Enzoic Navigation
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
banking

API’s Are Leaving Digital Banking Services Unlocked

How to Address the Vulnerabilities in Open Banking

Major cyberattacks have made international news repeatedly over the last years, and there is no indication that cyberattacks will be slowing down. It isn’t just ransomware that is a growing issue for the financial sector, but credential stuffing attacks that are posing major risks to banks and credit unions.

In 2020, the FBI released a credential stuffing advisory warning and shared research which indicated that these attacks frequently target APIs. Gartner predicts that APIs will be ‘the most frequent online attack vector by 2022.’

Why are APIs such good targets?

Over the past decade, banks and credit unions have rolled out innovative, customer-facing digital banking services with the widespread use of application programming interfaces (APIs). APIs are broadly deployed because of the intense demand for a seamless and easy digital customer experience.

With the increased pressure, banks and credit unions partner with third parties to enhance the client experience. This is called open banking, or open bank data—the practice of a bank or credit union partnering with a third-party service that provides consumers with open access to their banking information, and transactions, and networking with multiple other financial institutions.

Customers want to be able to access their information with a few taps of their smartphone screen, but sometimes, it’s at the risk of security.

Financial data—from credit cards numbers to mortgage reports—as well as personal data contained within accounts, are all tempting targets for cybercriminals.

Convenience or Security

Now is the crucial moment to step back and examine the digital landscape of open banking. A report from August 2020 found that about half of all the organizations surveyed “knowingly push vulnerable software”. When developers are pressured (by deadlines, low risk, or simple oversight), it means that security is no longer at the forefront of their minds.

Whatever the case, when security is not top of mind, it makes it easier for hackers to access customer data.

What Can Be Done?

Financial organizations must become more involved with the existing API vulnerabilities. Every stage of the process, from code to interface development up through deployment, should be examined from a defensive point of view. There are many vulnerabilities to address, but organizations can start with a few basics:

  1. Know how many APIs exist in their environment.
  2. Keep track of them. Catalog all APIs, keep records of what they do, and record the type of information the system handles.
  3. Audit the APIs for existing and potential risks. Determine existing vulnerabilities and extrapolate to a situation where the API was attacked.
  4. Make changes. Respond to the issues found in the process.

There are also ways institutions can immediately shore up their defenses against credential stuffing attacks, which will massively assist API security concerns overall.

In credential stuffing attacks, cybercriminals automatically ‘stuff’ combinations of usernames and passwords into a login form. The credentials might have been obtained from a previous breach or stolen from a different organization.

To combat the possibility of these attacks, banks and credit unions can:

  1. Institute Web Application Firewalls – WAFs can help banks and credit unions monitor for attacks.
  2. Hash Passwords – instead of plain text, all stored passwords should be protected with hashing, which means they will still be secure in the event of a data breach.
  3. Mandate the use of Multifactor Authentication – making MFA mandatory (as opposed to optional, as many systems currently offer) decreases the chance of a breach.
  4. Screen for Compromised Credentials – one of the most immediately effective changes to make is to screen credentials against a blacklist of previously compromised passwords. Ideally, this should be done at the moment a new password is created, as well as on an ongoing basis.

When enterprises forge forth and try to reach customer expectations quickly with non-secured APIs, it’s easy to compromise system security. Financial intuitions offering open banking should have a common goal when it comes to APIs: balancing safety with the customers’ digital experience expectations.

APIsCredential Stuffingdigital transformationhashingPasswords

Search

Assess your cyber vulnerabilities with a free password audit tool
Start Now

Browse blog categories

  • Account Takeover (28)
  • Active Directory (44)
  • all posts (152)
  • Continuous Password Protection (24)
  • COVID-19 (7)
  • Cracking Dictionaries (6)
  • Credential Screening (21)
  • Cybersecurity (66)
  • Data Breaches (31)
  • EdTech (3)
  • Enzoic News (18)
  • Financial Services Cybersecurity (5)
  • GovTech (4)
  • Healthcare Cybersecurity (15)
  • Law Firm Cybersecurity (2)
  • NIST 800-63 (28)
  • Password Security (30)
  • Password Tips (51)
  • Regulation and Compliance (11)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Developer Documentation (APIs)

Recent blog posts

  • CISA: The Risk of MFA Without Improving Password Security
  • It’s W0rld P@ssw0rd D@y!
  • Tackling Cybersecurity Vulnerabilities in School Systems  
  • [ Sign Up for a Free Account ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2022 | Privacy Policy | Acceptable Use

3800 Arapahoe Avenue, Ste 250 l Boulder, CO 80303

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website