[OR] [MB] [E4] [CBS] [10] [SuPS] Identify Severe but Plausible Scenarios

Severe but Plausible Scenarios

CBS-10 – Self-service Terminal

Introduction

Self-service terminals (SSTs), including automated teller machines (ATMs), cash deposit machines, and self-service kiosks, form a critical component of Maybank’s retail banking services.

They provide customers with 24/7 access to essential banking functions, including withdrawals, deposits, account inquiries, and card-related services.

As Critical Business Services (CBSs), SSTs must remain resilient against a range of operational, cyber, and technology-related threats. Identifying severe but plausible scenarios allows Maybank to anticipate disruptions, prepare mitigation measures, and align with regulatory requirements for operational resilience.

This section outlines severe yet realistic scenarios for each sub-process under CBS-10: Self-service Terminal, and links them to cyber and ICT risk integration and proactive risk management actions.

Table: Severe but Plausible Scenarios for CBS-10

Sub-CBS Code	Sub-CBS	Severe but Plausible Scenario	Integration of Cyber & ICT Risks	Evidence of Proactive Risk Management Action
10-1	Authentication & Access	Large-scale credential-skimming attack in which fraudsters install advanced skimming/malware devices on multiple ATMs across Malaysia.	Cyber risk: compromised card/PIN data; ICT risk: malware injection on terminal OS.	Deployment of anti-skimming devices, biometric authentication trials, and regular penetration testing.
10-2	Withdrawal (Card & Contactless)	Massive service outage due to switch/network provider disruption during peak holiday season, preventing withdrawals nationwide.	ICT risk: switch failure; Cyber risk: DDoS on transaction switch.	Dual-site switch redundancy, transaction rerouting protocols, and real-time DDoS monitoring.
10-3	Deposit & Inquiry	Cash deposit fraud involving counterfeit currency undetected by machines, followed by simultaneous malware injection to manipulate balance inquiries.	Cyber risk: malware manipulating inquiry data; ICT risk: hardware integrity failure in deposit validation.	Enhanced counterfeit detection systems, machine learning anomaly detection, and forensic monitoring of transaction logs.
10-4	Activation & Setup (Cash-out)	Widespread “jackpotting” attacks where criminals force ATMs to dispense cash through malware or unauthorized access to cash loaders.	Cyber risk: ATM malware/jackpotting; ICT risk: compromise of cash management system.	Endpoint hardening, remote terminal isolation capabilities, and red-teaming simulations on cash-out attacks.
10-5	Availability Management	Power grid failure or telecommunication blackout in key urban areas (e.g., Kuala Lumpur), leaving large clusters of ATMs unavailable.	ICT risk: dependency on telco & power; Cyber risk: ransomware targeting ATM network availability.	Backup power sources, multiple telco routing, and ransomware tabletop exercises.
10-6	Security & Resilience	Coordinated cyber-physical attack where terminals are simultaneously vandalized and subjected to malware attacks, overwhelming response capacity.	Cyber risk: coordinated malware deployment; ICT risk: physical resilience breach.	Integrated SOC + physical security monitoring, geo-tracking of incidents, and emergency dispatch protocols.
10-7	Customer Support & Recovery	Surge in customer complaints due to fraudulent withdrawals linked to ATM compromise, overwhelming call centres and digital helpdesks.	Cyber risk: phishing/social engineering post-ATM compromise; ICT risk: overload of support infrastructure.	AI-driven call deflection, trained incident response playbooks, and crisis communication templates.

[BCM] [Thin Banner] Summing Up

The identification of severe but plausible scenarios for CBS-10: Self-service Terminal ensures Maybank is prepared to manage a broad spectrum of risks, from cyber-enabled fraud to large-scale operational disruptions.

By integrating cyber and ICT risk considerations, Maybank enhances its ability to anticipate interconnected vulnerabilities across self-service channels.

Evidence of proactive risk management, such as anti-skimming technology, redundancy protocols, and incident simulations, demonstrates commitment to customer trust and regulatory expectations.

Ultimately, scenario identification is not only a regulatory requirement but also a cornerstone of operational resilience, ensuring that critical banking services remain available and secure under severe conditions.

Operational Resilience in Action: Case Studies and Best Practices for MayBank
eBook 4: Starting Your OR Implementation
CBS-1 Retail and SME Loans
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.