Hacker News Reader

Comment by jiveturkey | Hacker News Reader

> IT security at banks ... is pretty crappy? I would think it's easy to get in, and hard to not get caught.

Yes it is not state of the art. They need a compliance regime in order to be secure, and they meet that and that only. But I think you're missing an aspect, things like passwords that change daily and require collusion, advanced social engineering, physical access, etc.

Further, being easy to get caught is the definition of good security. It's super easy to physically enter a bank and take all available cash at gunpoint. Nearly impossible to get away with it. That's good security. Extend that to the digital realm.

View on HN

Better security is not letting them get the cash at all.

In some banks in Europe, a customer needs to be buzzed in to enter the premises.

Cost of dealing with a dead teller is probably higher than the amount of cash that will satisfy most traditional robbers. If that robber-satisfying amount can be recovered with a certain degree of reliability, the security model is effective in deterring attacks, minimizing attack damage, and ensuring physical safety of team members.

There are only around 5,000 bank robberies in the US each year. If they each walked away with 100,000$* which is unlikely that's only 0.5 billion which is peanuts vs the 44 billion retail loses from shoplifters and other issues.

PS: 100k in 20's is ~11 pounds. Some people might leave the bank with more than that, but not that much as most branches don't much have cash and simply simply moving it becomes difficult.

Yet Fort Knox gets on just fine having zero robberies. I'm not saying every bank should be FK, but I do think we're unwise to at least admit that security is a spectrum and the most secure places do not get robbed or bugged.

I don't think that Fort Knox is open to the public. Which makes it a much harder problem than to stick up a bank (which is a hellishly stupid form of crime to begin with).

True but not particularly relevant. In reality, we almost never expect 100% perfection, we assign a cost/benefit ratio and multiply by failure rate.

there are barriers and dye bags amoung other things. in this instance it's about security and safety plus they are insured.

Reply on news.ycombinator.com