Secure bank link won’t protect an exposed NBFC, warns cybersecurity expert Shastry - The Times of India
Cybersecurity expert Pendyala Krishna Shastry warns that secure bank connections do not protect non-banking financial companies from fraudulent payment attacks if their own systems are compromised.
Hyderabad: A secure bank connection does not guarantee protection against fraudulent payments if attackers compromise the finance company initiating them. Recent cyber incidents involving non-banking financial companies (NBFCs) have highlighted weaknesses in their infrastructure, access controls and transaction monitoring, according to cybersecurity expert and Interpol trainer Pendyala Krishna Shastry.
Connecting to a bank's secure API does not automatically make an NBFC's own environment secure. The responsibility for protecting its infrastructure, applications, identities and transaction initiation processes rests with the NBFC.
Attack sequence
Shastry explained how attackers, potentially including the group identified as 'Crafty Falcon,' target financial institutions. The attack sequence begins with gathering information about employees, technology and business processes. Attackers then exploit phishing emails, malicious links or vulnerabilities to gain access, deploy malware, steal credentials and move across loan origination systems and core banking platforms.
Security priorities
Shastry outlined six key security priorities for NBFCs: protecting APIs through mutual TLS, OAuth 2.0 and strong authentication; independently validating fund transfers; strengthening identity management with multi-factor authentication; conducting regular vulnerability assessments; implementing continuous monitoring for unusual activity; and establishing round-the-clock security monitoring with rapid response capabilities.
His central warning: securing the bank connection alone is insufficient; NBFCs must secure every system and permission involved in initiating payments to prevent fraudulent transactions and fund diversions to mule accounts.
Related
