APIs: The Silent Security Risk in Fintech

A quarterly report published by integrated app and security platform Wallarm sheds light on a crucial but often overlooked security concern for fintech companies — their APIs, as stated in Fintech News. Developed from publicly available sources, these reports aim to provide detailed insights to help CISOs and cybersecurity managers assess threats and build risk models.

In an interview, Wallarm co-founder and CEO Ivan Novikov emphasized the importance of these reports in offering real-time analysis and identifying new threat groups, particularly those related to the increasing use of APIs.

One of the major issues highlighted in the report is API leaks, which accounted for over 10% of incidents. These leaks have affected companies like Netflix, open-source software providers, and enterprise software firms, highlighting the broad impact of this emerging threat.

Novikov explained that for fintechs, the use of open APIs for banking introduces specific security challenges. Institutions must track where their financial data travels, especially personally identifiable information and internal bank account information. Any compromise of this data could lead to significant fraud risks.

Regarding the security of APIs, Novikov pointed out that while banks have multiple layers of protection for passwords and login credentials, APIs often rely on a single key. This key, once compromised, can lead to unauthorized access and potential fraud. Novikov stressed the need for better solutions to address this problem.

The report also highlighted the challenge of aging infrastructure, with many bank APIs dating back several years. This aging infrastructure makes it difficult to locate and update security keys, increasing the risk of breaches.

In light of these challenges, it is crucial for financial institutions and fintech companies to ensure they can trust their partners. While banks can define standards for their data providers, fintechs must set their own standards to protect their APIs and data.

Wallarm is developing a cloud-native platform that can detect attacks in near-real-time, providing repair recommendations and remediation capabilities. This platform aims to address the increasing security threats faced by fintech companies due to API vulnerabilities.