Security Holes Common In Customer-Facing Bank Apps
CRASH Report reveals that banks fall behind in making their customer-facing applications structurally sound and secure.
New York-based software analysis company Cast Software recently released its second annual CRASH (Cast Report on Application Software Health) report, a study of the structural quality--the engineering soundness of the architecture and coding--of business application software. The study examined 745 enterprise software applications in 160 organizations across industries.
For the banking industry, the most significant finding is that while most legacy core banking applications tend to be secure, the newer, customer-facing financial apps tend to have more structural flaws that could cause operational problems such as outages, performance degradation, breaches by unauthorized users, and data corruption.
Bill Curtis, senior VP at Cast Software and co-author of the CRASH report, said that there are a number of reasons for the disparity of structural soundness between older, back-end applications and newer, customer-facing apps. "These large legacy applications usually sit on mainframes and are not exposed to the Web. It's the exposure to the Internet that opens the doors for hackers to come in," he explained, adding, "For 30 or 40 years the IT people at banks have been trying to eliminate all of the security holes in these legacy applications. They've really been working hard over a long period of time and have gotten common weaknesses out of the apps."
The programming language used to write the application also makes a difference in its structural soundness, according to Curtis. He said that many financial core applications have been written in the mature COBOL programming language, while customer-facing apps are being written in newer languages that tend to be less secure.
On top of that, he noted, they're often built in several computer languages. "While developers often know a few languages very well, they don't know all of them," he says. "That makes it difficult to look at the entire app to make sure it's structurally sound."
The integration that modern, customer-facing apps require to operate introduces yet another challenge to achieving structural soundness, noted Curtis. "In the old days, we used to just build an application," he said. "Now that application interacts with a lot of other applications, which continues to create new ways to make mistakes. We're constantly learning about new problems."
The effort to achieve and maintain compliance with Sarbanes-Oxley requirements remains one of the primary drivers behind many IT security initiatives. In our Security Via SOX Compliance report, we share 10 best practices to meet SOX security-related requirements and help ensure you'll pass your next compliance audit. (Free registration required.)
Dark Reading Tech Digest, Dec. 19, 2014Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Published: 2014-12-28 CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.
Published: 2014-12-28 Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.
Published: 2014-12-28 The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...
Published: 2014-12-28 IBM Rational AppScan Source 8.0 through 184.108.40.206 and 8.5 through 220.127.116.11 and Security AppScan Source 8.6 through 18.104.22.168, 8.7 through 22.214.171.124, 8.8, 9.0 through 126.96.36.199, and 9.0.1 allow local users to obtain sensitive credential information by reading installation logs.
Published: 2014-12-28 IBM WebSphere Service Registry and Repository (WSRR) 8.5 before 188.8.131.52, when Chrome and WebSEAL are used, does not properly process ServiceRegistryDashboard logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.