Why Financial Services Need Security Testing
Financial institutions and fintech organizations operate technology environments that can include online banking platforms, payment systems, customer portals, APIs, cloud infrastructure, internal networks, and systems containing sensitive financial information.
Security requirements vary according to the organization’s activities, regulator, jurisdiction, contractual obligations, and technology environment.
For financial institutions subject to the FTC’s jurisdiction, the GLBA Safeguards Rule requires an information security program with administrative, technical, and physical safeguards and requires covered organizations to regularly monitor and test the effectiveness of safeguards. Where continuous monitoring is not implemented, the Rule provides for annual penetration testing and vulnerability assessments at least every six months, subject to the Rule’s applicability and requirements.
For other regulated financial institutions, supervisory expectations can depend on the applicable regulator and risk-management framework. FFIEC guidance recognizes penetration testing and vulnerability assessments as security-testing activities and states that the frequency and scope of penetration testing should be determined through the institution’s risk-assessment process.
Penetration testing can therefore provide useful technical evidence about whether selected security controls and systems withstand controlled attack scenarios.
Regulatory and Security Context
Financial services organizations may need to consider multiple requirements rather than relying on a single cybersecurity standard.
Depending on the organization, relevant considerations can include:
- GLBA and applicable Safeguards Rule requirements
- Federal or state regulatory expectations
- Contractual security requirements
- Payment card requirements where cardholder data is involved
- Internal risk-management policies
- Customer, partner, and third-party security requirements
The appropriate testing scope should be determined from the requirements that actually apply to the organization.
The FFIEC Information Security guidance describes penetration tests as tests designed to subject systems to real-world attack scenarios and recommends that management determine the appropriate level and types of testing based on the institution’s risk assessment and assurance needs.
What’s Covered in a Financial Services Penetration Test
Online Banking and Customer Portals
Customer-facing financial applications can be assessed for weaknesses involving authentication, authorization, session management, application functionality, and other relevant security controls.
Core Financial and Transaction Systems
Where authorized and technically appropriate, testing can evaluate systems involved in financial transactions, account management, data processing, and related business functions.
Testing should be carefully scoped to avoid unnecessary impact on sensitive or operationally critical systems.
Authentication and Access Controls
Testing can evaluate authentication mechanisms, authorization boundaries, session controls, and other access-management mechanisms.
This can help identify conditions that could allow inappropriate access to accounts, functions, or sensitive information.
API Security
Financial platforms often rely on APIs to connect applications, internal systems, partners, and third-party services.
Testing can assess API authentication, authorization, data access, input handling, and other relevant security controls.
See our API security testing service for dedicated API assessments.
Web Application Security
Web applications can be assessed for security weaknesses affecting customer portals, administrative platforms, account-management systems, and other internet-facing applications.
See our web application penetration testing service for dedicated application testing.
Internal Network Security
Internal network testing can help evaluate exposed services, access controls, segmentation, configuration weaknesses, and potential paths between systems within the authorized scope.
See our network penetration testing service for dedicated network assessments.
Cloud Environments
Cloud infrastructure supporting financial applications can be assessed according to the services, identities, configurations, applications, and architecture included in the engagement.
Where appropriate, cloud testing can complement application and API assessments.
See our cloud security testing service for dedicated cloud assessments.
Our Financial Services Penetration Testing Process
Scope and Authorization
The engagement begins by defining the systems, applications, networks, environments, and testing objectives included in the assessment.
Written authorization, exclusions, testing windows, communication procedures, and rules of engagement should be established before testing begins.
Environment Review
The assessment team reviews the relevant technology environment and identifies the systems and attack surfaces that correspond to the engagement objectives.
Particular attention can be given to sensitive applications, authentication systems, APIs, transaction-related systems, and externally exposed services.
Security Testing
Testing combines appropriate automated tools with manual assessment techniques within the authorized scope.
The methodology is adapted to the technology and business environment being assessed.
Finding Validation
Potential findings are reviewed and validated to reduce false positives and better understand their potential significance.
Reporting
The final report can include:
- Assessment scope
- Testing methodology
- Systems and applications assessed
- Identified security findings
- Severity or risk information
- Supporting evidence
- Potential business impact
- Remediation recommendations
Remediation and Retesting
Where included in the engagement, previously identified findings can be reviewed after remediation.
Retesting can help determine whether relevant security weaknesses have been addressed.
What You Receive
Depending on the agreed scope, deliverables can include:
- Executive summary
- Detailed technical findings
- Assessment scope and methodology
- Severity or risk information
- Affected systems or applications
- Supporting evidence
- Potential business and security impact
- Remediation recommendations
- Retesting results where included
The objective is to provide clear technical documentation that security teams and management can use to understand identified risks and prioritize remediation.
Testing Live Financial Systems
Penetration testing against production environments requires careful planning because financial systems may support critical operations.
Before testing begins, the engagement should establish appropriate testing windows, prohibited activities, escalation procedures, communication channels, and system-specific restrictions.
Where appropriate, staging or non-production environments can be considered for portions of an assessment.
The correct approach depends on the organization’s architecture, testing objectives, operational requirements, and risk tolerance.
Financial Services Penetration Testing and Risk Management
Penetration testing should form part of a broader security and risk-management program rather than operate as a standalone security measure.
FFIEC guidance states that the frequency and scope of penetration testing should be based on the level of assurance needed by the institution and determined through its risk-assessment process.
For organizations subject to the FTC Safeguards Rule, the applicable requirements also address regular monitoring and testing of safeguards, with provisions concerning continuous monitoring or periodic penetration testing and vulnerability assessments.
A vulnerability assessment can complement penetration testing by helping identify and prioritize known security weaknesses.
The applicable regulatory and contractual requirements should therefore be reviewed before determining the appropriate testing schedule.
Financial Services Penetration Testing and PCI DSS
Organizations that handle payment card data may also have obligations under PCI DSS.
PCI DSS requirements are distinct from broader financial-services cybersecurity requirements, so cardholder-data environments should be assessed according to the applicable PCI DSS scope and requirements.
For organizations specifically seeking cardholder-data security testing, see our PCI DSS penetration testing service.
Who May Benefit From Financial Services Security Testing?
Banks and Financial Institutions
Financial institutions can use authorized testing to evaluate applications, networks, authentication systems, APIs, and other technology within scope.
Fintech Companies
Fintech organizations may need to assess customer-facing applications, APIs, cloud infrastructure, transaction systems, and third-party integrations.
Payment and Financial Technology Providers
Organizations supporting payment or financial workflows can use security testing to identify weaknesses across relevant applications and infrastructure.
Investment and Wealth Management Platforms
Platforms handling financial accounts, customer information, and online services can use targeted application, API, network, and cloud assessments.
Financial Service Providers
Organizations providing financial products or services may use security testing as part of their broader cybersecurity and risk-management programs.
Frequently Asked Questions
Do Financial Institutions Have to Perform Penetration Testing?
The answer depends on the organization, regulator, and applicable requirements.
For financial institutions subject to the FTC’s Safeguards Rule, the Rule requires covered organizations to regularly monitor and test the effectiveness of safeguards. Where continuous monitoring is not implemented, the Rule specifies annual penetration testing and vulnerability assessments at least every six months.
Other financial institutions may be subject to different regulatory or supervisory requirements.
Does GLBA Require Penetration Testing?
The GLBA Safeguards Rule requires covered financial institutions under applicable FTC jurisdiction to maintain an information security program and regularly monitor and test safeguards.
Under the Rule, organizations that do not implement continuous monitoring must conduct annual penetration testing and vulnerability assessments at least every six months, including system-wide scans designed to test for publicly known security vulnerabilities.
The exact applicability of these provisions depends on whether the organization falls under the FTC’s jurisdiction and the circumstances described in the Rule.
How Often Should Financial Institutions Perform Penetration Testing?
There is no single frequency that applies to every financial institution.
FFIEC guidance states that penetration-testing frequency and scope should be determined based on the level of assurance needed and the institution’s risk-assessment process.
Specific regulations or contracts may impose additional requirements.
Can You Test Production Financial Systems?
Yes, where the systems are properly authorized and the engagement is designed to accommodate the operational risks involved.
Testing windows, prohibited activities, escalation procedures, and other rules should be established before testing begins.
Can You Test a Banking or Financial Application?
Yes, where the application is within the authorized scope.
Testing can evaluate relevant authentication, authorization, session management, application functionality, and other security controls.
Can You Test Financial APIs?
Yes.
APIs can be assessed for relevant authentication, authorization, data-access, input-handling, and other security weaknesses.
Can You Test Internal Financial Networks?
Yes, when included in the authorized scope.
Internal testing can assess network services, access controls, segmentation, configurations, and other relevant security weaknesses.
Can You Support Regulatory or Audit Reviews?
Penetration-testing documentation can provide technical evidence for internal security reviews, risk-management activities, and certain regulatory or third-party assessments.
However, a penetration test does not by itself establish regulatory compliance.
Do You Provide a Detailed Security Report?
Yes. Depending on the engagement, reporting can include findings, severity or risk information, supporting evidence, affected systems, and remediation recommendations.
Do You Provide Retesting?
Retesting can be included where agreed as part of the engagement to determine whether previously identified security weaknesses have been addressed.
How to Choose a Financial Services Penetration Testing Provider
Organizations should evaluate whether a provider can define clear testing boundaries, authorization requirements, methodology, reporting procedures, and rules of engagement before testing begins.
The provider should also understand the organization’s technology environment and applicable security requirements rather than treating every financial organization as having the same assessment needs.
For organizations seeking an authorized technical assessment, our penetration testing services provide a dedicated option.
Request a Financial Services Penetration Testing Assessment
Need to evaluate an online banking application, financial platform, API, internal network, or cloud environment?
Tell us about the systems involved, your security objectives, and the requirements that apply to your organization.
We can help define an authorized financial services penetration testing scope focused on the technology and risks that matter most.
Our cybersecurity consulting services can also help organizations define an appropriate technical assessment scope.
Confidential consultation · Authorized security testing · Professional reporting