How to Address the Vulnerabilities in Open Banking
Major cyberattacks have made international news repeatedly over the last years, and there is no indication that cyberattacks will be slowing down. It isn’t just ransomware that is a growing issue for the financial sector, but credential stuffing attacks that are posing major risks to banks and credit unions.
In 2020, the FBI released a credential stuffing advisory warning and shared research which indicated that these attacks frequently target APIs. Gartner predicts that APIs will be ‘the most frequent online attack vector by 2022.’
Why are APIs such good targets?
Over the past decade, banks and credit unions have rolled out innovative, customer-facing digital banking services with the widespread use of application programming interfaces (APIs). APIs are broadly deployed because of the intense demand for a seamless and easy digital customer experience.
With the increased pressure, banks and credit unions partner with third parties to enhance the client experience. This is called open banking, or open bank data—the practice of a bank or credit union partnering with a third-party service that provides consumers with open access to their banking information, and transactions, and networking with multiple other financial institutions.
Customers want to be able to access their information with a few taps of their smartphone screen, but sometimes, it’s at the risk of security.
Financial data—from credit cards numbers to mortgage reports—as well as personal data contained within accounts, are all tempting targets for cybercriminals.
Convenience or Security
Now is the crucial moment to step back and examine the digital landscape of open banking. A report from August 2020 found that about half of all the organizations surveyed “knowingly push vulnerable software”. When developers are pressured (by deadlines, low risk, or simple oversight), it means that security is no longer at the forefront of their minds.
Whatever the case, when security is not top of mind, it makes it easier for hackers to access customer data.
What Can Be Done?
Financial organizations must become more involved with the existing API vulnerabilities. Every stage of the process, from code to interface development up through deployment, should be examined from a defensive point of view. There are many vulnerabilities to address, but organizations can start with a few basics:
There are also ways institutions can immediately shore up their defenses against credential stuffing attacks, which will massively assist API security concerns overall.
In credential stuffing attacks, cybercriminals automatically ‘stuff’ combinations of usernames and passwords into a login form. The credentials might have been obtained from a previous breach or stolen from a different organization.
To combat the possibility of these attacks, banks and credit unions can:
When enterprises forge forth and try to reach customer expectations quickly with non-secured APIs, it’s easy to compromise system security. Financial intuitions offering open banking should have a common goal when it comes to APIs: balancing safety with the customers’ digital experience expectations.