Penetration testing and the financial services industry

Why Penetration Testing is Essential for the Financial Services Industry

The financial services industry is constantly under attack from numerous and significant cyber attacks and threats. There are many things a business can do, and penetration tests are one of those that can help mitigate those risks.

Vulnerabilities hackers can exploit in the financial services sector

The security challenges the financial industry faces vary depending on a few things:

• Size of the organisation
• How established they are
• The products/services that are on offer
• The data that’s held on customers

Many financial organisations have apps for customers, and much like how magpies are attracted to shiny things, finance apps are like the shiniest of things for hackers. Due to the amount of data (personal and financial) the app holds and processes on an individual or an organisation, you can imagine it’s like entering The Cave of Wonders once inside one of these apps.

Insecure Direct Object References

One example of a type of web application vulnerability that finance organisations could see is an Insecure Direct Object References vulnerability typically involves a hacker logging into an app and making small changes to the URL, gaining access to the profiles of other users.

For larger organisations, key vulnerabilities often surround the use of outdated technology and the migration to the cloud. Uri Bar-El, Qualitest’s Global Head of Cyber Security, explains the risks of cloud migration for the financial industry in a blog by Qualitest called “Cloud Migration: 3 Biggest Risks Banks and Financial Services Companies Need to Know (and How to Avoid Them)”, and in summary, says:

• Whoever owns the process of finding vulnerabilities does not own the process of mitigating them. Creating misalignment or a security-development disconnect.
• Poor normalisation. Each security tool is an island and has its own risk metrics. So, when a bank or financial services organisation gets a set of results – and again, these are hundreds or thousands of results – they’re not normalised. So, there is no way for the organisation to compare apples with apples and know its real risk level and prioritise the mitigation process.
• Lack of aggregation and correlation. Sometimes, several vulnerabilities can be solved by a single fix. But right now, security needs to contact each developer team about each vulnerability one by one and tell them what they need to do.

Older technologies weren’t developed with today’s cybersecurity threats in mind (perhaps these businesses thought cyber-attacks couldn’t get any more sophisticated, or that we would have been able to crack down on cybercrime, or maybe they just thought it would be somebody else’s problem). As such, outdated technology can present an increased risk, particularly if software patches and updates aren’t regularly released and applied.

For organisations that have joined the modern workplace, the above won’t be an issue; however, you’re not out of the woods just yet. A rapidly growing business, such as a financial start-up can quickly exceed the rate at which they are able to protect its organisation. Another potential issue is that new technologies can lack widely documented security standards and are consequently often misconfigured.

Remote working also poses a number of security risks across the financial sector, with employees accessing networks and systems outside of the office, meaning it is vital that regular assessments are conducted to identify weaknesses. For example, if data is sent in an unencrypted format, like plain text, then it might be intercepted and stolen by hackers. Financial organisations should therefore not be allowed to access any unknown Wi-Fi networks unless they are using a VPN connection.

Choosing the right security partner is key

Penetration testing should be at the heart of any financial organisation’s security posture, providing invaluable insight to help security teams better understand where their organisation is vulnerable to cyber-attacks.

Choosing the right security partner is vital to a successful pen test – it is important to select one that can demonstrate sector-specific experience and an understanding of the latest techniques being used by hackers.

Without an experienced, CREST-certified partner, penetration testing will not deliver the value and outcomes your organisation needs in order to better understand the security risks they face and strengthen its cyber resilience.

Key Takeaways

To conclude, penetration testing is essential for any organisation with a security-first mindset, but it is also particularly prevalent in the financial services industry due to the nature of data held and the common vulnerabilities mentioned above. Web-based and internal applications should be fully tested to ensure they do not provide an avenue of entry for attackers.

Want to know more about our Penetration Testing Services?