Securing FinTech: Challenges of Cybersecurity

A shakedown is happening in the financial world. The traditional banking giants are struggling to retain customers, and an emerging market of FinTech companies are collecting them rapidly. A success of growth lies in offering alternatives to conventional financial solutions through cryptocurrencies, online loans, and P2P. Among a variety of challenges, one aspect stands out: cybersecurity. Its unfettered growth on online platforms makes this industry uniquely vulnerable to security breaches. While many leaders of FinTech believe strict regulations would stifle the innovation powering the industry, others are already employing a self-regulatory framework to their platforms so that they can ensure risk-management and data privacy.

 

In collecting and storing personal information, FinTech companies have to protect their customers first and foremost. The challenge then is the way they protect this data. Though they’re disrupting traditional financial channels, many of them have adopted bank-level security measures and fine-tuned them for their digital platforms. One of the most significant upheavals for businesses, including FinTech companies, has been the introduction of the EU’s General Data Protection Regulation (GDPR), with financial firms both new and old having to invest significant time and resources to ensure that they comply with the new laws. And GDPR is just one of the many regulatory hurdles faced by the financial sector. While traditional financial institutions often have whole teams to deal with these hurdles, with smaller FinTech start-ups, the burden of compliance can often fall into a single brave soul who has to shoulder the concern of making sure the company is adhering to all the regulations. With varied global regulatory environments to contend with, this can prove to be a major headache, especially when laws fail to keep pace with changes in technology, leaving many start-ups operating in a grey area.

So what can FinTech firms do to avoid running afoul of regularity authorities? Well, working with the authorities themselves is an excellent place to start, which can be achieved by getting involved in a regulatory ‘sandbox.’ Some regulators have also begun sanctioning the temporary loosening of restrictions, allowing financial organizations to test new ideas and reducing the initial hurdles faced by start-ups. However, you should also be ready to scale your compliance team according to your growth and consider pooling resources with other FinTech companies to share some of the responsibilities.

 

It’s not just the big players that face cyber-crime. Everyone is familiar with the recent hacks into J.P. Morgan, Target, the US IRS, and Defense Departments. What is not so publicized, is the smaller organizations that get hacked regularly – medical practices, small retailers, and even local and regional FinTech companies. Criminals are looking for anything from bank card numbers to customer personal information data, and yet – in the case of JP Morgan – emails.

Startups are particularly vulnerable because security measures may not yet be “fully baked” when companies open their doors for business. However, this should never be the case with a FinTech startup – the consequences of falling victim to cybercrime include total loss of trust on the part of customers, loss of business to the point of failure, and legal and financial consequences from which it will never recover. The highest level of FinTech cybersecurity must be in place before the doors open. While FinTech founders are savvy in many financial sectors, most do not have the expertise in how to build an entirely secure FinTech application. Here is a list of the most common cybersecurity mistakes FinTech startups make – and they all can be avoided:

Dozens of FinTech providers often forget to double-check their safety mechanisms, trusting the Blockchain technology capabilities to protect itself. So wrong on many levels. It’s like leaving the door wide open for hackers. Your defense should have a multi-store protection system — like traditional banks have high-security vaults; your financial services should also be protected with such digital vaults. It requires a myriad of security tests being done with your software most holistically. Everything in the development process must follow this approach to establish and avoid digital security risks. From planning, strategy building, milestones, and end-points to code writing, devices testing, and observation of human factors. All the great hacker needs are just your one vulnerability, and you’re done — money, data, assets, everything is gone in a moment. Cybercriminals don’t have mercy for entrepreneurs and organizations worldwide. However, no client will forgive you for a security breach. In this age, even Bitcoins can be stolen, and the Blockchain ledger could be exposed to hackers. So, your FinTech developers must create additional protection algorithms.

FinTech companies want to provide an omnichannel user experience while offering a variety of services. At the same time, consumers are increasingly using mobile devices to access those services. Establishing authentication measures are critical. These can be put in place through the ever-increasing use of biometrics (e.g., fingerprints), one-time passwords, and code-generating apps, such as Google Authenticator, can bypass all of the conventional methods (passwords, PINs, security questions, etc.) and provide that added layer of protection. One of the upcoming trends in FinTech security is the use of AI to analyze risk-based authentication by analyzing user behaviors.

One of the top challenges in health records management has been in the storage and transmission of patient records among providers. This challenge exists on a scale just as significant for FinTech data security as well. The answer? Encryption. Every piece of data in a system should be encrypted, both as it is transmitted in-house or between company and customers, and company and partners. While startup founders worry that encryption may slow down their apps, it can be run on a dedicated server. While encryption is a relatively easy technology, it requires expertise in the setup, and especially in the protocols for how the access to keys will be granted.

FinTech involves banking, insurance, lending, and more. In the course of being a user, payments will be made. And, of course, the payer wants an easy and convenient method to make payments. He also wants security measures in place so that he is not left vulnerable to hackers who get into systems. The challenge for FinTech is to find the best merger of security and convenience. The problem often comes when a FinTech app scales and new layers of architecture are added. There is always vulnerability when this happens, so using the same developers over time may be the safest solution here. The expertise and the technologies are out there, and the wise FinTech founder will spend the money to get the best. Unfortunately, numerous FinTech providers (even crowdfunding and P2P lending) credit various entrepreneurs and small businesses with no long or transparent credit histories. This often results in high defaults, so the loan guarantees are down the drain.

The problem with people trusting the FinTech startups is that no one knows who is the sender and the receiver of money in digital peer-to-peer transactions. Unlike traditional financial services, the FinTech companies provide the software where participants would be mostly anonymous. This leads to a lack of secure credit and capital adequacy standards. Money could go to terrorists, drug lords, and fictitious companies. Bad enough. So, while the whole system can be secured, the participants of the P2P exchange are still an issue. The possible solution would be mixing the business models of traditional financial services and FinTech startups.

This should go without saying, but it bears repeating. Here’s the thing about the public cloud: your data can be at risk, mainly if you use a cheaper, less-known company. Even with the larger companies, you are still open to attack, and you also risk getting locked out of your data. For top results, FinTech companies should develop a private cloud server for data storage.

There is an old military saying – “Loose lips sink ships.” The same is true in cybersecurity; only it has to do with “loose fingers.” There should be a standard security training manual, and all employees must be required to complete that training and demonstrate mastery before they have access to any data. A part of employee training must also relate to how to address the most common security issues, along with detecting and reporting any potential security issues. Cybercriminals love to get into systems through employees' email and social media accounts.

There must be a plan in place for both continuous monitoring and vigilance so that all systems are watched for threats. And there should be one individual in charge of receiving information on all potential issues from everyone and everywhere. That may be an in-house security executive, or, in the case of small FinTech operations, a contracted expert, preferably from the development team that created the app itself. Those with intimate knowledge of architecture are best able to fix it if bugs or gaps are discovered. Audits should not just occur for the FinTech system; they should occur with any technology partners as well. Who is managing their security, and what is the level of expertise? Do they monitor and audit themselves too? There is a massive vulnerability in the transmission of data if the interfaces between systems are not wholly secure.

The tech bubble is far from bursting. New technology hits the horizons continually. And hackers, too, are continually developing new technology to commit their intrusions and thefts. The individual in charge of a FinTech security must stay abreast of all new developments in industry security, breaches that have occurred, gaps that have been found in the safety of others’ systems, and the latest technology that criminals have developed to hack into databases and payment systems successfully. These hacks will not always be within the FinTech industry itself – they may occur in healthcare, or any e-commerce enterprise that stores personal and financial data of consumers. In short, a FinTech security executive, whether in-house or contracted, must remain an expert on any cybercrime that is afoot.

This new encryption technology has disrupted the market during the last years. It promises a new level of security mechanisms. The Blockchain is a decentralized digital ledger without a need for administering where users don’t leave any paper trace after their transactions. While it’s a picture of a bright future, it’s still open for digital security risks, and real innovations in the Blockchain encryption technology that will make it a perfectly protected tool are yet far ahead.

 

Fending off cyber-attacks in one of the most significant challenges faced by businesses and governments around the world, and given the sensitive nature of the client data they hold. With cybercriminals launching more sophisticated and frequent attacks, the number of significant data breaches looks set to soar. This has seen organizations devote more time and money ever in an attempt to thwart these attacks. Of course, not every FinTech company has that kind of money to throw at the problem. So what can you do to minimize your exposure to cyber-attacks and keep client data safe while keeping ever-spiraling costs down? Well, with traditional cybersecurity methods becoming unsustainable, you may need to reassess your approach to protecting yourself and your clients from cybercriminals. To this end, it may be time to consider deploying dynamic security solutions such as:

This method helps to frustrate attacks by continually shifting the points of attack and robbing hackers of the static targets they’re familiar with breaching. MTD has already been deployed by the US Department of Homeland Security as well as major European banks, and much more businesses are expected to follow.

Industry-standard secure socket layer (SSL) encryption by Comodo SSL Store. Highlights:

• Comodo SSL certificates are the quickest way for online businesses to protect customer transactions with SSL security.
• Featuring fast online issuance, the most reliable possible levels of encryption, dedicated customer support and a massive $250K warranty, Comodo SSL lets you create a highly secure e-business environment within minutes

It is a web-tool to encrypt and decrypt text using the AES encryption algorithm. You can choose 128, 192, or 256-bit long key size for encryption and decryption.

AWS has certification for compliance with ISO IEC 27001:2013,  27017:2015,  27018:2014, and ISO/IEC 9001:2015

Amazon Elastic Compute Cloud is a web service that provides secure; resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers. Highlights:

• The simple web service interface allows you to obtain and configure capacity with minimal friction. It provides you with complete control of your computing resources and lets you run on Amazon’s proven computing environment.
• Reduces the time required to obtain and boot new server instances to minutes, allowing you to quickly scale capacity, both up and down, as your computing requirements change.
• Changes the economics of computing by allowing you to pay only for capacity that you use.
• It provides developers the tools to build failure resilient applications and isolate them from common failure scenarios.

A web application firewall (or WAF) filters, monitors, and blocks HTTP traffic to and from a web application. Highlights:

• A WAF is differentiated from a regular firewall in that a WAF can filter the content of specific web applications while proper firewalls serve as a safety gate between servers.
• By inspecting HTTP traffic, it can prevent attacks stemming from web application security flaws, such as SQL injection, cross-site scripting (XSS), file inclusion, and security misconfigurations.

Amazon Simple Storage Service (Amazon S3) is storage for the Internet. It is designed to make web-scale computing easier for developers. Highlights:

• Amazon S3 has a simple web services interface that you can use to store and retrieve any amount of data, at any time, from anywhere on the web.
• It gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its global network of web sites.
• The service aims to maximize benefits of scale and to pass those benefits on to developers.

Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud. Highlights:

• It provides cost-efficient and resizable capacity while automating time-consuming administration tasks such as hardware provisioning, database setup, patching, and backups.
• It frees you to focus on your applications so you can give them the fast performance, high availability, security, and compatibility they need.
• Amazon RDS is available on several database instance types - optimized for memory, performance, or I/O - and provides you with six familiar database engines to choose from, including Amazon Aurora, PostgreSQL, MySQL, MariaDB, Oracle Database, and SQL Server.
• You can use the AWS Database Migration Service to migrate easily or replicate your existing databases to Amazon RDS.

Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. Highlights:

• It is designed to give developers and businesses an extremely reliable and cost-effective way to route end users to Internet applications by translating names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect.
• Amazon Route 53 is fully compliant with IPv6, as well.
• Amazon Route 53 effectively connects user requests to infrastructure running in AWS – such as Amazon EC2 instances, Elastic Load Balancing load balancers, or Amazon S3 buckets – and can also be used to route users to infrastructure outside of AWS.
• You can use Amazon Route 53 to configure DNS health checks to route traffic to healthy endpoints or to monitor the health of your application and its parameters independently.
• Amazon Route 53 Traffic Flow makes it easy for you to manage traffic globally through a variety of routing types, including Latency Based Routing, Geo DNS, Geoproximity, and Weighted Round Robin—all of which can be combined with DNS Failover to enable a variety of low-latency, fault-tolerant architectures.
• Using Amazon Route 53 Traffic Flow’s simple visual editor, you can easily manage how your end-users are routed to your application’s endpoints—whether in a single AWS region or distributed around the globe.
• Amazon Route 53 also offers Domain Name Registration – you can purchase and manage domain names such as example.com, and Amazon Route 53 will automatically configure DNS settings for your domains.

Docker is a software platform that allows you to build, test, and deploy applications quickly. Highlights:

• Docker packages software into standardized units called containers that have everything the software needs to run, including libraries, system tools, code, and runtime.
• Using Docker, you can quickly deploy and scale applications into any environment and know your code will run.
• Running Docker on AWS provides developers and admins a highly reliable, low-cost way to build, ship, and run distributed applications at any scale. AWS supports both Docker licensing models: open source Docker Community Edition (CE) and subscription-based Docker Enterprise Edition (EE).

 

Ensuring cybersecurity in FinTech requires the use of the latest technologies and the highest level of expertise that can be found. For the protection of customers' personal and financial information to secure payment systems, the system must be protected from outside threats, as well as those networking challenges within the organization. There are solutions, but they involve a solid plan and a willingness to invest the time and money to do it right.

 

To remain competitive as consumers increasingly demand personalized and on-demand capabilities, banks and FinTech need to find a way forward that allows for technical innovation and performance without compromising security. To address these concerns, banks and FinTech organizations should focus on the following key security areas:

Consumerization of finance means the increased usage of applications. FinTech largely relies on applications that can access users’ financial profiles to perform a variety of real-time transactions. Additionally, finance has been an early adopter of DevOps and agile development, with 87 percent of firms affirming their reliance on DevOps as a continuous release model that enables them to meet consumer demands for updated features and improved user experience. But this approach can also leave room for vulnerabilities. Applications are an increasingly common attack vector, and vulnerable code can be exploited as an entryway into financial networks. To this end, banks and FinTech have to ensure that a robust application security infrastructure in place designed to protect user data. This should include things like a web application firewall enabled with current threat intelligence to identify and mitigate known and unknown threats, as well as to detect and patch vulnerabilities.

Practical digital innovation also makes ample use of cloud computing and storage. Many FinTech companies utilize cloud services to provide consistent, scalable performance with lower upfront costs. However, the cloud must be secured differently than a traditional network or data center, and disparate point solutions often amplify data movement while reducing visibility across these distributed environments. As a result, if financial data is going to be stored in the cloud, banks and FinTech firms must ensure that the same security standards they apply to their networks are used in the cloud. In addition to detection and prevention, this security must also be dynamically adaptable and scalable to ensure that is can grow seamlessly alongside cloud use. Additionally, to secure financial data, firms need to implement internal segmentation, along with cloud access security brokers, to improve data visibility while integrating industry security standards.

Such integrated defenses also need to be enabled with automated threat intelligence built into them as a holistic system. As security devices monitor the network, they naturally collect data on at-risk devices, known attacks, common attack trends, and more. To be effective, this information needs to be dynamically shared and correlated across all security instances. As banks and FinTech firms enter into partnerships, it will be impossible for IT teams to manually gather and assess all of this threat intelligence in a manner that allows them to respond to risk in a timely or meaningful way. Machine learning will be integral to this process. Cybercriminals are already leveraging automation to make attacks more effective and persistent. Likewise, machine learning and automation integrated into network security tools enable the detection and prevention of attacks in real-time, allowing the organization to keep pace with cybercriminals.

 

Furthermore, threat intelligence gathered not only needs to be available to each tool deployed across the network but provided in a form that can be easily consumed and leveraged. An abundance of raw threat data from different solutions can decrease visibility, and therefore security, especially in those partnerships where multiple teams and systems are involved, which is why banks and FinTech organizations should seek to integrate traditionally isolated security solutions together using a common security fabric approach that allows for instant and dynamic communication and collaboration within the security architecture. 

 

So, what is the possible ultimate solution for digital security risks? The answer is: raising the awareness of digital security risks.

Besides technological ways to protect your software from cyber attacks and breaches, we all should accept the rapid growth of the need for digital technologies in all areas of our lives. This would push us to think ahead, plan the defense, and act before a problem occurs. We may consider forsaking critical systems and replace them with more distributed ledgers. Also, put some additional limits on data storage and involve governments to regulate the technology industry on the official level. Because no matter how much we want to avoid this aspect, things like big data, AI, algorithms, machine learning, IoT technology, and so on require regulators, indeed. No one should assume that some technology is 100 percent safe — there is always a room for weaknesses. Recent cybersecurity reports and news about hacked Bitcoins let us see that while the Blockchain platform is the future of our world, it still needs vast improvements and open the doors for debates about potential digital security risks of such software for data security and society in general. But while professional developers must stay on top with their security implementing skills, the organizations and companies who desire to adopt FinTech have to raise the awareness about data safety and protection mechanisms. Only innovations that walk hand in hand with regulations become essential for destroying the dark side of the FinTech and reducing the risks for everyone using digital financial software.