Unsupported ATM Estate Against a Board Risk Appetite
A small finance bank's risk register carries an entry for 640 ATMs and the ATM switch appliance, all running Windows Server 2012 R2, which stopped receiving security updates from the OEM in January 2023. The extended security update programme costs Rs 1.8 crore a year for the estate; a full migration to a supported platform is quoted at Rs 9.4 crore over 14 months, against a capex provision of Rs 3 crore this financial year. The vendor offers a compensating bundle - virtual patching through the fleet's endpoint protection, network access control permitting only the transaction switch to reach the ATMs, and monthly offline scanning - priced at Rs 40 lakh a year. The internal assessment scores inherent risk 20 (5 likelihood x 4 impact) and residual risk 12 with the bundle. The board-approved risk appetite statement says no residual high risk may persist in systems that can move customer funds. Internal audit has raised this as a repeat finding for the second consecutive year.
1. Is a residual score of 12 'high' under a typical 5x5 matrix, and does accepting it breach the risk appetite statement? What would you do?
Read the worked answer
First, do not assume the matrix. A 5x5 matrix is commonly banded as 1-4 low, 5-9 medium, 10-16 high, 17-25 critical, which places 12 in the high band - but the bank's own register defines its bands, and the expected discipline is to check the definition rather than apply a textbook one. On the common banding, 12 is high and the appetite statement is breached.
What that means procedurally: the appetite statement is a board instrument. A business or IT unit cannot accept a high residual risk because it lacks budget - that is precisely the situation appetite statements exist to prevent. The options are:
- Treat: fund the migration; Rs 9.4 crore is the compliant path.
- Reduce scope: migrate the ATM switch and the newest 400 ATMs first, prioritising the switch because it can move customer funds; leave the oldest 240 ATMs on compensating controls.
- Time-bound exception: the board risk committee may approve a documented exception with a sunset date, a funded milestone plan and monthly reporting. The CRO recommends; the risk committee approves. The CISO does not self-approve his own residual risk.
Why not simply re-score to 9: re-scoring to fit the appetite is the classic audit finding, and internal audit has already raised this twice. If compensating controls genuinely reduce the score, evidence it by measurement, not assertion.
2. Assess the compensating controls: which reduce likelihood versus impact, and what residual score would you assign?
Read the worked answer
Test each control against likelihood and impact separately:
- Virtual patching (endpoint protection): reduces likelihood of exploitation of known vulnerabilities, but only for signatures that exist, only if the agent is healthy, and only for the vulnerability classes the vendor covers. It does nothing against a locally exploited credential or a supply-chain compromise. It is a real control but a fragile one on an unsupported OS that may itself stop receiving agent updates.
- NAC / switch-only access: reduces impact by blocking lateral movement into core banking, and reduces the number of attackers who can reach the ATM estate. Strong, cheap and verifiable - it also protects the ATM switch, the single point of failure.
- Monthly offline scanning: detective only. A monthly cycle means up to 30 days of undetected dwell time on a fund-moving system.
Residual score: hold at 10-12, still high. Likelihood moves from 5 to about 3; impact stays at 4 because if the switch is compromised the customer-fund exposure is unchanged by any of the three controls. The bank's 12 is defensible only as a floor, and only with switch segmentation live and scanning at a fortnightly, not monthly, cadence.
Missing from the bundle: application whitelisting on the ATMs, egress filtering, and a tested ATM-specific incident playbook. Add them before signing.
3. Compare the three-year economics, and set out what you would put to the board and risk committee.
Read the worked answer
Three-year cost comparison:
- Migrate: Rs 9.4 crore one-time plus annual support (typically 18-22% of licence) and migration project risk.
- Compensate: Rs 1.8 crore ESU plus Rs 0.4 crore controls = Rs 2.2 crore a year, Rs 6.6 crore over three years - after which the platform is still unsupported and the ESU vendor may withdraw coverage.
The compensating route costs about 70% of migration over three years and buys none of the risk reduction after year three. The financial case for migrating is straightforward; the case against is capex timing, not value.
To the board and risk committee:
- The appetite breach, stated plainly, with the CRO's recommendation.
- A phased plan: switch plus 200 ATMs in 6 months (about Rs 3.8 crore), balance within 12 months, part-funded by releasing ESU and control spend.
- An interim exception with a sunset date, conditions (segmentation live within 60 days, fortnightly scanning) and monthly reporting.
- A named accountable executive and a consequence for slipping - two years of repeat findings is evidence that milestones slip without one.
- Expected-loss context: a 3% annual probability of a switch compromise with Rs 15 crore impact gives about Rs 45 lakh annual expected loss, which alone covers most of the ESU cost and ends the affordability argument.