An essence of Application Security in Financial Sector
Digital innovation has been evolving and growing in the financial space with time. It is no secret that the financial companies today see digital presence as a key component to their company’s success. Customers can now manage their finances from anywhere and at anytime using these digital offerings. But, this raises a serious issue. With the sensitivity of data that financial services deal with, financial sector becomes an active target for cyber attacks.
Cyber attacks against financial organisations are becoming more frequent and sophisticated day by day. From the large organisations such as corporate banks and insurance companies to the small ones such as regional banks, money transmitters and third party service providers(for example, Payment Gateways), most of them have reported attempted breaches on their applications in recent years. Websense, a cyber security company reported, “The financial industry is the most frequent target, facing 300 per cent more cyber attacks than any other sector.”
What’s in it for attackers?
Financial services applications deal with sensitive user data such as account details, debit and credit card details and Personally Identifiable Information. Common cyber attacks against these applications include :-
- Credential Stealing and Data Theft: Due to the inability of the application to safeguard the user information properly, attackers get hold of user credentials such as account details and card details. These details can be further used to steal funds from the victims. Money remains the main motivation behind such attacks. The growing black market also encourages the attackers to breach systems, as the stolen data can get them easy and good money on the black market.
- Funds Stealing via account takeovers: If the financial application is not secure, then the data is just sitting there to be exploited. Once the attackers get hold of user’s sensitive data, they try to figure out how it can be exploited. Some of them, in greed of easy money, sell the stolen data on black market. On the other hand, the criminal organizations and hacker groups attempt to takeover the entire account and steal funds from them.
Biggest Attacks on Financial Sector
- JPMorgan Chase: In July 2014, America’s largest bank, JPMorgan Chase was compromised by attackers. The names, addresses, contact numbers and email addresses of account holders were stolen. Around 83 million accounts were affected. This data breach is considered to be one of the largest data breach in the history.
- NASDAQ: In July 2013, Nasdaq OMX Group’s community forum website was compromised by attackers . The email addresses and passwords of the members of the site were leaked.
- Global Payments: In March 2012, Global Payments, a third-party processing company with clients including financial institutions, government agencies and large corporations such as Visa and MasterCard was attacked. It was reported that around 1.5 million records were exposed from Visa and MasterCard.
- Sony Online Entertainment: In 2011, Sony Online Entertainment Network was hacked by the hacker group Lulzsec. It was reported that banking and credit card information belonging to more than 23,000 customers were compromised.
- Major American Banks and Chain Stores: Companies like Nasdaq, 7-Eleven and Dow Jones were hit by a ring of hackers . Over seven years, hackers used sophisticated hacking techniques to steal more than 160 million credit and debit card numbers, targeted more than 800,000 bank accounts resulting in at least $300 million in losses to companies and individuals.
Impacts of Data Breach
- Monetary Losses
- Business Disruption
- Defacement
- Loss of Customer trust
Preventive Measures
- Your business should be PCI Data Security Standard compliant. Perform yearly PCI scans
- SSL should be properly implemented
- Implement an extra layer of security in your application such as two-factor authentication
- Use intrusion prevention system (IPS)
- Provide security awareness training to employees
- Monitor the traffic and logs of the website regularly
- Patch your servers for common vulnerabilities
- Follow a Secure Software Development Lifecycle (SDL)
- Implement a DDoS detection and mitigation service
- Use a fraud management service
- Backup your site regularly
Conclusion
A Financial service application requires a secured environment to run, not only for the customers but also for the organization’s reputation. But, no application is fully secured. You harden your security but attackers come up with more sophisticated attacks. A pro-active approach goes a long way than a reactive approach. It is important to conduct regular evaluation and penetration testing of your application. “Hack yourself before the hackers do.” You can use the assessment tool mentioned below to judge how secure is your application.
