Australia is progressing with open banking.
The big four, CBA, Westpac, ANZ and National Australia Bank introduced open banking in July 2021.
Other banks and financial services are expected to follow in 2022.
According to many fintechs, however, the introduction is going slower than expected, and they are pushing financial markets to open their banking services online by signing additional data holders.
Open banking has benefits for banks and fintechs as well as consumers.
However, its services and competition does not come without security cautions.
Unlike traditional banking where all customer data is controlled by the parent bank, in open banking, customer data is securely exposed to third-party providers via application program interfaces (APIs) when consent is provided by the customer.
The sharing of that data in turn creates a broader threat surface that must be protected against cyber abuse and malice. So can open banking be secure? The answer is yes; there is a way forward for a secure future for open banking.
Open banking benefits
The benefits of open banking for consumers are clear. Open banking makes it easier for consumers to shop around for financial products and services.
Rather than the tedious process of contacting each lender separately, consumers can give a group of banks temporary permission to audit their financial history and risk profile.
What they get in return is faster, more personalized, and more competitive quotes from lenders, and a much easier way to compare product offers.
Open banking also offers advantages to banks and lenders.
According to Finextra, there are four major advantages for banks: increased collaborative opportunities, greater ability to make foresighted decisions, heightened customer satisfaction, and improved digital agility.
The security implications
Open banking offers valuable service benefits and conveniences. There are, however, perils for the unwary and the technology is considered by some to be a significant threat.
So what are the security implications of open banking?
The process opens client data to external providers via published open APIs.
Easy-to-build and easy-to-consume, APIs speed-up application development while enabling the sharing of sensitive data between systems.
According to a survey by my company, more than half of applications in nearly two-in-five organisations are exposed to the Internet or third-party services via APIs.
The challenge is a high percentage of organisations fail to maintain the same security practices for mobile applications as they do for web applications.
So, while APIs bring tremendous benefits, they also introduce availability and security concerns that consumers and financial institutions alike must be aware of.
Service disruption
Third party APIs may lead to unintended service disruptions if API services are unavailable due to security, network and application configuration errors, API denial of service attacks or application or authentication infrastructure outages.
Trust issues
Many solutions for open banking are built on cloud-only or hybrid infrastructures. However, the company report found migration to public clouds creates trust issues.
These include incompatibility of security tools, settings challenges across different environments, misconfigurations, and issues in application security policies and profiles.
Increased attack surface
API attacks are not uncommon.
A survey by my company revealed that 55% of organisations experience a DoS attack against their APIs at least monthly, 48% receive some form of injection attack at least monthly, and 42% experience an element/attribute manipulation at least monthly.
Other attacks include API authentication and authorisation attacks, embedded attacks such as SQL injection, cross-site scripting (XSS), and bot attacks.
Bot attacks on APIs
Bot attacks are human-like automated programs scripted to break into user accounts, stealing identities, initiating payment fraud, scraping content such as pricing or data, spreading spam, and impacting legitimate business activities.
Data theft
Many APIs process sensitive personally identifiable information (PII).
Sensitive and confidential data coupled with the lack of visibility into how these APIs and third-party applications operate are a security nightmare in the case of a breach.
Undocumented but published APIs
Undocumented APIs may accidently expose sensitive information if not tested and may be open to API manipulations and vulnerability exploits.
Threats vary and API security requires a combination of security controls like API access controls for authentication, authorization and access management.
It also includes detecting and preventing the attacks listed below.
- Bot attacks on APIs
- API manipulations
- DDoS and availability attacks
- Embedded attacks
- API vulnerabilities
- Leakage of PII data, and excessive data exposure
- Fraud and phishing scams
How to secure open banking
When building a comprehensive and effective security solution for open banking, the “basics” are no longer enough. Gartner predicts that by 2022, API attacks will be the most-frequent attack vector, causing data breaches for enterprise web applications.
The strategy must offer support for the OWASP Top 10, bot management, API security, DDoS protection, scalability and availability plus threat intelligence.
Each component has an important role to play.
OWASP Top 10
OWASP Top 10 is an online document that provides ranking of and remediation guidance for the top 10 most critical web application security risks.
The report is based on a consensus among security experts globally and helps organizations prioritize risks to focus on and vulnerabilities to fix in their technology.
Bot management
A bot manager defends APIs against automated attacks and ensures that legitimate users and devices access the APIs but block attempts to reverse engineer kits.
DDoS protection
APIs need to be protected against attacks using a flood of requests to slow or disrupt a service or to gain access to databases. Many DDoS attacks, frequently using SSL, focus on rendering the web application layer unreachable, causing a denial-of-service state.
A maliciously designed HTTP request can lead the web or application server to execute a large number of internal requests that can consume all its resources.
Defence and cloud DDoS applications
Guarding against ever-evolving cyber threats requires comprehensive automated DDoS protection that continuously adapts to offer the fastest threat detection and mitigation.
Cloud security posture and infrastructure management
Migrating application workloads to the public cloud creates new threat surfaces that if left unsecured can be exploited by attackers and lead to theft of customer data.
Multi-layered protection for infrastructure and workloads
It’s important to secure the cloud against identity and access abuse and malicious user behavior, plus protect the overall security posture of the public cloud environment.
Reverse proxy or application delivery controller (ADC)
Ensuring application SLAs is critical for ensuring the digital experience.
ADCs are the foundation for keeping applications and their environments secure, scalable and available. ADCs enable support for the mutual transport level security (mTLS) requirement to securely connect banks to authorized third party applications.
Web application and API protection (WAAP)
As apps are built on REST APIs, a layered approach is needed for protection of APIs against injections, scripting, parameter manipulations, protocol attacks and data theft.
The same capabilities used for applications apply to APIs as well.
WAAP helps in protecting both applications and APIs from data leakage, API vulnerabilities, and API manipulations while protecting undocumented APIs.
Ultimately, the benefits of open banking, shared by both banks and customers, are dependent on comprehensive security strategies.
With a multi-layered safety net banks and fintech will thrive in this environment and offer solutions to build customer trust while keeping cyber criminals at bay.
Prakash Sinha is a technology executive and evangelist for Radware with over 30 years of experience in strategy, product management, product marketing and engineering.
