDC method
time-series event* Impact of damages incurred up to thetime-series event before the last
Annualized loss expectancy (ALE) = Single loss expectancy (SLE) *Annualized rate of occurrence (ARO) = Asset value (AV) * Exposure
factor (EF) * Annualized rate of occurrence (ARO)
ALE method
single loss expectancy (SLE) = Asset value (AV) * Exposure factor (EF)SLE: Single Loss Expectancy
ARO: Annualized Rate of Occurrence
Risk = Likelihood * Impact
OWASP
Likelihood = Threat agent + Vulnerability
methodImpact = Technical Impact + Business Impact
27

(7) Compare and select proposed measures with their practical effectiveness.
Now the control workload or a risk value of each security measure has been
calculated, those values can be compared to identify in which attack steps the measures
should be implemented with maximum performance. As a control workload corresponds
to a risk values, a method to compare the control workloads, instead of the risk values, isused in the following.
Table 2-12 Measures Associated with Management Areas (EUROPOL Requirements)
Attack Step

(1) Maintenancedoor unlocking(2) Malware
installation

Management Area

Measure (EUROPOL
Requirement)(m3) Management
inside banking office(1) Personal identification(2) Maintenance door key
management(3) Surveillance camera(m1) Management atother sites(4) BIOS password
protection(5) Hard disk encryption(including password andencryption key
management)(m2) Management
in-transit outsidebanking office(4) BIOS password
protection(5) Hard disk encryption(including password andencryption key
management)(m3) Management
inside banking office(4) BIOS password
protection(5) Hard disk encryption(including password andencryption key
management)(13) Division of duties(m4) Management
inside ATM
maintenance door

(4) BIOS password
protection(5) Hard disk encryption(including password andencryption key
management)(6) OS hardening(7) Whitelist(8) USB device defense(11) Software behavior
monitoring(m6) Management
inside monitoring center(12) ATM equipment
monitoring(unexpected reboot)28

(3) Malware
activation(4) Withdrawal
operation(m4) Management
inside ATM
maintenance door(6) OS hardening(7) Whitelist based
anti-malware software(11) Software behavior
monitoring(m6) Management
inside monitoring center(12) ATM equipment
monitoring(m5) Management
inside safe door

(14) Cash replenishment
amount/interval
optimization

While Table 2-10 summarized which management area each measure (the Guidelines
requirements) is associated with, Table 2-12 summarized which measures eachmanagement area is associated with. Since annual control workloads have already been
estimated by management area, it possible to identify and prioritize the attack steps todefend most efficiently and most effectively by comparing the control workloads. In Table
2-12, once the defense against “(3) malware activation” is failed, “(14) cash replenishment
amount/interval optimization” is the only measure left to prevent “(4) withdrawal
transaction.” This measure requires checking cash balances from time to time as amonitoring activity. If one were to seriously prevent fraudulent withdrawals at this stage,
one would have to check cash balances every hour, for example. This would be too
unrealistic to make the Guidelines requirements truly effective. Accordingly, a comparative
assessment with the control workloads required should make it possible to formulate
appropriate security measures within limited resources and budgets.

2.4

Extending Application to Crimes Yet to be CommittedThis section focuses on Step (8) in Table 2-1.

(8) Extend application of measures to potential crimes through analyses above
Even for potential crimes, it is possible to break a crime down to attack steps and to
estimate control workloads of security measures against an attack step in accordance with

(1) identify protected assets,(2) refer similar crime incidents,(3) break down the crime into attack steps assumed with the similar incidents,(4) list the measure candidates to defend the each attack step from a view point ofdefense in depth,29(5) analyze the possible impact of the measures upon the existing operations(operational control workload),(6) estimate the practical effectiveness of the measures with their impact on the existing
operations,(7) select the most relevant measures by comparing the measures from a standpoint of
their practical effectiveness and select the attack steps that can be most effectively
defended against.
Regarding (2) (3), what is important is to think what kinds of attacks criminals are up tonext, to maximize the effects of selected security measures. Just as the statement “Thesize of returns for risks should be of concern to the criminals as well” in Chapter 1 says.
Supposing existing attacks to get some assets are completely failed, consider what assets
with the second priority criminals would try to get. Then think of what attack methods
criminals would prefer from a perspective of the criminal’s inventments, attack workloads,
and risks of detection or apprehension. Namely, it is important to imagine what criminals
would attack and how from a criminals’ standpoint. In this way, the framework presented
here should make it possible to design specific security measures and to estimate thepractical effectiveness of the measures even for potential crimes.

3 Conclusion
This document provides guidelines for thewhich is better to protect assets by enforcing stringent management in operation or bymechanisms such as cryptography as well as consumer devices.
The vast amount of control workloads is required to make existing measures work
effectively in some cases. Neverthaless, none of the existing security guidelines haveexpressly pointed out it. For this reason, ineffective measures have been introduced into
financial institutions without regard to the situations. This document suggests one
approach to evaluate the effectiveness of measures quantitatively by numericallyestimating control workloads accompanying a measure to cope with such issues.
Although this document is developed as security guidelines relating to ATM operations, it
might be applicable to other kinds of products as well: assumed threats, security measuresin the life cycle of a product. Vendors are encouraged to make positive use of thisguidelines volume in exploring security measures in their product development process.

30

APPENDIX RISK RATING FORMULA
Appendix 1 CVSS (Common Vulnerability Scoring System) v3 Method[3]
CVSS (Common Vulnerability Scoring System) is an open and generalized method ofvulnerability assessment for information systems. It offers a vendor-independent common
tool of assessment. CVSS employs three kinds of metrics to designate the severity ofvulnerabilities: (1) base metrics, (2) temporal metrics and (3) environmental metrics. Eachof these three kinds of metrics is expressed in a range of values from 0.0 (low) to 10.0(high).
In the course of its upgrading from v2 to v3, CVSS has been modified to feature:

(1)
(2)

introduction of an assessment item called “scope” to allow for an expanding scope

(3)
(4)

changes to the approach to environmental metrics.

For more information, see References.

1.1 Base Metrics
Base metrics is a standard under which to assess the characteristics of vulnerabilities. It
assesses the impact upon three security characteristics required of an information system,that is, confidentiality impact, integrity impact and availability impact, from a perspective of
being attackable from network to calculate a CVSS base score. With base metrics, therating result is fixed and does not change with the lapse of time or differences in the user
environment. It is assessed by vendors, organizations that publicize vulnerabilities and thelike to represent the severity unique to vulnerabilities. CVSS base scores (base scores)
are expressed in equations as follows:(1)

Impact

Before-adjustment impact = 1-(1-C) * (1-I) * (1-A) …Eq. (1)Impact (Scope Unchanged) = 6.42 * Before-adjustment impact…Eq. (2)Impact (Scope Changed) = 7.52 * (Before-adjustment impact - 0.029)
31

-3.25 * (Before-adjustment impact - 0.02) 15(2)…Eq. (3)Exploitability

Ease of exploit = 8.22 * AV * AC * PR * UI …Eq. (4)(3)

Base score

If the impact is zero or less, base score = 0 …Eq. (5)If the impact is larger than 0,
Scope Unchanged: Base score = Round up (min [(Impact + Exploitability), 10])(First decimal place rounded up) …Eq. (6)Scope Changed: Base score = Round up (min [(1.08 * (Impact + Exploitability)),10]) (First decimal place rounded up) …Eq. (7)Definitions of C, I, A, AV, AC, PR and UI are found in Table a1-1 and Table a1-2.

Table a1-1 Metrics Required for Calculating Impacts
Assessment Item

Metric ValueHigh (H)Confidentiality
Low (L)

Impact (C)No (N)High (H)Integrity Impact (I)Low (L)No (N)High (H)Availability(A)

ImpactLow (L)No (N)

Description
Confidential information or sensitive systemfiles could be referenced to deliver an
extensive impact.
Problems, such as information leakage or
avoidance of access restrictions, could arise
but their impact is restricted.
No confidentiality impact.
Confidential information or sensitive systemfiles could be modified to deliver an
extensive impact.
Information can be modified, except for
confidential information and sensitive systemfiles, so that the possible impact is limited.
No integrity impact.
Resources (such as network bandwidths,
processor processing and disk spaces) may
be completely exhausted or shut down.
Resources could be temporarily exhausted
or operations could be delayed orinterrupted.
No availability impact.

32

Value
0.56

0.22
0.00
0.56

0.22
0.00
0.56

0.22
0.00

Table a1-2 Metrics Required for Calculating the Ease of Exploit
Assessment
Item

Metric Value
Network (N)Adjacent (A)Attack Vector(AV)

Local (L)Physical (P)Low (L)

AttackComplexity(AC)

High (H)

None (N)Privileges

Low (L)

Required (PR)High (H)User Interaction(UI)

None (N)Required (R)Unchanged(U)

Scope (S)Changed (C)Description
The target component is remotely attackable via
a network, e.g., attacks launched from theInternet.
The target component needs to be attacked
from an adjacent network, for example, via a
local IP subnet, Bluetooth or IEEE 802.11.
The target component needs to be attacked
from a local environment, e.g., launchingattacks with a local access privilege or byloading fraudulent files into a word-processing
application is required.
The target component needs to be attacked
from a physical access environment, e.g.,launching attacks launched via IEEE 1394 or a
USB device is required.
The target component is attackable at all times
without needing special attack conditions.
There are attack conditions dependent on otherthan attackers. For example, any one of theconditions outlined below might apply in somecase. Attackers need to collect information
about the objects they are about to attack, suchasconfiguration
information,
sequence
numbers and common keys, beforehand.
Attackers also need to define the environmental
conditions under which their attacks can
succeed, such as contention and heap spray
success
conditions.Attackers
requireanenvironment to launch intermediary attacks.
No special privileges are required.
Basic privileges regarding components will
suffice, such as the right of access to
non-confidential information.
An equivalent of the administrator privileges forcomponents is required, such as those gaining
access to confidential information.
Vulnerabilities could be exploited without users
doing anything.
User actions, such as clicking a link, viewing
files or making configuration changes, arerequired.
The scope of impact is restricted to theauthorization scope to which a vulnerable
component is attributed.
The scope of impact could expand beyond theauthorization scope to which a vulnerable
component is attributed. Examples include
cross-site scripting and vulnerabilities that could
be exploited by reflector attackers.

(*) Value for “scope change.”

33

Value
0.85

0.62

0.55

0.20

0.77

0.44

0.85
(0.68)*
0.62(0.50)*
0.27
0.85
0.62

-

-

1.2 Temporal Metrics
Temporal metrics is a standard under which to assess the present severity ofvulnerabilities. It assesses such severity from a standpoint of whether exploit codes
appear or not or whether action information is available or not to work out a CVSS
temporal score. The rating result based on temporal metrics varies with the lapse of time
according to the status of approach to vulnerabilities. It is assessed by vendors,organizations that publicize vulnerabilities and the like to represent the present status ofvulnerabilities. CVSS temporal scores (base scores) can be expressed in an equation as
follows:
Temporal score = Round up (Base score * E * RL * RC) …Eq. (8)(First decimal place rounded up)
E, RL and RC are defined in Table a1-3.

Table a1-3 Metrics Required for Calculating Temporal Scores
Assessment
Item

Metric Value
Not Defined (X)High (H)
Exploit CodeMaturity (E)Functional (F)Proof-of-Concept (POC)
Unproven (U)Not Defined (X)Unavailable (U)Remediation

Workaround (W)Level (RL)
Temporary Fix (T)Official Fix (O)(RC)

This item is not rated.
An exploit code is available under any
circumstances.
Attackable without needing an exploit
code.
An exploit code exists and is usable inmost situations
A proof of concept exists.
An imperfect exploit code exists.
A proof of concept or exploit code is notavailable.
Attack techniques exist only theoretically.
This item will not influence the score.
No remedies are available.
Remedies cannot be applied.
Unofficial remedies are available fromother than product developers.
Workarounds are available from productdevelopers.
An official measure is available from theproduct developer.

Value
1.00

1.00

0.97
0.94
0.91
1.00
1.00
0.97
0.96
0.95

Not Defined (X)This item will not influence the score.

1.00

Confirmed (C)Vulnerability information has been
confirmed by the product developer.
Vulnerabilities have been confirmed at
the source code level.
Vulnerability information has beenbroadly confirmed from a proof ofconcept, exploit code or the like.

1.00

ReportConfidence

Description

34

Reasonable (R)Unknown (U)Multiple sources of unofficial information
have been released by security vendors,
survey groups or the like.
Vulnerabilities have not been confirmed
at the source code level.
Vulnerabilities have not yet been fully
determined or verified.
Only unconfirmed information exists.
There are several conflicting items of
information.

0.96

0.92

1.3 Environmental Metrics
Environmental metrics is a standard under which to assess the severity of final
vulnerabilities, including the product user’s usage environment. It assesses the severity of
final vulnerabilities from a standpoint of the magnitude of secondary damages from attacks,
the status of usage of the target product within an organization or the like to work out a
CVSS environmental score. The rating result based on environmental metrics varies fromevery product user according to the threat assumed for the vulnerabilities. It is assessedby product users to determine how to respond to vulnerabilities. CVSS environmental
scores are expressed in equations as:(1) Modified impact
Modified Before-adjustment impact = min [(1 - (1 - MC * CR) * (1 – MI * IR)* (1 - MA * AR)), 0.915]…Eq. (9)Modified Impact (no scope change) = 6.42 * Modified Before-adjustment impact…Eq. (10)Modified Impact (scope change) = 7.52 * (Modified Before-adjustment impact - 0.029)- 3.25 * (Modified Before-adjustment impact- 0.02) 15 …Eq. (11)(2)Modified ease of exploit
Modified ease of exploit = 8.22 * MAV * MAC * MPR * MUI…Eq. (12)(3)Environmental score
If the modified impact is zero or less, environmental score = 0…Eq. (13)

If the modified impact is greater than 0, no scope change:
Modified base score = Round up (min [(Modified impact + Modified ease of exploit),
10])
Environmental score = Round up (Modified base score * E * RL * RC) …Eq. (14)35

(First decimal place rounded up)

scope change:
Modified base score = RoundUp1 (min [(1.08 * (Modified impact+ Modified ease of exploit)), 10])
Environmental score = RoundUp1 (Modified base score * E * RL * RC) …Eq. (15)(First decimal place rounded up)

Definitions of CR, IR and AR in Eq. (9) above are found in Table a1-4
and MA in Table a1-5

MC, MI

AV, MAC, MPR and MUI in EQ. (12) in Table a1-6 and E, RL and

RC in Eq. (14) and (15) in Table a1-3.

Table a1-4 Target System Security Requirements (CR, IR and AR: Security
Requirements)
Assessment
Item

Metric Value
Not Defined (X)Confidentiality
Requirement
(CR)

1.0

Loss of this item could leave a devastating
impact.

1.5

Medium (M)Loss of this item could leave a serious impact.

1.0

Low (L)The impact would be limited if this item is lost.

0.5This item will not influence the score.

1.0

Loss of this item could leave a devastating
impact.

1.5

Medium (M)Loss of this item could leave a serious impact.

1.0

Low (L)The impact would be limited if this item is lost.

0.5This item will not influence the score.

1.0

Loss of this item could leave a devastating
impact.

1.5

Medium (M)Loss of this item could leave a serious impact.

1.0

Low (L)The impact would be limited if this item is lost.

0.5

High (H)High (H)

Not Defined (X)Availability
Requirement
(AR)

Value

This item will not influence the score.

Not Defined (X)Integrity
Requirement(IR)

Description

High (H)36

Table a1-5 Reassessing Base Metrics with Environmental Conditions Taken into
Account (Modified Base Metrics) 1
Assessment Item

Metric Value
Not Defined(X)

Modified
Confidentiality
Impact(MC: Modified
Confidentiality)

High (H)Low (L)

Confidential information or sensitive systemfiles could be referenced to deliver an
extensive impact.
Problems, such as information leakage or
avoidance of access restrictions, could arise
but their impact is restricted.
No confidentiality impact.

Not Defined

If “Not Defined” is selected, reference therating result with base metrics.

High (H)Low (L)

Confidential information or sensitive systemfiles could be modified to deliver an
extensive impact.
Information can be modified, except for
confidential information and sensitive systemfiles, so that the possible impact is limited.

None (N)No integrity impact.

Not Defined

If “Not Defined” is selected, reference therating result with base metrics.

(X)
Modified
Availability Impact(MA: Modified
Availability)

If “Not Defined” is selected, reference therating result with base metrics.

None (N)(X)
Modified Integrity
Impact(MI: Modified
Integrity)

Description

High (H)Low (L)
None (N)Resources (such as network bandwidths,
processor processing and disk spaces) may
be completely exhausted or shut down.
Resources could be temporarily exhausted
or operations could be delayed orinterrupted.
No availability impact.

Value
-

0.56

0.22
0.00
-

0.56

0.22
0.00
-

0.56

0.22
0.00

Table a1-6 Reassessing Base Metrics with Environmental Conditions Taken into
Account (Modified Base Metrics) 2
Assessment
Item

Metric Value
Not Defined (X)Attack Vector(MAV)

Description
If “Not Defined” is selected, reference therating result with base metrics.

Value
-

Network (N)The target component is remotely attackablevia a network, e.g., attacks launched from theInternet.

0.85

Adjacent (A)The target component needs to be attacked
from an adjacent network, for example, via a
local IP subnet, Bluetooth or IEEE 802.11.

0.62

37

Local (L)The target component needs to be attacked
from a local environment, e.g., launchingattacks with a local access privilege or byloading fraudulent files into a word-processing
application is required.

0.55

Physical (P)The target component needs to be attacked
from a physical access environment, forexample, via IEEE1394 or a USB device.

0.20

Not Defined (X)

If “Not Defined” is selected, reference therating result with base metrics.

-

Low (L)The target component is attackable at all times
without needing special attack conditions.

0.77

High (H)

There are attack conditions dependent onother than attackers. For example, any one of
the conditions outlined below might apply insome case. Attackers need to collectinformation about the objects they are about toattack, such as configuration information,
sequence numbers and common keys,
beforehand. Attackers also need to define theenvironmental conditions under which their
attacks can succeed, such as contention andheap spray success conditions.
Attackers require an environment to launchintermediary attacks.

0.44

Modified Attack
Complexity(MAC)

Not Defined (X)Modified
Privileges
Required (MPR)

None (N)No special privileges are required.

Low (L)

Basic privileges regarding components will
suffice, such as the right of access to
non-confidential information.

High (H)

Modified User
Interaction(MUI)

If “Not Defined” is selected, reference therating result with base metrics.

An equivalent of the administrator privileges
for components is required, such as thosegaining access to confidential
information.

0.85(0.68)*
0.62(0.50)*

0.27

Not Defined (X)

If “Not Defined” is selected, reference therating result with base metrics.

-

None (N)

Vulnerabilities could be exploited without
users doing anything.

0.85

Required (R)User actions, such as clicking a link, viewing
files or making configuration changes, arerequired.

0.62

Not Defined (X)

If “Not Defined” is selected, reference therating result with base metrics.

-

Unchanged (U)The scope of impact is restricted to theauthorization scope to which a vulnerable
component is attributed.

-

The scope of impact could expand beyond theauthorization scope to which a vulnerable
component is attributed. Examples include
cross-site scripting and vulnerabilities that
could be exploited by reflector attackers.

-

Modified Scope(MS)
Change (C)381.4 Seriousness Classifications
CVSS assesses (1) base metrics, (2) temporal metrics and (3) environmental metrics insequence to represent the severity of vulnerabilities in a range of values from 0.0 (low) to
10.0 (high). CVSS v3 classifies the values thus assessed into the following scores ofseverity rankings:

Table a1-7 Qualitative Severity Rating Scale
RatingCVSS Score

Critical

9.0 - 10.0High

7.0 - 8.9

Medium

4.0 - 6.9

Low

0.1 - 3.9

None

0.0

39

Appendix 2 Modified CCDS Method [4]The modified CCDS method is a risk assessment formula that represents a version of
the CVSS method simplified from the CCDS perspective. The method of calculating risk
values is mathematically expressed in an equation as:

Risk value = (Difficulty + Impact) * Attacker’s motivation…Eq. (16)Difficulty, impact and attacker’s motivation criteria are defined in Table a2-1 to Table
a2-3, respectively. Ranks, which are associated with the risk values calculated by solving
Eq. 1, are listed in Table a2-4. CCDS has empirically found that there are no majordifferences between the RISK values calculated by the CVSS method and those calculatedby the modified CCDS method, suggesting the modified CCDS method offers a convenient
tool of assessing risk values.
Table a2-1 Difficulty Criteria
Rank

Criteria
Multiple conditions (such as authentication and special privileges) are
required, and connectable (for an attack) only from a local environment.
A single condition (such as authentication or special privilege) is required,and connectable (for an attack) only from a local environment.
One or more conditions (such as authentication and special privileges) are
required, or connectable (for an attack) only from a local environment.
No attack conditions are required and connectable (for an attack) from awireless network.

S
A
B
C

Value
1
3
5
10

Table a2-2 Impact Criteria
Rank

Criteria
Attacks leave no impact upon users, or only produce a minor error
indication, and leaking information does not help identify an individual.
Attacks put users at a disadvantage or leaking information helps
identify an individual.
Attacks put users at a disadvantage and also produce incidental
damages, or leaking information helps identify multiple individuals.

Minor
MediumSerious
Destructive

Attacks produce fatal damages or incidental damages.

Value
1
3
5
10

Table a2-3 Attacker’s Motivation Criteria
Rank

Criteria

Value

Low

Attacks occur accidentally and the attackers have no intention.

MediumAttackers have objectives, such as testing, pastime or self-display.

1.25

High

Attackers have a specific strong motive, such as gaining monetary benefits
or threatening security.

1.5

40

1

Table a2-4 Risk Value Rank Criteria
Rank

Risk Value

Must

17 - 30(maximumvalue)

High

12 - 16.9

Middle8 - 11.9

Low

0 - 7.941

Appendix 3 Event Tree and Defense Tree Combined Method (EDC)
Method [5]The “Event Tree and Defense tree combined method” (EDC) method is a method thatwas presented by Ryohei Ishi and others at the JSSM (Japan Society of Security
Management). Attackers attacking a system often do so by varying their methods to suit
the time-series events, such as proceeding further attacks if an attack method succeeds orotherwise resorting alternative methods. In the circumstances, the EDC method has beendeveloped as a method of listing and compiling the events that are executed in atime-series into an event tree and estimating risk values from the probability of occurrenceof the individual time-series events and their impact while formulating measures to mitigate
their occurrence and assessing their effectiveness. A summary description of the EDC
method is given below.

(1)

Extract time-series events and describe their impact

In implementing a fraudulent withdrawal assisted by malware, for example, it isnecessary to (1) unlock the maintenance door, (2) install malware, (3) activate the malwareand (4) conduct a withdrawal transaction (because the on-site perpetrator could use acellular phone, not a card, to get a withdrawal permit on challenge/response
authentication). These time-series events are extracted and compiled into an event tree
and the impact of individual events occurring is also described. The impact should beproperly set to reflect the amount of damages and impact upon operations/business.

(2)

Calculate probabilities of occurrence by time-series events and describe

countermeasures
Next, conduct a defense tree analysis with regard to each time-series event as a top
event. A defense tree analysis is to list and link the events that could generate a top event,from the top downward, to generate a fault tree and thus to calculate the probability ofoccurrence of the top tree from the probability of occurrence of each individual event. Thismethod also defines the effectiveness of measures taken to inhibit the occurrence oflower-level events by listing them and their effects (reduction rate) side by side.

(3)

Calculate the total risk value

Determine the product of the probability of occurrence of each time-series event by the
impact (event risk) before totaling the products to arrive at a total risk value. Figure a3-1
shows how to calculate total risks with reference a fraudulent withdrawal assisted by42

malware as an example.

(1)
AttackInitial Event
(2)
(3)
(4)
(5)
MaintenanceTime-Series(malware
Malware Malware Withdrawal Attack
door
Event
development)
installation activation transaction successunlockingP1 * P2

Attacksuccess
probability

P0 (=1)

Attackfailureprobability(1 - P0)(= 0)

1 - P1

1-P2

1-P3

1-P4

-

Magnitudeof impact at
attackfailure atthattime-series
event (*)

-

M1

M2

M3

M4

M5

-

(1 - P1)* M1

P1* (1 - P2)* M2

P1 * P2* (1 - P3)* M3

P1 * P2* P3* ( 1 - P4)* M4

P1 * P2* P3 *P4* M5

Risk valuebytime-series
event
Total risk
value

P1

P2

P3

P4

* P3 *
P4(1 - P1) * M1 * P1 * (1 - P2) * M2 + P1 * P2 * (1 - P3) * M3
+ P1 * P2 * P3 * (1 - P4) * M4 + P1 * P2 * P3 * P4 * M5

Figure a3-1 Scheme of Risk Value Calculation by the EDC Method

43

Appendix 4 Annualized Loss Expectancy (ALE) Method [8] [9] [8] [9]A method of risk quantitization, called “annualized loss expectancy (ALE),” exists. Whileother risk assessment methods come up with classifications, or something closer toqualitative assessments, rather than specific amounts of losses, the ALE method ischaracterized by its ability to represent risk values in terms of specific amounts ofannualized loss expectancies.

Annualized loss expectancy (ALE) = single loss expectancy (SLE) * Annualized rate ofoccurrence (ARO) …Eq. (18)
SLE: Single Loss Expectancy, ARO: Annualized Rate of Occurrence

In this equation, the single loss expectancy (SLE) is the amount of loss expected to arise
when an event occurs once and is calculated by solving asset value (AV) * exposure factor(EV). In addition to the virtual loss, the associated loss, primary response, cost ofrecurrence prevention and so on must be reviewed. The annualized rate of occurrence(ARO) is the number of occurrences of an event expected to occur a year.
Because the equation single loss expectancy (SLE) = asset value (AV) * exposure factor(EV) also holds true, the annualized loss expectancy may be rewritten as follows:

Annualized loss expectancy (ALE) = Asset value (AV) * Exposure factor (EV)* Annualized rate of occurrence (ARO) …Eq. (19)44Appendix 5 The OWASP Risk Rating Methodology [10] [11]OWASP is an open community committed to the goal of solving the issues of Web
application security. The OWASP Risk Rating Methodology (OWASP method) is atechnique for vulnerability assessment developed by the OWASP (Open Web Application
Security Project). It is characterized by financial damages, such as those to money, andreputation damages, being included in risk factors. The method involves the use of somany factors that overall risks are evaluated on the basis of their average value. The
values of the individual factors are not weighted and hardly impact overall performance.
Risk values start from a standard model as represented by Eq. (20).

Risk = Likelihood * Impact …Eq. (20)

The risk values of likelihood and impact can be expressed in equations as:

Likelihood = {Threat Agent+ Vulnerability} / 2 …Eq. (21)Impact = {Technical Impact+ Business Impact} / 2 …Eq. (22)The threat agent, vulnerability, technical impact and business impact can be expressedin equations as:
Threat Agent = {Skill level + Motive+ Opportunity + Size} / 4…Eq. (23)

Vulnerability = {Ease of discovery+ Ease of exploit+ Awareness+ Intrusion detection}/ 4 …Eq. (24)Technical Impact = {Loss of confidentiality+ Loss of integrity+ Loss of availability+ Loss of accountability}/ 4 …Eq. (25)45

Business Impact = {Financial damage ++ Reputation damage+ Non-compliance+ Privacy violation }/ 4 …Eq. (26)
Items contained on the right hand of Eq. (23) to Eq. (26) are defined in Table a5-1 toTable a5-4, respectively.

Table a5-1 Threat Agent Factors
Threat Agent Factor

Skill level

MotiveOpportunity

Size

Rating Result

Value

No technical skills
Some technical skills
Advanced computer user
Network and programming skills
Security penetration skills
Low or no reward
Possible reward
High reward
Full access or expensive resources required
Special access or resources requiredSome access or resources required
No access or resources required
Developers, system administrators
Intranet users
Partners
Authenticated users
Anonymous Internet users

1
3
5
6
9
1
4
9
0
4
7
9
2
4
5
6
9

Table a5-2 Vulnerability Factors
Threat Agent Factor

Ease of discovery

Ease of exploit

Awareness

Intrusion detection

Rating Result

Value

Practically impossible
Difficult
Easy
Automated tools available
Theoretical
Difficult
Easy
Automated tools available
Unknown
HiddenObviousPublic knowledge
Logged and reviewed
Logged without review
Not logged

46

1
3
7
9
1
3
5
9
1
4
6
9
1
3
8
9

Table a5-3 Technical Impact Factors
Threat Agent Factor

Loss of confidentiality

Loss of integrity

Loss of availability

Loss of accountability

Rating Result

Value

Minimal non-sensitive data disclosed
Minimal critical data disclosed,
extensive non-sensitive data disclosed
Extensive critical data disclosed
All data disclosed
Minimal slightly corrupt data
Minimal seriously corrupt data
Extensive slightly corrupt data
Extensive seriously corrupt data
All data totally corrupt
Minimal secondary services interrupted
Minimal primary services interrupted,
extensive secondary services interrupted
Extensive primary services interrupted
All services completely lost
Fully traceable
Possibly traceable
Completely anonymous

2
4
5
9
1
3
5
7
9
1
5
7
9
1
7
9

Table a5-4 Business Impact Factors
Threat Agent Factor
Financial damage(financial damage)

Reputation damage

Non-compliance

Privacy violation

Rating Result

Value

Less than the cost to fix the vulnerability
Minor effect on annual profit
Significant effect on annual profit
Bankruptcy
Minimal damage
Loss of major accounts
Loss of goodwill
Brand damage
Minor violation
Clear violation
High-profile violation
One individual
Hundreds of people
Thousands of people
Millions of people

47

1
3
7
9
1
4
5
9
2
5
7
3
5
7
9

The risk levels of likelihood and impact can be determined from the following table:

Table a5-5 Risk Levels
Risk (Risk value)
Rank (level)0<=Risk value<3

3<=Risk value<6

6<=Risk value<9LOW

MEDIUM

HIGH

MAX: 9Overall risk severities can be determined from the following table:

Table a5-6 Overall Risk Severities
Overall Risk Severities
HIGH

MediumHigh

Critical

MEDIUM

Low

Medium

High

LOW

Note

Low

MediumLOW

MEDIUM

HIGH

ImpactLikelihood

48

REFERENCES[1]

Connected Consumer Device Security Council, “CCDS Security Guidelines by
Product Category: Banking Terminals (ATM) Volume Ver.1.0,” June 8, 2016,
https: //www.ccds.or.jp/public/document/other/guidelines/CCDS Security Guidelines
by Product Category: Banking Terminals (ATM) Volume_Ver.1.0.pdf[2]European law enforcement agency, "Guidance and recommendations regarding
logical attacks on ATMs", June 11, 2015,
https://www.ncr.com/sites/default/files/brochures/EuroPol_Guidance-Recommendati
ons-ATM-logical-attacks.pdf[3]
Information-technology Promotion Agency Security Center, “Common Vulnerability
Assessment System CVSS v3 Overview,” December 1, 2015,
https: //www.ipa.go.jp/security/vuln/CVSSv3.html[4]Connected Consumer Device Security Council, CCDS Security Guidelines by
Product Category: Automotive On-Board Devices Ver.1.01,” June 8, 2016,
https: //www.ccds.or.jp/public/document/other/guidelines/CCDS Security Guidelines
by Product Category: Automotive On-Board Devices _Ver.1.01.pdf[5]
Ryohei Ishii, Ryoichi Sasaki, Tokyo Denki University, “Proposal of a Risk
Assessment Method That Combines Event Trees and Defense Trees and Its
Preliminary Application to Targeted Attacks,” JSSM(Japan Society of Security
Management), 29th National Conference Research Reports[6]
Information-technology Promotion Agency, “Supplement to Survey Report:
Quantitative Security Scale Measurement Guidelines,” 15 Information Economics No.
651,
http: //www.ipa.go.jp/files/000013701.pdf[7]
Institute of Electronics, Information and Communication Engineers, Chapter 8,
Information Security Management - Institute of Electronics, Information andCommunication Engineers Knowledge Base, Group 3, Volume 7 Computer Network
Security Chapter 8 (ver.1), June 14, 2010,
http: //www.ieice-hbkb.org/files/03/03gun_07hen_08.pdf[8]FIPS PUB 31. “FEDERAL INFORMATION. PROCESSING STANDARDSPUBLICATION", "Guidelines FOR AUTOMATIC DATA PROCESSING PHYSICALSECURITY AND RISK MANAGEMENT.”, June 1974,https: //www.ncjrs.gov/pdffiles1/Digitization/68759NCJRS.pdf[9]
FIPS PUB 65, “FEDERAL INFORMATION. PROCESSING STANDARDSPUBLICATION", “Guidelines FOR AUTOMATIC DATA PROCESSING RISKANALYSIS”, August 1975,
http: //www.femto-second.com/Documents/FIPS65.pdf[10] The OWASP Risk Rating Methodology,
https: //www.owasp.org/index.php/OWASP_Risk_Rating_Methodology[11] The OWASP Risk Rating Template,
https: //www.owasp.org/images/5/5b/OWASP_Risk_Rating_Template_Example.xlsx

49