4 Reasons Why Financial Services Companies Need Better API Security Now

API Attacks Threaten Key Business Initiatives

Open banking gives consumers more choices and convenience to address their financial needs. Also significant, it increases competition across the financial services industry and generates new revenue avenues. Open banking also provides more traditional financial institutions the opportunity to compete with faster-moving fintech companies.

Covid has sped up digital transformation across multiple industries. In financial services, it hastened the adoption of mobile and remote banking; consumers want integrated services and the ability to connect their financial lives when and where they want. This requires banks and other finance companies to roll out new capabilities or risk becoming obsolete and losing customers and, along with them, revenue.

Digitalization has become a critical business initiative and is increasingly important in financial services. However, without the ability to protect the data being used within these services, financial organizations lose that opportunity entirely. Harnessing the value of those business opportunities mandates the protection of those APIs.

Just a single API attack has the potential to wipe out all the gains made from an organization’s digital transformation.

API Security Incidents Damage Consumer Trust

Have you ever had an experience with a company and vowed never to do business with them again? Have you ever switched from a provider due to poor customer service? Once trust is lost, it’s very difficult to get it back.

In financial services, the costs can be high. Salt Labs, the research arm of Salt Security, provides ongoing API vulnerability research. In its latest report, Salt Labs uncovered a server-side request forgery (SSRF) flaw on a large fintech platform that provides a wide range of digital banking services to hundreds of banks and millions of customers.

The vulnerability had the potential to compromise every user account and transaction data served by its customer banks. Imagine the leaking of customers’ banking details and financial transactions and users’ personal data or, worse, unauthorized funds transfers into the attackers’ bank accounts.

None of these nightmares came to be, because Salt Labs found the problem before a bad actor did, and all issues have been remediated. But this type of exploit, had it occurred, would have likely caused irreparable reputational damage – not to mention financial losses, theft, and fraud.

The nature of financial services applications is to exchange sensitive financial and customer data, making APIs a high-stakes asset requiring protection.

Traditional Solutions Don’t Deliver Adequate API Protection

Most financial services companies have sophisticated runtime security stacks with multiple layers of security tools, such as bot mitigation, WAFs, and API gateways. These traditional tools provide foundational security capabilities and protection for traditional applications; however, they lack the context needed to identify and stop attacks that target the unique logic of each API.

Attacker activity looks like normal API traffic to traditional tools, such as WAFs, API gateways and other proxy-based solutions. The architecture limits them to inspecting transactions one at a time, in isolation, and beyond rate-limiting. They also depend on signatures to detect well-known attack patterns. If the transaction does not match a known attack signature, the WAF will send it through. Since each API is unique with unique vulnerabilities, signatures cannot help prevent API attacks.

API security requires big data to capture all API traffic and artificial intelligence (AI) and machine learning (ML) to continuously analyze the large volumes of API traffic. Without continuous analysis of API traffic, you cannot understand normal behavior for each unique API and gain the context required to pinpoint attackers.

In addition, while open banking defines standards around how APIs should be structured to enable predictable integrations and communications, open banking provides no standard to meet the majority of API security requirements. Moreover, basic controls, such as authentication, authorization, and encryption, fall short of meeting API security challenges.

API Security Must be at the Forefront for Financial Services

API usage is on the rise. In financial services, APIs have become essential to meet changing consumer expectations and innovate to remain competitive. At the same time, APIs are now the most frequent attack vector. In the past 12 months, 95% of organizations experienced an API security incident, and API attack traffic grew 681% — more than twice as fast as overall API usage traffic.

Financial data breaches cost the business in compliance and regulatory fines and lost revenue and cause irreparable harm to an organization’s brand. Reputation is everything in the highly competitive financial services market.

Financial services organizations must put API security at the forefront to protect this growing attack surface. To do so requires dedicated API security tooling for the entire API lifecycle that provides continuous attack surface visibility, early attack prevention, and automated insights for continuous API improvement.

To learn more about how Salt can help defend your organization from API risks, you can connect with a rep or schedule a personalized demo.

‍