In 2021, the IMF said it was “not a question of if, but when” a cyberattack threatens financial stability; this statement isn’t surprising when we consider the state of security in banking and financial technology today. According to NowSecure’s app security tracker, as of May 2024, more than half of observed popular banking and finance mobile apps could be taken over by an attacker using known vulnerabilities.
Cybercrime is a huge threat, and it’s only getting worse. Damages are expected to rise from $9.2 trillion USD in 2024 to $13.8 trillion by 2028 — that’s more than the 2023 GDP of Germany, India, Russia, and Brazil combined. In light of the increasing threats, world governments are responding with initiatives to tighten cybersecurity regulations in the financial sector, and financial institutions need to be ready.
Any security-conscious financial institution (which should be all of them) should be building out their cybersecurity tech stack, both to counter threats today and to prepare for regulations to come. One tool that belongs in every institution’s tech stack is software composition analysis (SCA), which scans your software (in-house and vendor) for known vulnerabilities. Here’s why.
1. SCA protects you from vulnerabilities in your systems
Even if you’re serving tens of millions of customers and managing billions of dollars in assets, your company isn’t a hacker’s biggest target - but your systems might be. That’s because the easiest way for any malicious actor to affect you isn’t by attacking you directly—it’s by exploiting the vulnerabilities in the tools you (and many other financial institutions) already use. And unfortunately, those vulnerabilities aren’t difficult to find.
96% of software applications have at least one open-source component. This freely available code forms the building blocks for most of the world’s largest software programs because it makes the entire software development process faster. Just like most builders don’t make their own bricks or cut their own lumber, most software companies don’t code everything from scratch. Instead, they rely on pre-built components (open-source) because it enables them to focus on the features and functionalities their customers need and get them to market faster.
The problem is that open-source code libraries aren’t always secure, and there’s no real system in place to monitor for vulnerabilities. Developers in the open-source community do their best, continuously flagging vulnerabilities as they find them, but some open-source authors are more vigilant than others. According to Sonatype’s 9th annual State of the Software Supply Chain, over 18 percent of Java and JavaScript open-source projects maintained in 2022 were no longer maintained as of September 2023. So, while one code library might be updated regularly, another might go years without any updates (or never get updated again!).
For security-conscious financial institutions (which, again, should be all of them), official databases like CISA’s “Known Exploited Vulnerabilities Catalog” enable teams to look up open-source vulnerabilities and compare to the components identified in their SBOMs to see where their code is vulnerable.
However, while information about these vulnerabilities is publicly available, it doesn’t mean that every software company addresses them. Updating software to remediate vulnerabilities takes time, and security measures aren’t always prioritized over new feature releases. In a 2021 IBM Security™ study, 59% of respondents cited delays associated with patching vulnerabilities as a reason their organizations hadn’t become more resilient to known threats.
In other words, even when vulnerabilities are known, they tend to linger, which is why the software supply chain is such an attractive target to hackers. Why attack one financial institution directly, when exploiting known vulnerabilities in a software offers an easy way into hundreds or thousands of financial institutions all using the same software? It’s a numbers game, and the latter offers more bang for your buck - literally!
SCA tools help you monitor and remediate these vulnerabilities
Financial institutions can protect themselves against these transitive vulnerabilities by using an advanced SCA tool, like MergeBase, to continuously monitor their software, including any third-party components.
MergeBase, for example, enables teams to scan applications to detect vulnerabilities, licensing issues, or outdated dependencies that could pose security risks (or already are). If issues are found, the system generates alerts, classifies the risk on the universal scale of 1-10, and provides Developer Guidance, offering tailored advice on what to do about each issue detected.
The custom policy feature also allows you to dictate the type of alert that is generated. For example, you can set a policy that anything over 9.3 is classified as a “violation”, but 8.5-9.2 is a “warning”; this helps you to address the more critical issues first and comply with your company’s known vulnerability policy that dictates remediation timelines based on risk levels.
You can also import or create software bill of materials (SBOMs) for each piece of software to gain visibility on the components used within an application. This allows you to see how secure your existing software vendors’ products are—and it helps you evaluate the security of hopeful vendors.
2. SCA helps you stay ahead of the compliance game.
Cybersecurity is entering its legislative heyday: the U.S government published the National Cybersecurity Strategy in March 2023, which calls for two significant shifts in the world of software development:
-
Rebalancing cybersecurity responsibilities to industries — Rather than the full effects of cybercrime being born by citizens, the U.S. government aims to shift the onus of cybersecurity to critical industries (including financial institutions) and the technology companies selling into them.
-
Incentivizing long-term investments in cybersecurity — Historically, technology companies have focused most of their efforts on innovation because more advanced products meant more customers and bigger deals. With new feature rollouts taking priority, security updates often took a backseat. The U.S. government aims to change this focus by using regulations to push both tech companies and the industries they sell into to devote more resources to securing this technology and maintaining the security of the applications long-term.
It’s not just the U.S. that’s imposing cybersecurity regulations— Canada and the European Union have both put forth initiatives pushing technology companies to provide SBOMs when selling into critical industries. And this is likely just the beginning.
SCA tools help you prepare for future regulations
As cybersecurity regulations within the financial industry increase, businesses will need to devote more resources to compliance. It’s wise to start investing in the tools that can help your team stay ahead of these shifts now rather than playing catch-up to your competitors when the regulations tighten (or the regulatory bodies come knocking!).
As we’ve seen with the new FDA regulations for medical device manufacturers, companies must start detailing how they will monitor and identify vulnerabilities and address them in a reasonable time post-market. It’s likely the financial service industry will implement similar regulations, and software composition analysis is an easy way to satisfy these conditions.
An advanced SCA tool shows your dedication to improving security (assuming you act on the reports the tool generates) and is an essential tool to help your team keep your technology compliant with cybersecurity legislation as it evolves.
3. SCA helps you keep your own technology secure
Fintech companies aside, most banks, credit unions, investment firms, and the like weren’t started as technology companies. However, to adapt to how the modern consumer wants to access financial services, they have had to create apps and other software for their customers and employees to use.
This proprietary technology, whether coded entirely from scratch (unlikely, as we’ve seen) or relying heavily on open-source code, must also be secured against transitive vulnerabilities like any technology you’re paying for from vendors.
An advanced SCA tool can go a long way in keeping your apps, portals, and other proprietary technology secure. For example, MergeBase allows you to generate your own SBOMs for the tools you create and gives you an overview of known vulnerabilities in any third-party code used in your software. Beyond this, Mergebase provides your developers with best-in-class guidance, making it easy for developers to see available updates and check them for compatibility.
Prepare for compliance in the financial industry with MergeBase SCA
As cybersecurity regulation in the financial industry becomes more sophisticated, institutions will need more advanced tools to keep up. Investing in a powerful SCA now gives you the opportunity to get ahead of compliance trends and protect your stakeholders from the growing threat of cybercrime. It also shows a commitment to security, which may help you stand out against competitors who are slower to adapt.
If you’re looking for an advanced SCA to use in your business, MergeBase can help. Our system equips you to monitor transitive vulnerabilities like any good SCA should, but we go above and beyond with:
-
Unmatched accuracy — False positives destroy productivity and morale on DevSecOps teams, yet they’re all too common in the SCA world. MergeBase is built for accuracy, and our reports consistently return fewer false positives than the other big SCA players. (It’s one of the main reasons people switch to us!)
-
Autopatching — Not only does our tool provide information on each patch’s risks, compatibility, and popularity, but MergeBase can automatically implement safe patches for you—so your product and security teams can make informed decisions and move on.
-
Comprehensive SBOM support — With MergeBase, you can import and export multiple SBOM formats, all of which clearly delineate dependency relationships between the components and subcomponents in your application. Plus, MergeBase’s UI lets you visually navigate your SBOM to see how your third-party code is nested and where any given vulnerability lies.
-
Runtime protection — MergeBase is built on a Shift Left Security philosophy, protecting your build pipeline and runtime, integrating with your repository, and allowing for both container and binary scanning—so you’re always aware of known vulnerabilities in your third-party code, whether open source or licensed.
To see MergeBase in action and discover firsthand how our advanced tool can protect your organization against vulnerabilities, start your free trial today
Prefer to talk to an expert first? Connect with one of our engineers here.
