Trend Micro Incorporated today released research demonstrating that major new European banking rules could greatly increase the cyberattack surface for financial services firms and their customers.
The new research details the impact of the EU’s Revised Payment Services Directive (PSD2), which is designed to give users greater control over their financial data and the option of sharing it with a new breed of innovative Financial Technology (FinTech) firms. The same ideas are spreading globally under the term “Open Banking.”
The report highlights several possible attack scenarios under the new regulatory regime:
- Attacks on APIs: Public APIs are at the heart of Open Banking, allowing approved third parties to access users’ banking data to provide innovative new financial services. Implementation flaws in these APIs will allow attackers to exploit back-end servers to steal data.
- Attacks on FinTech companies: Users will be forced into a new trust relationship with providers that may have fewer resources than their banks and no track record on data protection. In a quick survey of Open Banking FinTechs, Trend Micro found them to have an average of 20 employees and no dedicated security professional. This makes them ideal targets for attackers and raises concerns over security gaps in their mobile apps, APIs, data sharing techniques and security modules that could be incorrectly implemented.
- Attacks on the apps or mobile platforms: Most Open Banking services will be deployed as mobile apps, making these a prime target for attackers. Finding the username, password, or encryption keys within the app would allow a criminal to retrieve banking data and pose as the user. Even if the apps don’t have permission to make payments, they could contain transaction data, allowing an attacker to build a highly accurate profile of their victims.
- Attacks against the user: Because new Open Banking apps will become the primary means for users to access financial data and services, phishing attacks could reap major rewards for attackers.
To prepare for the changing landscape, Trend Micro details how financial institutions can improve their cyber resilience. These include ensuring sensitive information is never contained in URL paths, prioritizing secure protocols, and eliminating risky practices.
Meanwhile, Open Banking app developers and owners must adopt a secure-by-design approach, including regular software audits.
To find out more about the cyberrisks associated with new Open Banking rules, read our report,Ready or Not for PSD2: The Risks of Open Banking, here: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-risks-of-open-banking-are-banks-and-their-customers-ready-for-psd2.