There are some startling statistics regarding the security of fintech startups. Despite being well-funded, 98 percent of the world’s top 100 fintech startups are vulnerable to web and mobile application attacks. Another study showed that 100 percent of fintech startups have security, privacy and compliance issues relating to abandoned or forgotten web applications, application program interfaces (APIs), and subdomains.
Investors in fintech companies may also want to review a company’s procedures on data protection and cybersecurity before investing, which is even more motivation for fintech startups to have cybersecurity at the forefront of their business strategy.
Despite its rapid growth, security and privacy are the top threats to the continued rise of fintech companies. Fintech companies often have access to highly confidential information on individuals and enterprises – social security numbers, credit card information, net worth, income, and much more. As this data becomes increasingly available in digital formats, the data is more susceptible to security breaches.
Both professional hacking and amateur hackers alike have had their signs set on the valuable financial data that resides at banks, brokerages, financial advisory firms, and other financial firms. They know that one successful breach is all they need for a substantial payday. The rise of fintech has only given hackers more avenues and accessibility to cash out on financial data, making startups one of the most vulnerable industry verticals to cyber threats.
Fintech regulations are not black and white – there’s a lot of gray space in this industry. Regulators are working to develop rules that will govern the fintech space, but there is uncertainty as to precisely how the U.S. regulation of fintech will evolve. Many of the regulations that apply to these types of platforms are still being developed, which makes it difficult for many early-stage fintech startups to know what is expected of them in terms of compliance. As you can imagine, this creates uncertainty around the best way to safeguard fintech companies from cyber threats.
Being able to protect customers from breaches and defend customer security is an important selling point for most fintech startups, furthering the need to proactively meet any compliance regulations that are in place. Fintech startups must be nimble in their compliance strategies and always stay up to date (and follow!) the latest rulings. Since this can get quite complex, having a seasoned securities lawyer on the team is an efficient way to stay on top of this. Here are some regulations to consider:
- FINRA
- NYS-DFS part 500
- PCI-DSS
- Recent updates/proposals relating to Gram Leach Billey Act
- Recent broad-reaching regulations such as GDPR and CCPA
Fintech implementation interfaces with banks, financial service providers and fintech firms, which increases cybersecurity risk as data elements travel through these interfaces. The following are some of the most significant risks:
Malware attacks: Easily exploitable vulnerabilities are prevalent, and hackers take advantage of these vulnerabilities by launching malware attacks.
Data leakages: Automated systems that interface with fintech service providers are particularly vulnerable to sensitive financial data leaks (payment card info, user credentials, etc.)
Cloud environment security risk: Payment gateways, digital wallets, and secure online payments are some of the niche cloud computing services provided in a fintech ecosystem. Lack of adequate cloud security measures can result in compromise and corruption of this sensitive information.
Availability of critical systems: Any system outage can have a catastrophic impact on fintech companies – 99.999% uptime isn’t sufficient enough. Aside from the cyber risks, downtime can cost the company millions, especially when markets are open.
Application security risk: Applications are always preferable attack vectors due to the vulnerabilities that are hidden in their design and code.
The frequency and severity of the threats targeting fintech startups require the highest possible level of preparedness. This means a cybersecurity strategy that combines up-to-minute know-how, the latest tools, and an experienced cybersecurity team.
It’s essential to utilize governance tools like Data Loss Prevention, File Level Encryption, and other integrity tools in the strategy. State of the art SIEM tools also provide tremendous value – SolarWinds Security Event Manager & ManageEngine EventLog Analyzers are two that can be tested out with a free trial. Frameworks like NIST-CSF and the NIST-RMF should also be taken advantage of, as they are nimble and easily adaptive frameworks to implement for a specific business.
The most valuable cybersecurity defense is an experienced team of vigilant defenders with the ability to protect your data and reputation. Fintech startups that neglect to establish a full-scale robust cybersecurity solution will continue to be at risk. Sometimes, hiring an in-house cybersecurity expert isn’t financially realistic. The best way for fintech startups to defend themselves against the onslaught of cybercrime is to partner with a managed security service provider (MSSP).
For fintech startups that think they already have a sound cybersecurity strategy in place, they can utilize a third-party to perform Red Team assessments to test the viability of their cybersecurity programs without the benefit/blinders of inside knowledge. Red Team assessments will test your program’s capabilities against attack scenarios and help to fill the cracks in the current strategy.
Fintech startups are increasingly vulnerable to cyber threats. Until the industry has clear regulations, startup founders need to take the initiative to understand the associated cyber risks and then create a clear plan to safeguard their technology, mitigate the risks, and meet compliance regulations.