Connectedness and insights are notable cornerstones of our ever-burgeoning digital society. Both the users of mobile apps as well as the enterprises that run them benefit endlessly from the two-way communications that enable services to be offered, improved upon, and expanded.
In this spirit of connectedness, businesses such as financial institutions should no longer be hesitant to proactively and consistently monitor what their apps are doing on unmanaged consumer or user devices.
Why banks need to take mobile app monitoring more seriously
Obviously, banks have an enormous responsibility to comply with laws and regulations pertaining to privacy and customer information. Self-monitoring of an app for attacks is not the same as monitoring a managed device or monitoring user activities. Observations are based on whitelisting and ignoring all legitimate actions, which is an important distinction.
And to reiterate that distinction further, employer-owned smartphones, for example, can be fully monitored with no privacy expected. These monitoring solutions need to have a holistic view to compare all activities to known attack profiles.
A bank that simply offers an app for download can confidently monitor that instance’s actions that belong to the category of attacking the app without entering the realm of private information or privacy concerns. There’s no “big brother.” Instead, they’re simply looking at their own offering, limited to illegitimate patterns of use, not data outside of it. All collected data is focused and anonymized, period.
And the benefits of gaining intelligence about what suspicious behavior apps are doing and when, etc., provide businesses with the ability to maintain a much more robust cybersecurity posture that can identify threats and remediate them before they cause much harm, if at all, to the app or their related enterprise. That’s only due to the connectedness of the mobile app ecosystem.
Many other industries and sectors have embraced mobile app monitoring to fulfill that need for the most protected and informed enterprise possible. From payment apps to retail apps and much more, they’re gaining the benefits of truly knowing their app’s activities minute by minute—even on an unmanaged device. There’s no reason a bank can’t enjoy the same benefits.
A bank’s typical concerns in terms of compliance and risk
All of the known compliance requirements and rules that have now been around for years likely drive the ongoing hesitancy surrounding banks connecting to each mobile app instance, let alone a third-party cybersecurity vendor. They’re also very used to holding things tight, and they don’t want to do anything that could potentially put them at the mercy of a security provider or other entity.
Top concerns often include:
Banks could potentially be concerned that the collected data from a cybersecurity solution would not be compliant. They may also be fearful that their users or customers will not supply the needed permissions.
But given the experience in countless other industries, permissions and data concerns have proven to not hamper enterprise or user privacy.
• Loss of control
Banks may not initially feel it’s safe, for example, to provide a third-party cybersecurity vendor with their Android Package during the process of securing their app. However, that turns into a myth when it’s pointed out that banks upload their unprotected apps to app stores all the time.
There’s no difference other than the fact that by providing their APK to their security vendor, they’re becoming more secure, unlike their decision to provide the unsecured app to the public or app store.
Banks don’t want to create a scenario where any cybersecurity measures they employ could be used against them by competitors or bad actors. Since all data is anonymized and enjoys solid separation, this isn’t a concern with solutions such as Verimatrix XTD. Additionally, all threat countermeasures available to the bank stay with the bank and remain under its control.
The above perceptions rank among the top overarching hesitations that still seem to lead to offering so many unprotected banking apps today.
Banks should use Extended Threat Defense (XTD) solutions for mobile app monitoring
Most of today’s banks are missing out on the intelligence and proactiveness associated with monitoring their actual apps. After all, through this monitoring, banks are often able to receive very early indications of upcoming threats to their apps and prepare accordingly.
The irony is that most banks use extended detection and response, or XDR, services from trusted vendors like Palo Alto Networks and CrowdStrike that provide holistic protection against cyberattacks, unauthorized access, and misuse across all data sources.
Other banks use endpoint detection and response (EDR) solutions from vendors such as SentinelOne and Sophos, which are endpoint security solutions that monitor end-user devices to detect and respond to cyber threats. Both EDR and XDR vendors work with the world’s biggest banks to gather endpoint and other telemetry data and monitor/share this data with their customers. This underlines how today’s modern cybersecurity solutions work.
Banks can and should be in the driver’s seat when it comes to the security posture of their mobile apps. But in-app telemetry at the device level and the sharing of threat intelligence are the directions the app protection and mobile threat defense industry are moving in.
By taking action early and consistently, banks no longer have to wait until a lab identifies a new wave of threats to a mobile app that then requires a new signature-based scan to be implemented.
Extended Threat Defense solutions like Verimatrix XTD function just like leading XDR and EDR solutions on the market, bringing trusted protection, detection, response, and prediction capabilities to the mobile app ecosystem for the benefit of banks and industries beyond.