Digital transformation across the financial landscape is moving at a quick pace for the past few years. Such an evolving environment makes it essential for banking and finance companies to maintain high standards and keep their technological infrastructure up to date to be compliant to the next level of standards for cybersecurity in FinTech.

Accenture’s 2019 Ninth Annual Cost of Cybercrime report stated that financial services had the highest share in cybercrime among all the industries across the world In 2018.

In the report, Accenture explained that as the industries go more digital and disrupt the existing environment, the threats will dramatically expand and become more complex. This increasing complexity will require innovative security procedures to protect companies’ digital ecosystem. Subsequently, the cost to build such security solutions will also be substantial – and growing.

Data Source: Accenture

Cybersecurity Challenges In FinTech

Third-Party Security Risks

Securing internal infrastructure isn’t always enough for banking and financial institutions. Many times, when banks or financial institutions leverage external financial services from a not-so-trusted organization, they have the chance to lose control of their data. They could experience service failures, and many banking and finance institutions even lose their reputation because of this.

To overcome such third-party security risks, banking and financial institutions should involve relationships-relation security concerns into their risk management assessment process.

Malware Attacks

So far, we’ve realized that hacking via malware is one of the most prominent types of security issues that threaten the global market. The recent attack on Society for Worldwide Interbank Financial Telecommunication (SWIFT), indicates that it is possible for cybercriminals to hamper the global financial market. This is especially evident in this specific scenario, as SWIFT systems are globally being used by almost every bank and top financial institution to exchange vital financial information.

However, the cyberattack on SWIFT indicated the level of sophistication the hackers and malware attackers have. To keep themselves immune to malware attacks, banking and financial institutions should focus on mitigating vulnerabilities into their processes.

Data Breaches

It is evident that data is the new oil, as it plays a vital role in every industry irrespective of their domain. However, for industries like banking & finance, healthcare, and law, data is a matter of utmost importance. As the FinTech industry is growing at a fast pace, many inefficient fintech systems have started operating in the financial sector. As a result, the concerns of data breaches in FinTech are increasing.

Information like credit/debit cards details and user’s personal data can be easily accessed by the hackers, which makes online transactions prone to cyber-attacks. Modern-day fintech institutions partner with several other financial service providers, which increases the chances of data breaches due to ineffective security measures.

Digital Identity Risks

Mobile and online-only banking and finance trends have increased the use of one-time passwords and security codes in the banking and finance industry. However, the security codes and passwords aren’t foolproof and can be hacked by a cyber-criminal.

As Accenture’s report stated, FinTech businesses aren’t adequately spending on system security. Hence, the only way to overcome digital identity risk of cybersecurity in FinTech is to re-access online security architecture and identify the risk factors before rolling out the FinTech solutions.

Legacy Banking Systems

Banking and financial institutions struggle hard to develop or integrate advanced FinTech solutions into their non-patched core banking and financial infrastructure. The conventional banking and finance infrastructure is very prone to all sorts of cybersecurity attacks. However, the main concern is more than this.

Modern-day FinTech services integrate with the conventional banking and financial infrastructure, leaving loopholes in the security systems. Hence, every financial institution should refresh or update their core banking systems before implementing or integrating a tech-friendly FinTech solution.

Cloud-based Security Risks

Cloud-based solutions are one of the critical elements of the FinTech industry. From digital wallets to payment gateways, cloud computing services offer various services for FinTech businesses to accelerate and secure online transactions. Considering this dependency of FinTechs on cloud solutions, it is crucial to ensure the confidentiality and integrity of financial data.

Although Cloud computing is a groundbreaking technology and is considered a secure means of storing the data, inadequate and inefficient security measures can result in data breaches and alteration. Even if the FinTechs partner with a reliable cloud service provider, it is crucial to cross-check the security layers and parameters.

An investigation on Cloud Hopper by WSJ found that one of China’s most prominent corporate hacks was executed via the cloud. CGI Group Inc, one of the largest cloud service providers in Canada, was hacked during that hack.

We’ll discuss Cloud security for FinTech in detail in the latter part of the article.

CLOUD SECURITY BREACHES

The Cyberattacks Are Evolving

Accenture also found that information theft is the fastest rising and most expensive consequence of cybercrime across all industries. The report noted the drivers behind cybersecurity’s evolving threat across all sectors, including FinTech. Here there are:

The Evolving Targets: Accenture reports that data is no longer the only target for cybercriminals. Companies across the globe are now seeing their core systems – infrastructure and control system – getting hacked. This potentially could lead to more significant disruption than data theft.

The Evolving Impact: When it is not just about data, it is no longer about just theft. For instance, cybercriminals have changed their approach from merely stealing confidential data, to destroying or altering data to cause distrust. In current times, data integrity itself is vulnerable to cyberattacks.

The Evolving Techniques: As the target changes, the techniques too. The cyber attackers are increasingly focusing on “the human layer”, that targets the weakest link – the people – via phishing and malicious insiders.

Phishing Threats

One of the most prominent cybersecurity cases in FinTech

The largest finance industry data breach happened in September 2017 when one of the three largest consumer credit reporting agencies, Equifax, exposed 147 million customers’ personal data.

An unpatched Apache Struts vulnerability caused the data breach. Apache Struts was the framework for Equifax’s US-based web apps. The breached exposed customer names, date of birth, social security numbers, and other personal information. Due to the breach, several members of Equifax’s C-suite stepped down.

There were other incidents of cyberattacks in FinTech. In fact, after Equifax, several other data breaches in FinTech saw as many as 130 million, 90 million, and 76 million people affected.

Also Read: How To Overcome Security Issues In Digital Banking For 2021

Overcoming Cyber Security Challenges in FinTech in 2021

It is imperative for banks and financial institutions to address the challenges associated with cybersecurity in FinTech. Hence, I’m listing down the cybersecurity recommendations for FinTechs:

Multi-factor authentication

The security issues we’ve discussed previously require FinTechs to make the customer onboarding process secure and compliant. FinTechs should incorporate multi-factor authentication to the onboarding process.

Multi-factor authentication requires additional security layers such as fingerprint scanning, which are nearly impossible to bypass. Although the implementation of multi-layer authentication is expensive, the efforts are justified for FinTechs in 2021. However, the consumer-facing solutions should find a way to ensure security, while keeping customer experience up to the mark in order to succeed.

End-to-End Encryption

Did you know that every year, confidential data worth billions of dollars are exchanged?

Banks, financial institutions, merchants, customers, payment gateways, and a few other parties are included in the data exchange or transaction processing. All of them either have access to whole data or part of the data, making them a hotspot for cybercriminals.

End-to-end encryption of data is the best way to make FinTechs ecosystem secure in 2021. One way to encrypt data is to ask for SSL chain verification. It is considered the best practice to secure the connection between the browser and the webserver. The FinTech institutions can also use TLS protocols to secure their computer networks.

Secure code and architecture

It is not only the financial information and customer data that need to be safeguarded; the institutions’ mobile apps and web app codes should also be encrypted. It will ensure that the cybercriminals don’t prostrate the cybersecurity of FinTechs by cloning the customer touchpoints.

FinTechs should use obfuscation instruments while testing their digital infrastructure. Also, the decryption keys should be managed securely. Even the most sophisticated encryption is hackable if the keys are easily accessible.

The Impact of the Cloud on Cybersecurity in FinTech

The prevalence of cyber attacks in FinTech will increase as cloud computing within FinTech space grows. According to a Verizon study, Cloud assets were a part of around 24% cyber breaches last year. Of all the cloud breaches, 73% were email, web application server breaches and 77% were credentials breaches.

A recent report by Cornerstone Advisors named Cloud on the Horizon, identified the most major cloud-related cybersecurity challenges in FinTech, where were:

  • Over-reliance on cloud service providers

FinTech companies rely heavily on cloud service providers to complete cybersecurity checklists during due diligence. Moreover, the consolidation of multiple organizations within one cloud service provider makes it a more lucrative target for cybercrimes.

  • Reporting issues

In many cases, Chief Information and Security Officers (CISOs) have complained that the cloud service providers incorrectly completed the due diligence cybersecurity requests. Once CISO stated that when his bank asked the cloud service provider for a SOC-2, the vendor sent them AWS’ SOC-2. And surprisingly, when the CISO questioned the vendor about whether it has its own SOC-2, the vendor had no idea that they needed to have one for their own.

  • Technical limitations

Many cloud service providers suffer from cybersecurity limitations. For instance, they cannot IP-restrict, or cannot include compulsory multi-factor authentication for third-parties. The configuration is also a challenge.

Hence, it isn’t only the cloud vendors’ fault. Bill Glasby, CTO at Heritage Bank, states that the cloud operators’ inability to configure the tools is also an issue for cloud security.

How to overcome Cloud Security Challenges?

Banking and Financial institutions’ migration to the cloud necessitates changes in the way they govern and manage their IT environments from two perspectives:

  • Contractual perspective

The migration to the cloud asks for switching from conventional security testing to a contractual-based security testing model. Banking and financial institutions cannot migrate to the cloud without caring about dealing with contracts and the service providers’ clauses. In particular, FinTech institutions should negotiate the reversibility clause with their cloud vendors.

However, one issue stated by a CIO interviewed by Cornerstone is that many cloud service providers have no idea about what should be written in a reversibility clause.

  • Strategic perspective

Different departments in a business prefer flexibility and opportunity for innovation. However, migration to third-party cloud services typically involves a shift from highly customizable to standardized IT environments. As a result, this can cause friction between the business and IT departments – friction that should be resolved with strategic planning and clarity.

Cornerstone and Defense Storm share the following recommendation for FinTech organizations to handle the coming wave of cloud-related cybersecurity issues:

Set up a cybersecurity committee. The committee would conduct at least one meeting per quarter to discuss new service providers, services, or products. CISOs should identify the areas of the IT environment and the metrics that the committee should monitor.

Build a realistic cybersecurity policy. One CISO whom Cornerstone had interviewed, said that he once received a 200+ item cybersecurity questionnaire from a cloud service provider. His team rejected the questionnaire as it was too overbearing and draconian. Hence, FinTechs should encourage cloud vendors to build meaningful cybersecurity policies that are simple to follow and easy to execute.

Monitor the entire IT infrastructure. Small FinTechs and the largest banks find it challenging to monitor their entire network infrastructure, which includes on-premise systems and cloud-based providers.

Conclusion

Although not many FinTechs have invested heavily in security within the past few years, expanding the digital landscape, especially to the cloud environment, asks for an increase in cybersecurity investments. Cybersecurity must never be an afterthought for FinTech businesses in 2021.

If you’re looking for a financial technology solution provider, feel free to reach us at contact@nimbleappgenie.com. We are among the top FinTech developers for both early stage businesses and corporates. This is due to our extensive knowledge in developing software solutions for banking and finance institutions.

  • Tags: