How to Build a Perfectly Secure Fintech Application

While financial services technology is certainly disrupting traditional banks, investment firms, and even insurance companies, there is something that traditional institutions have more than fintech companies do – they’ve got more trust.

People have always trusted that their money, valuables, and information are safe within a brick-and-mortar bank. Translating that to a fully digital operation is a big leap.

Nothing will kill a fintech initiative faster than a security breach. Already, there are examples of fintech and fintech-related startups that have suffered because of cyber attacks or failures in compliance. And, the interesting thing about these cyber-attacks is that they have not been highly sophisticated – they have occurred through social engineering (psychological manipulation of people for gaining secured information), or by exploiting basic security weaknesses.

Security in fintech absolutely has to be a top priority. And, if you are considering the development of a fintech application, security has to come before everything else does.

Gaining trust as you develop your fintech startup or app will involve understanding the fundamentals of security, mitigating the risks, and then demonstrating your successful security as a business asset.

The Fundamentals of Fintech Security

If you are planning on building a secure fintech application, both you and your team should be fully aware that anyone who has access to any data housed is a part of a strong security environment. Protection of customer information and assets, and compliance with legal requirements should be on everyone’s radar. Detailed security policies must be established, and the service architecture should be determined.

You’ll need to communicate all of that to the fintech developers you will eventually hire. At minimum, you will need the following for your fintech solution:

• Platform operations
• Server and database hosting
• Access Management
• Secure in-house communication
• Compliance requirements
• Secure and encrypted data transmission
• Payment integrations (if your app involves banking transactions, lending, crowdfunding, etc.)

There is a host of SaaS architectures that will provide some of these things, but consulting with a reputable fintech development team can provide you with valuable insight and suggestions/recommendations about things you may not have considered otherwise.

You may not know how to build a secure fintech application. What you do know is what you want it to do. It is up to developers to translate that into a piece of software that includes all of the security architecture you need.

Building your cloud app from scratch will ensure that you get what you want, along with the proper testing of every element and the post-launch support you need.

Define the Data Protection Controls You Need

What are the most sensitive data assets you will house? And what protocols need to be in place to secure them? This is where, in the fintech technology stack, there will need to be functions that control:

• Managing who has access to the data and revocation of access when necessary.
• Protection measures for both workstations and mobile devices, including encryption, firewalls, screen locks, and such.
• Encryption of data, as it is housed, accessed, and transferred.
• Two-factor authentication whenever possible.
• Setup of device inventory controls along with encryption in place, should a device be discarded, lost, or stolen.

Alignment with Security Compliance Regulations Must Be a Part of Any App You Develop

Here’s the thing about a successful fintech company. It ends up being a supplier or a partner to banks, if not being outright purchased by them. If your app, in its development elements, aligns with industry standards, you have a far greater chance of becoming a supplier or an AWS partner.

The security systems you have in place will determine your attractiveness. Some of these will be the protocols you have in place within your company. Others will be the security measures embedded in your software. It would be a good idea to study the ISO/IEC 27000 Standards for Security Management and ensure that your development team is aware of them as well.

Mitigating The Risks in Fintech

A large factor in developing a secure fintech app is in the post-development phase. It will involve a few things that you will need to be certain to “cover” with any developer you select.

Penetration Testing

You need to discuss how the developers engage in penetration testing. Basically, the idea is to have a tester to act like a hacker and attempt to gain access to your service/data. The importance of this cannot be over-emphasized. Afterwards, a test report that will identify weaknesses, and outline what is going to be done to mitigate them should be shared with you.

Outside Vendors

If you will make use of outside vendors as part of your company practice, what elements of your app will be developed to limit their access to your most sensitive data? What boundaries will be in place to control access?

Scaling Issues

As a fintech startup scales, it is bound to be establishing a growing number of links with systems of traditional providers. A major source of cyber vulnerability lies within the interfaces between systems. A part of fintech app development is scrutiny in testing as interfaces emerge. This will require an ongoing relationship with the developer/team that originally built your app.

Be certain that you will be dealing with a diligent team that understands the security issues involved with fintech interfaces. You need an app that can scale, and you need a development team that can accomplish that for you.

Looking for the Right Development Team

Cyber-attacks on the fintech industry have become so normal that the FBI is telling such companies that it is no longer an “if” situation but a “when” situation. One of the biggest hacks in recent times was the theft of $81M from the Central Bank of Bangladesh – a company that uses software from SWIFT financial platform – a platform that is used quite commonly. And recent attacks on startups and applications to retrieve financial data from repositories should tell anyone who wants to build a secure fintech app one thing – getting to market rapidly is a secondary goal. The first goal must be security.

Security comes from two vantage points – the architecture of the app, along with the testing and long-term support; and what you do as a business owner to support the security that has been built for you.

As you discuss your app with potential developers, here are the key questions to ask:

1. How long has the development team been developing fintech apps? Who could you contact to get a reference?
2. As architecture is being developed, do they review their code and the features to fulfill your security requirements?
3. While no product can claim to be 100% secure, encryption for data protection is critical. It is somewhat of a myth that encryption will slow your app down. If that is something that bothers you, then, in fact, encryption can be run on a separate server, if necessary. How will the developer ensure encryption without compromising access or speed? Encryption is easy – but make sure that there is a set agreement on what should be encrypted and how access to the encryption keys is provided. Generally speaking, each entry in your database should be encrypted.
4. How do they perform security assessments? This should involve penetration testing with a skilled expert acting as a hacker.
5. As you scale up and establish collaboration with other companies/providers, can they assess the security risks of interfaces and address any issues?
6. Can they guarantee rapid and efficient bug-fixing? Are there monitoring tools built in? And once the code is fixed, how do they retest it?

Don’t Undermine Your Own Responsibility

Whether your fintech application is for personal finance, banking transactions, lending, crowdfunding, or something else, you must bear your part of the collaborative effort:

1. Set up a regular communication schedule with the developer/team, and don’t miss those meetings.
2. Ask questions when you don’t understand something.
3. Assign one team member to be in charge of the in-house security protocols and to contact the developers immediately if issues arise. If your team is small, that person may be you.

Remember, you want to work with developers who see you as a part of the development team from start to finish and beyond. You need to be an active member of that team.

If your fintech app idea has “jelled” in your head, and you are clear on what features and security you need, it is time to talk with Romexsoft. We have been building fintech apps for over 10 years and would be happy to discuss the transformation of your idea into a great, secure product.

Written by Romexsoft on June 15, 2017 (edited 2020)