Financial services has been the most-attacked industry for five years straight but a large number of organizations are still compromising mobile security to meet a deadline or productivity target, leading them to suffer a compromise.
A new report by Intertrust, based on an analysis of 160 top financial apps worldwide, reveals that each of them have at least one security flaw.
To prepare the 2021 State of Mobile Finance App Security Report, the Silicon Valley-based provider of trusted computing products and services conducted security assessments on publicly available apps from four major categories, namely banking, mobile payment, investment/trading, and lending.
The Intertrust team evaluated applications from five countries or regions—the United States, India, the United Kingdom, the European Union, and Southeast Asia.
According to the findings, 88% of the apps had cryptographic issues, 81% can leak data, and 77% contained flaws that present high-level risks to finance organizations and their customers.
The report highlights that financial services are still lagging behind in cyber security despite the coronavirus pandemic-driven increase in contactless payments, online shopping, and digital-first financial services.
In 2020, time spent in finance apps increased by 45% last year, activity in investment apps jumped by 88%, and mobile wallet point-of-sale transactions picked up by 19.5%, helped by higher limits for contactless payments.
“As mobile finance apps increasingly enter people’s everyday lives, it’s vital to understand the security risks associated with these apps and the ways to help mitigate them,” said David Maher, chief technology officer and executive vice president at Intertrust.
He added that poor financial app security puts financial organizations and their customers at risk, especially considering the rise in cyberattacks over the course of COVID-19.
According to a survey of 571 community banks in 37 states, conducted by the Conference of State Bank Supervisors, more than 70% of respondents ranked cybersecurity as their top concern.
Intertrust found that Banking apps proved to be significantly more vulnerable both in terms of total number of issues and severity—35% contained more than 10 vulnerabilities and 81% at least one critical or high severity issue.
Payment apps fared only slightly better at 29% and 75%, respectively. Lending apps claimed the most secure spot, “possibly because of their more limited functionality”.
In the testing, Android apps had far more issues than iOS apps and significant variations were found between geographies in app security levels, with UK finance apps containing far fewer security issues than apps from other regions.
Intertrust says around 75% of high-level threats could have been mitigated using in-app protection.
Beyond getting the basics right, the company’s specific recommendations for boosting security include protecting data using secure encryption technologies like white-box cryptography or by using strong data obfuscation techniques.
“The vast majority of financial services apps (88%) have mishandled and/or weak encryption that puts them at risk for data theft. Key protection technologies such as white-box cryptography should be used to secure the encryption process,” the report said, while emphasizing the importance of anti-tampering and runtime protections.
Disclaimer: This article mentions a client of an Espacio portfolio company.
