Financial service providers, such as banks, credit unions and credit card companies, rely heavily on APIs to engage users with equal efficiency through a mobile app or a browser while fostering a vast 3rd-party ecosystem. Further validating that APIs are the development tool of choice, the most recent Cequence Security API Usage and Threat Report found that 14.4 billion or 70% of the 21.1 billion application requests analyzed were API-based. That same power and flexibility found in APIs are also leveraged by attackers, who use their developer skills for malicious purposes with 80% or 1.8 billion of the blocked attacks being API-based. APIs simplify the execution of hard to prevent automated attacks and business logic abuse, highlighted by a 62% increase in ATOs against login APIs and a surge of 178% in content scraping against APIs.
Financial Services Security by the Numbers
300x
Financial services firms are 300 times as likely as other companies to be targeted by a cyberattack.
Source
Source
$49.9B
The total cost of financial fraud in 2021, driven by the fact that every $1.00 of financial fraud has a true cost of $4.16.
Source
Source
42%
Cybercrime costs financial services organizations 42% more than other vertical markets.
Source
Source
API Protection is a Business Problem
Banks, credit unions, and other financial services organizations are the ultimate prize for hackers and cybercriminals seeking monetary gain with targeted attacks against APIs and web apps. The attacks vary from automated account takeovers that can then lead to theft of funds to leveraging authentication coding errors to gain escalated privileges and steal data. Or they uncover APIs exposing sensitive data leading to both the loss of data and potential compliance violations. Attacks on your APIs can introduce significant a range of risks and they impact the entire business – not just the security team. Business impact examples include:
Infrastructure
Whether it’s an automated ATO on a perfectly coded API, or a volumetric attack against an API coded without resource or rate limiting (OWASP API#4), the impact on infrastructure teams can cause costs to skyrocket. Worse yet, the web site and mobile app can become non-responsive, resulting in (real) user dissatisfaction.
Security
Security is impacted by efforts to slow or stop API attacks, often struggling to separate real transactions from fake, or worse yet, blindsided by an unprotected shadow API.
Fraud Teams
Fraud teams are overwhelmed by unauthorized fraudulent activity that affects their business operations, brand, and customers. This enables fraudsters to constantly instigate new and creative campaigns to avoid detection and defraud users and businesses.
Marketing, Sales, eCommerce
Depending on the type of attack, these groups may be presented with inflated marketing statistics which turn into poor or misleading sales program decisions, missed revenue projections and damage to vendor relationships.
Customer Satisfaction, PR, Brand
With the understanding that 57% of consumers spend more on brands to which they are loyal, which can generate a 12%-18% incremental revenue growth per year, financial services organizations are singularly focused on customer retention. A bad experience due to a slow or unavailable website, or a compromised account drive customers elsewhere, resulting in a 5x increase in costs of acquiring a new customer.
Limitations of Traditional Defenses
Today’s security teams simply lack the visibility and defense capabilities they need to protect the ever-growing risk from APIs and other application connections. Many believe that compliance with PCI or SOC 2 and a “shift-left, DevOps” approach is sufficient to protect their APIs. The problem with these strategies is that they don’t have a way to “know the unknown”, meaning they aren’t able to look for all APIs and API vulnerabilities without knowing where to look. Even if all APIs are discovered and “known”, attackers can still leverage seemingly legitimate transactions in an attempt to steal data, or commit fraud. Traditional approaches that use WAFs or API gateways depend on easily evadable detection, lack the real-time ability to discern good from bad API activity and are reliant on static, least common denominator protection spread across multiple technology components.
Cequence Secures the Financial Services Industry
Cequence takes a wholistic approach in defending against cyber-attacks that target financial firms with a market-defining United API Protection solution that goes far beyond traditional API security offered by other vendors. To ensure comprehensive API protection, it requires a solution that enables discover, comply, and protect stages of the API protection lifecycle across all APIs that defends against fraud, business logic attacks, exploits, and unintended data leakage.
This allows financial firms to ensure that they can continue to protect their organizations and their customers from multiple layers of risk, so they have the peace of mind that sensitive data is safe and there is no disruption to their business operations.
Why Cequence?
With the Cequence Unified API Protection solution, customers can continue to reap the competitive and business advantages of ubiquitous API connectivity. The Cequence solution results in attack futility, failure, and fatigue for even the most relentless of attackers. It significantly improves visibility and protection while reducing cost, minimizing fraud, business abuse, data losses and non-compliance.
