This may be a bit late to be of use to you but a bank in the Shadowrun universe will likely be an insane system to hack. We're talking minimum rating 6 firewall and related analyze programs optimized for their analyze.
Now before i begin I want to disclaimer that the below is not strictly based on the base SR4 rules. I always feel like the SR4 rules are an abstract system and then individual high security sites might employ various "tricks" to make sure their data remains secure. A bank is going to be one of those sites. My goal here isn't to make a system unhackable, i believe in SR there is no such animal. Rather the point is to make hacking much more difficult/time consuming and to make the hack more a problem solving exersize rather then just rolling hacking + exploit a couple times.
There's going to be an external system, wifi enabled pretty much usable only in the banks lobby. This system migh also serve as the banks web interface. This system won't link to anything important and won't store anything, sniffing traffic on this system could reveal some decent info and spoofing traffic here might allow you to syphon some creds from users but only in small amounts. It will have high ratings though, and decent encrption but getting someone's account credentials should be moderately easy as presumably a key will be given to every bank account holder. An agent or even a spider will likely be present looking for icons lingering ont he node and strictly enforcing time out rules.
There might be another wireless enabled gateway system for handling the wireless traffic of on site security personnel. Most importantly their coms, tacnet, and biomonitor. Again this system would be a big gaping hole in the banks security so it'd likely have very limited links. Logically it can pass text messages to the banks email system and it sends an alert if one of the guards biomonitors shows a problem. This system will likely have a one day encryption level (see unwired for details on this, basically the interval to break the encryption is one day but if the bank ever needs to change it they'll have all their devices down for a day while they rekey).
The banks main system is going to have ratings above 6, likely in the 7 range for a decent FDIC insured (SR equivalent of course) bank. It willl almost definitely have a professional rating 5 spider on during business hours and possibly higher. After hours a spider may or may not be present but alert proceedures should definitely involve a scramble spider action to bring them online. Important banks such as those who process lots or big transactions will warrant even higher security..
The banks system will likely store historical transactions but new transactions will be uploaded to the Financial Network only every 24 hours or so. Before they upload it an audit process will likely be done by some kind of agent. To perform high level bank fraud your going to need to not only hack the systems but make sure your changes beat the auditing agent, so likely some forgery or related knowledge skill.
There will also be a security system that handles the locks, cameras, etc it will have a external matrix connection but it should be extremely well hidden/vanishing SAN scenario (that is a node that only pops open to the outside world every so often to check in and allow access, if it needs to remain open for legitimate traffic will require a valid account or hacking). As above this system will likely have insane ratings and a spider present at all times during business hours and likely after hours as well. This spider would likely only be professional rating 3-4 as he's more a digital security guard then an actual guardian of the system. The much scarier main bank spider might be on here during the day as well. If the runners are actually breaking into the bank this is the system that they will most likely be interested in, it will control the doors, manage the alarms, etc. Figure rating 6 or 7 and a few IC to back up the spider plus an agent to watch the cameras.
Their coming to get me and i need to change locations before they trace this account but i''ll post or edit a little later to include how I as a GM would allow such a system to be beaten. I just want to clarify that this is perhaps more complicated then you might have wanted but it's all stuff that i feel is appropriate for a bank. Banks are serious business, hacking one or breaking into one should be a serious plus to a runner teams street cred.
