Bank of Thailand Guidance for Mitigating ATM Malware Risk
A source-based guide to the Bank of Thailand letter RorPorTor.ForSor.(03) Wor. 1180/2559, dated 26 September 2016, on mitigating ATM malware risk. Addressed to commercial banks and specialized financial institutions, it covers physical controls, Core PCs, operating systems, network devices, cash loading, reconciliation, SDMS, and anomaly alerting.
- Target Audience
- Commercial banks and specialized financial institutions addressed by BOT letter RorPorTor.ForSor.(03) Wor. 1180/2559
- Mandatory Frequency
- Short-term measures within 6 months and long-term within 2 years from the 2016 letter; no annual pentest cadence
- Required Scope
- ATM cabinets, Core PCs, operating systems, network devices, cash loading, reconciliation, SDMS, and anomaly alerting
- Non-Compliance Risk
- Malware on ATM terminals, unauthorized Core PC access, and undetected cash-volume discrepancies
Document scope and the timelines stated in the letter
The BOT describes ATMs as a key electronic-financial-transaction channel and cites a growing malware threat, directing institutions to strengthen both short- and long-term measures.
These are historical timelines in the 2016 letter, not periods that restart today.
- Letter dated 26 September 2016 — Starting point for the stated timelines
- Short-term measures — Complete within six months
- Long-term measures — Complete within two years
- Assessment and improvement plan — Submit within 60 days of the letter
- The letter set a six-month completion target for short-term measures and a two-year target for long-term measures, measured from its 2016 issue date.
- Compliance and internal-audit functions were expected to participate in governance and assessment, with an assessment result and improvement plan submitted within 60 days as stated in the letter.
- This page summarizes a 2016 source. It is not a determination of an institution's current obligations; check the latest BOT requirements and organization-specific obligations.
Short-term measures: physical condition, Core PC, and onsite equipment
The short-term measures connect site inspection with reducing unauthorized access to or modification of the Core PC and communications equipment.
ATM malware defense begins with physical access and extends to executable control.
- Cabinet, lighting, and CCTV — Detect tampering and preserve useful evidence
- Keys and BIOS — Restrict access, replace defaults, and disable external boot
- Core PC — Apply application allowlisting and least privilege
- Hardening — Disable unnecessary services and connection paths
- Logs and firewall — Filter communications and retain events
- Inspect ATM condition, communications equipment and cables, installation areas, lighting, and CCTV regularly, using a checklist so inspections remain repeatable.
- Control the storage and issue of ATM-cabinet and communications-equipment keys; replace default BIOS, Core PC, and network-device passwords with unique values and protect them appropriately.
- Disable automatic BIOS updates, close or restrict external-device connection paths, and configure booting from the primary hard disk only as stated in the letter.
- Restrict execution to approved applications, review user access, disable unneeded programs and services, enable a firewall, retain Security/Event Logs, and review Core PC hardening.
Network devices, cash loading, and reconciliation
The letter connects technical safeguards with operational controls so communications and cash-handling activity have accountable owners and auditable records.
Network evidence and cash controls should expose anomalies together.
- Router hardening — Replace defaults and close unused ports and services
- Access and logs — Restrict access and retain events
- Cash loading — Separate duties and control operators
- Dual control — Require more than one party at critical steps
- Reconciliation — Detect cash discrepancies promptly
- Replace router defaults, limit access by operational need, rotate passwords as appropriate, close unused ports and services, harden the device, and retain Security/Event Logs.
- Review ATM cash-loading procedures against internal controls, including segregation of duties, dual control, and regular independent supervisory review.
- Review and improve ATM cash reconciliation so cash-volume discrepancies can be detected promptly.
Long-term measures: network, SDMS, encryption, and alerting
The long-term measures extend individual-machine controls into network design, software management, authentication, encryption, and event monitoring across operations.
Long-term protection links ATM integrity, segmented networks, SDMS, and monitoring.
- ATM integrity — Apply appropriate pairing, encryption, and patching
- Network segmentation — Separate the ATM network from other internal networks
- ATM–SDMS authentication — Authenticate communications between systems
- Encryption and key management — Protect the channel to central systems
- Monitoring — Alert on physical, logical, and network anomalies
- Maintain secure key-management processes and staff-review standards; use pairing authentication between cash dispenser and Core PC where feasible, and encrypt hard-disk data with full-disk encryption.
- Separate the ATM network from other internal networks; control connections between ATMs, SDMS, and ATM Host with access control lists; verify SDMS-to-ATM communications; and encrypt the communications path with secure key management.
- Scan and remove detected malware and maintain anti-virus/anti-malware on SDMS; replace defaults, restrict access, harden the system, and retain adequate Security/Event Logs.
- Alert on physical, logical, and network anomalies including cabinet opening/tampering, unusual device or software installation, and unplanned reboot; limit Master-program access, scan it for malware before installation, and review staff activity periodically.
Requirements and Testing Scope Matrix
Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.
| Reference | Mandate Title | Scope Required | Testing Cycle |
|---|---|---|---|
| Short-term measures (Wor. 1180/2559) | Cabinet condition, Core PC, BIOS passwords, and approved-program controls | ATM cabinets, Core PCs, communications equipment, firewall, Security/Event Logs | Complete within 6 months of the 2016 letter |
| Long-term measures (Wor. 1180/2559) | ATM network segregation, encrypted communications, SDMS, and anomaly alerting | ATM network, SDMS, ATM Host, full-disk encryption, pairing authentication | Complete within 2 years of the 2016 letter |
Compliance Readiness Self-Assessment
Select items your organization has completed to evaluate your readiness score.
Frequently Asked Questions (FAQ)
Key answers and practical guidance addressing common compliance questions.
Does the BOT ATM guidance require penetration testing?
Letter Wor. 1180/2559 is malware-risk guidance for ATM systems. It does not set an annual pentest cadence. It focuses on physical controls, Core PCs, operating systems, networks, cash loading, reconciliation, SDMS, and anomaly alerting.
What timelines did the letter set for short-term and long-term measures?
The letter directed short-term measures to be completed within 6 months and long-term measures within 2 years from its 2016 issue date, with compliance and internal-audit functions submitting an assessment and improvement plan within 60 days as stated in the letter.
