Banks forging ahead on ATM encryption requirements

|tab|

by Michele Skalicky|ret||ret||tab|

SBJ Contributing Writer|ret||ret||tab|

sbj@sbj.net|ret||ret||tab|

|ret||ret||tab|

Financial institutions across the country are preparing to spend thousands of dollars per unit to update their ATMs in order to be compliant with a mandate by MasterCard and Visa.|ret||ret||tab|

Banks will have to upgrade or replace ATMs by April 1, 2005, to be in compliance with triple data encryption standard requirements. Triple DES essentially will provides three times more security for bank customers. |ret||ret||tab|

Single DES was developed by an IBM team 30 years ago and was adopted as a national standard in 1977. But in 1998, the Electronic Frontier Foundation, using a specially developed $250,000 computer, managed to break DES in less than three days, according to Kim Hancock, president and CEO of Federal Protection and Federal Construction Inc.|ret||ret||tab|

Triple DES allows more security in the encryption of data transmitted over the world's ATM networks. The DES algorithm is a 56-bit key, according to Hancock, while Triple DES goes through three rounds of encryption, "which effectively increases the key length to 168 bits," he said.|ret||ret||tab|

|ret||ret||tab|

Necessary upgrades|ret||ret||tab|

Banks are in the process of conducting or have already completed internal analyses to determine what changes they need to make to be in compliance with the Triple DES mandate. Signature Bank, for example, identified in September which of its ATMs required upgrades, said assistant vice-president Amy Kiefer. Signature Bank, which has three types of ATMs, determined that some of the machines will need new keyboards and software while others will require new processors, which will be more costly. The bank is working with Tiedemann Banking Equipment to determine prices and is planning the installation for later this year, according to Kiefer.|ret||ret||tab|

All six ATMs will require upgrades, she said, at a cost of about $20,000. She expects the upgrades to be complete by this summer.|ret||ret||tab|

Mark Maples, vice president of banking services for Mid-Missouri Bancshares, Inc. said his organization is ahead of the game. |ret||ret||tab|

"It was something that concerned us, that if we didn't act quickly we were going to suffer from a bottleneck effect because there's a limited number of parts by the two major manufacturers of ATMs," Maples said.|ret||ret||tab|

After analyzing each ATM what it would need to be Triple DES compliant and how much usage it received Mid-Missouri Bancshares determined that nine units would need to be replaced, and the other 22 would need upgrades. The company, which is working with NCR Corporation on the project, already has 26 of its 31 ATMs fully compliant with the mandate. The other five will be ready to go by April. |ret||ret||tab|

Anxiety over the mandate varies from bank to bank, said Rob Evans, director of industry marketing for NCR Corporation. |ret||ret||tab|

"Some of our largest customers are knee-deep in mergers and acquisitions right now they've got so many other things to worry about right now that the PINs on their ATM keyboard have fallen off the radar screen," he said.|ret||ret||tab|

Other banks, he said, would rather turn off MasterCard transactions before they would incur the cost of upgrading their ATMs.|ret||ret||tab|

Still others are "anxiously trying to comply and give it their best effort," Evans said. Last year was a strong order year, according to Evans, but that had as much to do with the natural replacement cycle as with the pending Triple DES dates.|ret||ret||tab|

Hancock says there's a backlog at Federal Protection in supplying equipment to banks that need it for compliance with the Triple DES mandate, but he said they started early. "Our goal with all of our client base is to have them totally compliant on or before December 31, 2004," he said. Federal Protection will be responsible for 700 customers for verification on Triple DES.|ret||ret||tab|

|ret||ret||tab|

Advantages|ret||ret||tab|

While security is the driving force behind the mandate, banks are finding that there are advantages to replacing or upgrading their ATMs. For instance, banks can go ahead and be in compliance with proposed rule changes to the Americans with Disabilities Act concerning keyboards. Aspects of the proposed guidelines, Evans said, are rounded keys, raised pictograms and different color schemes for the clear, enter and cancel keys. That's an advantage of the Triple DES mandate, Kiefer said. "The need is there," she said, "and it's the time to make other changes as well."|ret||ret||tab|

New software will allow financial institutions to offer additional services, as well. Mid-Missouri Bancshares is looking into eventually offering services like postage stamp dispersal and the sale of movie tickets services that are already offered by a few larger banks in urban areas. |ret||ret||tab|

"We're looking to go ahead and turn the existing ATMs (that) customers have traditionally looked at as just a way to get quick cash, to allow them to use them as a more sophisticated delivery channel in which they can do all the traditional things they've been able to do at ATMs but also allow them to do some things they haven't been able to do in the past," Maples said.|ret||ret||tab|

In the process of upgrading machines to meet the Triple DES mandate, Mid-Missouri will upgrade the appearance of its ATM screens by adding color graphics, Maples said. Mid-Missouri also plans to spot-promote specific banking products on their ATMs, he said.|ret||ret||tab|

"Even though at first glance it appears to be nothing more than just another regulation that requires a great deal of expense on our end," he said, "we look at this in a more strategic view it really helps us to go ahead and serve our customers better by making an investment in technology."|ret||ret||tab|

[[In-content Ad]]