In the rapidly evolving world of financial technology, where digital transactions and innovative solutions drive the future of finance, cybersecurity stands as both a guardian and a potential weak link.
A recent report by SecurityScorecard, a firm specializing in supply chain detection and response, sheds light on the precarious balance fintech companies maintain between robust internal controls and vulnerabilities in their external supply chains.
The report, titled “Defending the Financial Supply Chain: Strengths and Vulnerabilities in Top Fintech Companies,” delves into the cybersecurity posture of 250 leading fintech firms.
It reveals a striking statistic: a significant 41.8 percent of breaches impacting these companies originated from third-party vendors.
Moreover, fourth-party exposures—risks introduced through the vendors’ own subcontractors—accounted for an additional 11.9 percent, a figure more than double the global average.
This revelation brings to light a crucial concern: while fintech firms may bolster their internal defenses, their reliance on a complex web of third-party services and technologies presents a formidable challenge.
As Ryan Sherstobitoff, Senior Vice President of SecurityScorecard’s STRIKE Threat Research and Intelligence Unit, succinctly puts it, “Fintech companies anchor global finance, but one exposed vendor can take down critical infrastructure.”
The implications are profound.
In the interconnected world of fintech, third-party breaches are not mere anomalies—they are indicative of structural vulnerabilities that can lead to operational disruptions across payment systems, digital asset platforms, and core financial infrastructure.
The report highlights that technology products and services were linked to a staggering 63.9 percent of third-party breaches.
Among these, file transfer software and cloud platforms were the most frequently exploited points of compromise.
Despite these vulnerabilities, the report does offer a silver lining.
The fintech industry, as a whole, boasts the strongest security posture of any sector analyzed, with a median score of 90.
Impressively, 55.6 percent of fintech companies earned an ‘A’ rating for their cybersecurity measures.
This indicates a robust foundational security framework, yet the lurking threat of third-party breaches necessitates a vigilant and proactive approach to cybersecurity.
To navigate these choppy waters, SecurityScorecard’s STRIKE team has put forth a series of recommendations aimed at fortifying the fintech ecosystem against cyber threats.
At the forefront is the imperative to strengthen third- and fourth-party risk oversight.
Rather than basing vendor assessments solely on financial metrics or business value, fintech companies are urged to tier their vendors based on exposure and breach history.
This nuanced approach can mitigate cascading risks stemming from fourth-party breaches.
Another crucial recommendation involves securing shared infrastructure and technical enablers.
Given that file transfer software, cloud storage platforms, and customer communication tools are common vectors for breaches, fintech firms must conduct regular audits of these integrations.
Partners should be required to demonstrate secure implementation practices to prevent vulnerabilities.
Furthermore, addressing application security and DNS gaps is paramount.
With nearly half of fintechs scoring lowest in application security, the report underscores the need to rectify unsafe redirect chains, misconfigured storage, and missing Sender Policy Framework (SPF) records.
Prioritizing the remediation of these foundational weaknesses, particularly in customer-facing assets, is essential.
The report also highlights the significance of enforcing strong credential protections.
Credential stuffing campaigns and typosquatting attacks have impacted a majority of firms.
Implementing multi-factor authentication (MFA), monitoring for reused credentials, and taking down spoofed domains are vital measures to protect users and prevent cross-platform compromise.
Lastly, the report advocates treating repeat breaches as a leading risk signal.
Companies with multiple breaches accounted for the majority of total incidents.
Vendors with a history of breaches, especially those with known third-party exposures, should be subject to enhanced scrutiny during onboarding and renewals.
In conclusion, while the fintech industry is at the forefront of cybersecurity strength, the interconnected nature of its operations necessitates a vigilant approach to managing third-party risks.
As the digital landscape continues to evolve, fintech companies must remain steadfast in their commitment to safeguarding their operations and, by extension, the global financial infrastructure they underpin.
The insights from SecurityScorecard’s report serve as a clarion call for the industry to refine its strategies and reinforce its defenses in the face of ever-evolving cyber threats.
New research highlights how opportunistic infostealer malware is exploiting browser-based password managers to compromise corporate credentials at an unprecedented scale.
A new strategic partnership aims to overhaul space-based encryption hardware to support the high-speed data demands of modern military satellite networks.
Commercial data networks have become a critical vulnerability for military personnel as foreign adversaries exploit real-time bidding for intelligence.
