{"id":3383,"date":"2019-07-12T13:37:42","date_gmt":"2019-07-12T12:37:42","guid":{"rendered":"https:\/\/www.alvantia.com\/?p=3383"},"modified":"2019-07-12T13:37:44","modified_gmt":"2019-07-12T12:37:44","slug":"what-risks-does-a-fintech-run-when-publishing-insecure-web-applications-and-how-can-it-protect-itself","status":"publish","type":"post","link":"https:\/\/www.alvantia.com\/en\/what-risks-does-a-fintech-run-when-publishing-insecure-web-applications-and-how-can-it-protect-itself\/","title":{"rendered":"What risks does a Fintech run when publishing insecure web applications and how can it protect itself?"},"content":{"rendered":"\n

Imagine that one day the clients of\na small firm in the financial sector, whose products operate and are contracted\nonline, cannot access their accounts, make transfers or even access the\nwebsite. And they encounter the theft of their money, fraudulent use of their\ncards, movements of money to unknown recipients or misuse of their personal\ndata. Without a doubt, the company would run the risk of incurring very high\ncosts in order to deal with the claims, investigate what happened, repair the\ndamage caused, restore operations, compensate for damages to third parties,\nregain the trust of its customers, etc.<\/p>\n\n\n\n\n\n\n\n

Secure development<\/span><\/strong> helps to make web applications safer to operate and, to a large extent, to ensure the smooth running of a business.<\/p>\n\n\n\n

Incidents and the buzz<\/strong><\/strong><\/h4>\n\n\n\n

If there is one event that made fear spread like wildfire among software consumers in 2017, it was the mass hijacking of information perpetrated by the WannaCry virus, which affected banks and businesses around the world. Following this high-profile media event, the IT world would never again be trusted as it used to be.<\/p>\n\n\n\n

This incident raised a great deal\nof interest concerning security, which led the press to increasingly report on\nthe shortcomings of the sector. <\/p>\n\n\n\n

A little-known case<\/a><\/strong>, but one that clearly shows the importance of secure development, is the one that resulted in a 144-month prison sentence for the two men who stole 160 million credit card numbers using an attack known as SQL Injection. This attack consisted of entering commands in a language understood by databases through user applications. When orders are transferred by an application to databases, the databases execute them and return the requested information normally, due to the fact that the application has the required credentials.<\/p>\n\n\n\n

Spanish Small Business, a playground for criminals<\/strong><\/strong><\/h4>\n\n\n\n

The press also reported<\/a><\/strong> on the impact on Spanish SMEs, which were the victims of 70% of the attacks in that country, with losses of around 75,000 euros per incident, estimating the total losses at 14 billion euros in one year. <\/p>\n\n\n\n

The states have also echoed this circumstance and revealed figures<\/a><\/strong> like those from the Attorney General\u2019s Office, which says that in Spain 18,344 proceedings for online fraud (405 convictions), 272 for revealing trade secrets, 295 for computer damage, 68 for crimes against intellectual property and 144 for counterfeiting through ICTs were initiated. <\/p>\n\n\n\n

In 2017, 120.000 attacks were detected<\/a><\/strong> \u2013a new record for Spain\u2013 a rise of 140% in the last two years.<\/p>\n\n\n\n

Spain is the ninth most-attacked\ncountry, behind Italy in eighth place, and with Russia top of the list. The\nUnited States ranks 5th.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The trend: a hybrid combination of social engineering and malware\npurchasing<\/strong><\/strong><\/h4>\n\n\n\n

Web vulnerabilities base their\nattack vector on developers being the weak link, so that, by taking advantage\nof their ignorance, or carelessness, information can be obtained about the\napplication, the system containing it, or users and customers.<\/p>\n\n\n\n

But the increasingly sophisticated\nattacks are not normally based on just one attack vector. They also take into\naccount that a possible incorrect system configuration or user ignorance is a\nweakness and a way to get information.<\/p>\n\n\n\n

Therefore, an uncontrolled error in\nan application can provide system information to an attacker.<\/p>\n\n\n\n

Custom-made applications, the blind spot<\/strong><\/strong><\/h4>\n\n\n\n

There has been a lot of\nawareness-raising and companies have learnt by investing in protecting their\nnetworks against intrusion attempts by using antiviruses, firewalls and\nadvanced system security procedures. But this only slows down one part of the\nproblem.<\/p>\n\n\n\n

Attackers have realised that web\napplications are built with large vulnerabilities that provide a perfect way to\ncollapse the service offered to customers, corrupt or steal data, or obtain\ninformation about other vulnerabilities in the server-client infrastructure.<\/p>\n\n\n\n

We could compare this fact\ngraphically to equipping a house with a security door and leaving the keys\nunder the doormat.<\/p>\n\n\n\n

“More than 70% of security vulnerabilities exist in the application layer, posing a significant and immediate threat to users worldwide<\/span>\u201d,<\/span><\/em><\/strong> <\/span><\/em>said the recently deceased Howard A. Schmidt,\u00a0CISSP, board member of (ISC)\u00b2<\/a><\/strong> and chairman of the\u00a0Information Security Forum (ISF).\u00a0“<\/span><\/em>Too often, security is established at the end of the software life-cycle in response to a threat or risk.\u201d<\/span><\/strong> <\/span><\/p>\n\n\n\n

It is estimated that 86% of websites have at least one vulnerability<\/a><\/strong>, and the probability of information leakage is 56%. <\/p>\n\n\n\n

Identifying the risk, the black book of applications<\/strong><\/strong><\/h4>\n\n\n\n

\u201cThere are two types of companies: those that have been hacked and those that are still not aware that they have been hacked\u201d<\/em> John\u00a0Chambers, former CEO, Cisco<\/p>\n\n\n\n

The IMF, which is concerned about the subject, has produced a very revealing report<\/a><\/strong> on cyber risks in the financial sector, including mathematical calculation models. <\/p>\n\n\n\n

The report focuses on the most\nvulnerable players in the sector (Fintech), the threats and risk measurement.<\/p>\n\n\n\n

Of the risks considered to be major risks to the economy, the report highlights cyber risk as the greatest of all<\/span><\/strong>, even greater than geopolitical risk; and the US financial sector as the sector that most reports on the attacks that it suffers. This reveals the concern of American financial institutions for creating a joint security environment. <\/p>\n\n\n\n

This is not the case in other\ncountries, where there is no incentive to report incidents at the private\nlevel. Nor is there much information in the public environment, perhaps due to\nthe restrictions deemed necessary for national security.<\/p>\n\n\n\n

In regard to this market, the report emphasises the great difference between the impact of the attacks and the size of the victim: the smaller the company, the greater the impact of the attacks. <\/span><\/strong><\/p>\n\n\n\n

According to the report, this is\nnot because the attackers have a preference for Fintechs, but because Fintechs\nare not able to allocate as many resources to cyber-security as the major\nbanks.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The main threats you may encounter\ninclude: business disruption (very important if you are an online store or have\nmany concurrent operations), fraud, information leaks (especially if you handle\nvery sensitive information, such as medical records), and reputational risk.<\/p>\n\n\n\n

You can get a better picture of the\nrisk you run if you consider which of the above threats your business faces,\nwhat the weak links or vulnerabilities may be (in applications, the system or\nthe users), and what consequences a threat could have if it became a reality\nthrough a successful attack.<\/p>\n\n\n\n

Calculation of risk: <\/p>\n\n\n\n

Risk = f (Threat, Vulnerability, Impact\/Consequences)<\/span><\/strong><\/p>\n\n\n\n

The financial sector has a high\nlevel of threat, as it is\ntargeted by criminals, activists and spies.<\/p>\n\n\n\n

In addition, technological\nproliferation puts Fintechs at a very high level of vulnerability. The number of exposed applications and how they\nare constructed are of great importance in this area.<\/p>\n\n\n\n

Value-added solutions, turning costs into profits<\/strong><\/strong><\/h4>\n\n\n\n

Although zero risk does not exist, there\nis a lot you can do to mitigate the risks<\/strong> in your custom applications.<\/p>\n\n\n\n

If you are a software supplier, you can make the production of your application more secure by implementing a Development Security Maturity Model<\/span><\/strong>. This consists of a series of good practices to be integrated right from the beginning of the Development Life Cycle. Knowledge of these good practices and their implementation will allow you to raise the levels of maturity, and therefore create safer applications.<\/p>\n\n\n\n

There is a great project-based open\nframework (www.owasp.org), with applications, testing guides, methodologies and\nenough information to implement good security practices in the development life\ncycle of your projects.<\/p>\n\n\n\n

It is important that, when training\nusers, reliable sources should be quoted and any other sources questioned.<\/p>\n\n\n\n

If you are a small company, you can\nask your supplier to inform you about the good practices that will be used in\nthe development of the software that you are going to contract, whether they\nhave a security maturity model during development, or if they use the services\nof an external company to provide web auditing services, web intrusion testing,\ntraining in secure development, or support for the resolution of\nvulnerabilities.<\/p>\n\n\n\n

If your software provider is not\nmature enough, or you consider that you need to take extra steps, as the\ncustomer, you can contract the services of an external company to manage all\nthe security requirements.<\/p>\n\n\n\n

Whichever option you choose, it is important to implement it right from the beginning of the project<\/span><\/strong>, in order to reduce costs. <\/p>\n\n\n\n

As a software consumer company, you\nwill need to have detailed information on reliable sources that supply the\napplication you are purchasing: what data will be requested at any given time\n(especially passwords), what information will arrive by email, and which\nrepresentatives are reliable in the event of incidents or doubts.<\/strong><\/p>\n\n\n\n

Whether your company is a consumer\nor a builder, you must bear in mind that security incidents will appear\nthroughout development, and even once the product has been implemented. You\nmust therefore take into account the possible time-frames for resolution, even\nbefore they appear.<\/p>\n\n\n\n

You must consider, for maintenance\ntoo, the good practices of safe development and the methods for resolving the\nvulnerabilities that will appear throughout the lifetime of the product. <\/strong><\/p>\n\n\n\n

Finally, insurance is available to cover cyber risks<\/span><\/strong>, with products suitable for SMEs and the self-employed. Whether you are a supplier or a consumer, it is a good idea to consult your insurance agent and seek products that fit your cyber risks.<\/p>\n

<\/div>","protected":false},"excerpt":{"rendered":"

Imagine that one day the clients of a small firm in the financial sector, whose products operate and are contracted online, cannot access their accounts, make transfers or even access the website. And they encounter the theft of their money, fraudulent use of their cards, movements of money to unknown recipients or misuse of their<\/p>\n

Continue Reading<\/i><\/a><\/p>\n","protected":false},"author":5,"featured_media":3353,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[215,186,187],"tags":[225,299,236],"class_list":["post-3383","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alvantia-en","category-alvantia-2","category-technology","tag-fintech","tag-secure-development","tag-technology","not-single"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/posts\/3383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/comments?post=3383"}],"version-history":[{"count":4,"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/posts\/3383\/revisions"}],"predecessor-version":[{"id":3387,"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/posts\/3383\/revisions\/3387"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/media\/3353"}],"wp:attachment":[{"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/media?parent=3383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/categories?post=3383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.alvantia.com\/en\/wp-json\/wp\/v2\/tags?post=3383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}