Author Topic: How to Perform Audit of Online Banking and Other Electronic Payment Applications  (Read 497 times)

Dera24c

  • Newbie
  • *
  • Posts: 3
Financial technology (fintech) applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. The introduction of Online Banking application (a.k.a. internet banking application) brought about easy and convenient access to banking services and solutions that would have been done physically in the banking halls. Some of such services available/accessible via Online Banking app are self account to account funds transfer, funds transfer within same bank (intrabank transfer), funds transfer between two different banks (interbank transfer), Account Balance inquiry, Bills and utility Payment (e.g. electricity/energy bills, water bills, cable tv bills, govt tax payment, etc.), airtime and gsm subscription recharge, international funds transfer via SWIFT platform, cheque/check book requisition, ATM/debit card requisition, ATM/debit PIN issuance and reset, credit card requisition and PIN reset, hard/soft token (2nd factor authentication) request and reset, loans/facility request, appraisal and disbursement, among other services. Accessing these services via Online Banking or its mobile banking equivalent is critical to the survive of the business and rendering of 24/7 service with the convenience it provide to customers.

Would you imagine where these applications and solutions are not available/accessible and what will become of banking of today and how terrible banking service would have been? Online Banking and mobile banking applications have led to the decongestion of banking halls of today. Customers, from the comfort of their homes, offices or on the go can access banking services and do their transactions without having any interface with their banks. While this solutions provided a lot of convenience and flexibility to customers, it also presented lots of risk both to the banks and their customers, which if not check could lead to loss of funds and brand erosion. The greatest risk presented by Online Banking and Mobile Banking applications are the risk of confidentiality, integrity and availability (CIA). Because the solutions are available on the internet and mobile phones, they could easily be compromised by hackers with malicious intentions where the solutions are not hardened with appropriate security controls and defense techniques. Therefore, it is important that the solutions are reviewed/audited in line with the organization's information security policies, best practice and regulatory requirements to forestall any compromise and protect both the bank and their customers from financial losses and reputational damage.

To ensure a successful audit of Online Banking or Mobile Payment applications, the audit team must first develop an Audit Program - http://oxleyconsults.com.ng/audit/audit-programs/ebanking-payment-program/ where the objectives and scope of the audit are defined. The audit program also identifies the inherent risk associated with the application, existing controls in place to mitigate the risk and test procedures to be performed to confirm that the controls in place are able to address the risk. Where controls are inadequate, the residual risk are identified and communicated to management for action. New and emerging risk can also be identified during the audit and form part of the audit findings, which will eventually feed into the risk register of the organization to enable tracking of the risk.

Highlighted below are some of the areas of the application and IT infrastructure to be reviewed to confirm that controls are adequate or otherwise for the safe operation of the Online Banking application in addition to things to look out for in the course of auditing.

1. Application Security Review: Here, the application controls are reviewed in line with business rules set by management to drive the applications. Such business rules could be transaction limits (daily, weekly or monthly limits) for individuals and corporates, minimum authentication information (e.g. password, security questions and answers, geo tagging control, token/two factor authentication or One time password), etc. The functional requirement of the application are validated during the audit to confirm that the application is meeting the need of customers and other stakeholders. The applicable fees and deductions setup on the system are validated to ensure that customers are neither overcharged or undercharged on applicable transactions fees, which is a major revenue source for the financial institution. Given that Online Banking application does not function in isolation without integration with the core banking application of the financial institution, the interface through which the Online Banking application is integrated with core banking application most be reviewed to ensure that it complies with standard Service Oriented Architecture (SOA) web service integration best practice. The Audit team must also ensure that valid digital certificate signed by appropriate Certificate Authority (CA) are deployed on the web client interface of the Online Banking and Mobile Banking application for end-to-end encryption of transactions as well as communication/data exchange at all levels of the application.

2. Database Security Review: Here, the database controls are reviewed in line with baseline security configuration of the DMBS in use. Where Oracle, Microsoft SQL (MSSQL), Sybase, PostgreSQL, MySQL or other databases are used, applicable database security baselines - http://oxleyconsults.com.ng/audit/audit-programs/ are used to verify that the database security settings and controls are such that will ensure security of the database. The following general database controls should be looked at.

  • Users granted access to the database either locally or via the active directory (AD) are authorized and have need for such access.
  • Access must be on the need-to-do basis (i.e. least privilege principle for access) and access privileges must be based on job function.
  • Super users on the database must be identified to ensure that their access are authorized and required for their function.
  • All Service accounts on the database must be accounted for and their use must be verified to prevent unauthorized access or access creep.
  • Users must be given uniquely identifiable ids and passwords with which to access the database to ensure accountability and non-repudiation.
  • Password rules set for the database must be in line with the organization's chosen password policy (e.g. complexity requirement, length, reuse, expiration, lockout, etc.) to ensure use of strong passwords.
  • Database audit trail/log are activated and backed up externally for retention and use when needed.
  • Parameterization of the database is such that will ensure confidentiality, integrity and availability of the database.
  • Database backup are automatically scheduled in line with the recovery point object (RPO) and recovery time objective (RTO) of application data.
  • User access to the database are regularly reviewed for adequacy and relevant and exceptions escalated for management action.

3. Operating Systems (OS) Security Review: Here, the Online Banking Application Servers are reviewed for adequacy. Depending on the architecture of the application, the Online Banking app must have web servers (IIS, Apache or TomCat), Application Servers and Database Server physically and logically separated from each other for security purposes. Depending on the OS version or platform that the application is running on, applicable security baseline requirements for Windows, LINUX or UNIX (AIX/SOLARIS/HP) servers can be used to review the appropriateness of the servers.
For audit/security review checklists of various OS platforms, see below

                                 
Usually the web server is hosted in the DMZ section within the perimeter network, just behind the frontend firewall. This is to ensure easy and secured access of the client/web side of the Online Banking application by users on the internet while the application and database servers are located within the data center server farm configured within a specific/secured VLAN to protect it from being compromised by hackers. Of course, the data center server farm must be behind another firewall (a.k.a. backend firewall) and protected again with additional firewall (a.k.a. data center firewall). This layered security approach is to ensure adequate security at various levels of the network to prevent security breaches.

4. Logical Access Controls Review: Review of access of users who carry out admin and support functions on the Online Banking application and database to ensure that such access are still valid and relevant for their job functions. All disengaged staff (ex-staff) of the organization who perform admin or support functions on the Online Banking Application must be disabled/deactivated on the application to prevent unauthorized access. Also, support staff members who are on vacation/leave or re-assignment/redeployment to other functions must be disabled from the application. A procedure for access review must be put in place to ensure regular review of users' access to the application and invalid access promptly deleted to prevent unauthorized access. Also access logs or audit trails such as, login audit trail (successful/failed/attempted), logout audit trail, activity audit trail must be captured to aid in the investigation of security breaches in the application when the need arise. Also, IP addresses or hostnames from where users and other support personnel (administrators) access the application from must be captured for audit trail.

5. Password Security Review:The setting and use of password in the application must be easy and conform to the organization's adopted password policy. Password requirement such as, password length (e.g. minimum of 8 characters), alphanumeric and complexity requirement must be met, password reuse, ageing and lockout controls must be implemented as appropriate. This is to ensure that users are made to conform to the organization's password policy while selecting password to guarantee strong passwords.

6. Data Integrity:The development, test and live environments of the Online Banking application must be physically and logically separated (installed using different IP addresses) to prevent compromise and ensure segregation of duties among the operations, support and database teams. Application support function must be separated from database admin function on the application while user access management function must not be left with the operators to manage. Also, live data must not be used as test data in the test environment without obfuscation to prevent data leaks in the test environment since test environment are known to be open to vendors and third party employees and security is not always emphasized on the test area. Confidential customer information such as debit or credit card PAN and other critical data must be encrypted in the database when stored and while in transit in line with PCIDSS requirement.

7. Redundancy: The architecture adopted for Online Banking or electronic payment application being audited should be such that will ensure high availability for the application. Due to high volume of transactions witnessed on Online Banking application, the architecture should ensure high processing capacity by building redundancy into the application. To be able to handle high volume of requests/transactions from online users, the web server should be load balanced among say 3 to 4 servers (all virtual servers). Load balancing is where each of the servers are connected in a Mesh topology for even distribution of traffic or load on the application in a manner that unavailability of any of the servers will not bring about downtime of the application and will not be noticed by the application users. Same goes for the application server, which should be load balanced among say 3 to 4 servers (all virtual) connected in mesh topology. The live database can running on 2 servers that are in active-active replication (i.e. both servers are in sync with each other and update themselves in real-time such that at any given point in time, they are holding exactly the same level of data).

8. Business Continuity Management: Given the importance of the Online Banking and mobile banking application to the financial institution in delivering financial service to customers, the application must be part of the institution's business continuity plan. As such, the application must be recoverable in the institution's disaster recovery (DR) hot site. Hence, the application's infrastructure (servers) must be available at the DR site and an active replication established between the main processing facility and the DR site. The application should also be scheduled for testing as part of the institution's disaster recoverability testing plan where critical services, solutions and applications identified during the business impact analysis (BIA) assessment of the institution are periodically tested to ensure their recoverability in the event of disaster or service disruption. Evidence of such recoverability test must be requested and reviewed by the audit team for their adequacy. Lessons drawn from such test must be captured, internalized and used as a basis to improve on future tests while reports are sent to management accordingly. A disaster recovery procedure/plan should be developed for the Online Banking application and circulated among stakeholders for use during emergency.


Nwabueze Ohia
Tech Blogger and Self Publishing Author

Will appreciate your questions, comments and contributions to this post. For sponsorship, speaking opportunity and training bookings, please Contact US at  >>> http://oxleyconsults.com.ng/contact-us/ or Send us an email at info@oxleyconsults.com.ng. Remember that you need to first register and become a forum member before you can post a comment.
« Last Edit: March 13, 2018, 01:09:16 PM by Dera24c »