Back
In recent years, digital transformation has led to rapid change in the banking sector. Transactions made through mobile applications and internet banking without the need to visit a branch have taken the customer experience to the next level. However, this transformation has also created new security threats for banks. Banks hold the most sensitive data of individuals and organizations, such as financial information, credentials and transaction histories, making bank systems a target for attackers. Ransomware, phishing attacks and data leaks, which have increased especially in recent years, cause great financial losses for both banks and customers. In short, every new digital service added in the banking sector creates a potential attack surface for cyber attackers. Therefore, banks need to develop strategies that put security at the center of their digitalization journey.
Lessons to Learn from Global
Some of the major cyber incidents targeting banking systems around the world show us how critical the security measures that need to be taken are, not only from a technical but also from an operational perspective. Below are different examples of cyber attacks caused by firewall configuration, lack of user training and lack of MFA.
Capital One (USA, 2019)
Vulnerability: Incorrectly configured Web Application Firewall.
Impact: More than 100 million people had their credit card application information leaked.
Conclusion: Human error is one of the biggest risks in cloud infrastructure and security configurations.
Bangladesh Bank SWIFT Hack (2016)
Vulnerability: Infiltration of the SWIFT system to send fraudulent transfer instructions.
Impact: 81 million dollars stolen (Approximately 1 billion dollars were attempted).
Conclusion: Lack of multi-signature / MFA verification in critical infrastructures can cause serious damage.
Equifax (USA, 2017)
Vulnerability: Unpatched vulnerability in Apache Struts software.
Impact: 147 million people had their identity and financial data leaked.
Conclusion: Poor patch management and open source dependencies can pose major threats.
Tesco Bank (England, 2016)
Vulnerability: Fraudulent transactions were made using malicious code on card systems.
Impact: £2.5 million withdrawn from the accounts of 9,000 customers.
Conclusion: Anomaly detection was inadequate. There is a need for instant threat intelligence and behavioral analysis.
JPMorgan Chase (USA, 2014)
Vulnerability: VPN access information stolen.
Impact: 76 million household and 7 million small business data leaked.
Conclusion: Lack of MFA in access to critical systems carries great risk.
Russian Central Bank Hack (2016)
Vulnerability: Systems were accessed by a phishing attack via email.
Impact: 31 million dollars stolen.
Conclusion: Employee awareness against social engineering attacks should be increased.
Layered Security Approach in Banking
In order to ensure effective cyber security in a high-risk sector such as banking, a layered security approach should be taken as a basis. This model consists of multiple layers of security stacked on top of each other, each protecting against different threats. In particular, the following four key layers are of primary importance for the security of modern banking systems.
Network Security
Network security aims to prevent unauthorized connections by controlling both internal and external access to banking systems. This layer covers the following security measures.
Application Layer
-
Application-level traffic (HTTP, HTTPS) is secured at this level.
-
Web Application Firewall, API Gateway, rate limiting measures are applied.
Presentation Layer
-
This is where the correct encryption and decryption of data takes place.
-
SSL/TLS protocols, certificate management and data format control are implemented.
Transport Layer
-
Data is securely transmitted between the two systems.
-
TLS, SSL and connection security is provided over TCP/IP.
Session Layer
-
Session management, authentication and timeout rules are contained here.
-
Protection against Session Hijacking and Replay Attack threats is provided here.
Endpoint Security
Endpoints are the devices through which users and employees access the system. These include desktops, laptops, mobile devices. Attackers usually try to log into the system through these devices. Antivirus, EDR, XDR, Patch Management, MDM and Application Integrity Control are the main methods and tools that can be used for such attacks. Attacks often start with a malicious link that a user clicks on or a file that is uploaded. The endpoint layer is therefore the first layer of the security chain.
Data Security
In the banking sector, the most valuable asset for both banks and customers is data. Data protection should therefore not just be about encryption. Strong protocols such as TLS should be used during data transfer, and data should be encrypted in AES-256 standard in data centers and backup environments in accordance with international standards such as NIST. Detailed information on how to use AES and key management was published by NIST in 2020. Key management processes should ensure that encryption keys are securely generated, stored and destroyed. In addition, protecting sensitive data such as customer information with masking where necessary provides effective protection against both internal and external threats and data leaks.
Identity and Access Management
In the banking sector, access to systems and data is one of the most frequently targeted areas. This is why Identity and Access Management (IAM) systems are important systems for banks. IAM solutions must be configured to authenticate users, grant appropriate access rights, continuously monitor access and intervene when necessary.
Multi-Factor Authentication plays a central role in identity and access management systems. Password authentication alone cannot provide adequate protection against modern cyber threats. Users logging into banks' systems must provide at least one additional verification factor in addition to their password. These factors can be one of the following.
-
Something owned by the user (e.g. OTP code generated on the mobile device)
-
Something the user knows (e.g. PIN code)
-
The user himself/herself (Biometric verifications: Fingerprint, facial recognition)
MFA should be made mandatory, especially for high-risk transactions (large money transfers) and additional transaction-based verification steps should be implemented.
In addition, IAM systems should adopt the principle of least privilege, ensuring that each user has only the minimum authorization required to perform his/her task. Access records should be reviewed regularly and suspicious accesses should be analyzed.
A Practical Approach to Layered Security - PowerFactor
It is not enough to know only the general principles for effective security in banking. It should also be clear how these principles will be put into practice.
Multi-Factor Authentication (MFA)
Password-only access is insufficient against modern cyber threats. MFA requires the user to request more than one verification factor:
-
Something he/she knows (Password, PIN)
-
Something he/she owns (OTP)
-
Himself/herself (Biometric data, fingerprint, facial recognition)
In banking applications, implementing MFA on a transaction-based, risk-based or user behavior-based basis ensures regulatory compliance and enhances transaction security.
Application and Device Security
Mobile devices and applications have become direct targets for cyber attackers, especially in mobile banking. Security measures that stand out in this area:
-
Detection of root/jailbreak on the device,
-
Emulator and application manipulation detection,
-
Blocking screenshot/mirroring,
-
Reverse engineering protection,
-
Malware blocking.
Performing these checks in real time at the device level protects both the user and the application.
Technical Compliance with Regulations
Regulations such as the BRSA's 2023 circular, PDS2 and GDPR require certain controls in banks' technical infrastructure.
-
Strong Authentication
-
Data Encryption
-
Application Security
These requirements are not only a legal obligation but also critical for reputational and operational security.
PowerFactor can respond to such strategic needs, technically integrating the aforementioned layers of MFA, device security, application security and compliance. In mobile and internet banking systems, PowerFactor is able to offer solutions to these three areas at the same time with its architecture that analyzes the security status of the device, application integrity and authentication processes together. In this context, you can access detailed information at PowerFactor Multi-Factor Authentication and Mobile Application Security System to protect your application and its users, to fully comply with the regulations and to be prepared against threats.
