Attacks on APIs and Web Applications Skyrocket by 257 per cent

Financial Services Review | Thursday, December 01, 2022

Managing the attack surface is one of modern security teams' most difficult challenges.

FREMONT, CA:One of the hardest tasks for modern security teams is managing the attack surface. Every single app and API in today's hybrid and multi-cloud systems is a potential target that fraudsters may and will exploit.

According to new research published today by CDN service provider Akamai Technologies Inc. (NASDAQ: AAAKAM), web application and API assaults against financial service institutions have increased by 257 per cent compared to last year.

Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.

The same study also discovered a 22 per cent increase in DDoS attacks against financial services institutions year over year and that threat actors are employing strategies in their phishing efforts to get around two-factor authentication systems.

API Attacks and the Growing Attack Surface

Not only has Akamai witnessed the rising tide of API assaults, but other vendors have as well. 41 per cent of firms experienced an API security event in the previous 12 months, with 63 per cent of those incidents including a data breach or data loss.

The fact that there is a significant attack surface of web apps and APIs that most security teams lack the resources or skills to defend is one of the primary causes of the large volume of API exploitation that targets businesses and financial sector institutions.

Businesses have shifted key infrastructure to APIs, and now fraudsters are after the money. The advising CISO at Akamai, Steve Winterfeld, added that APIs are additionally more recent and, frequently, lack the same level of maturity in security processes and controls, making them more vulnerable.

Finally, because they are made for automation, they are simpler to automate assaults against. These elements work together to make APIs a prime target for attackers. Consequently, CISOs must concentrate on them.

Working Toward API Security

Enterprises can take some actions to strengthen their defences against API-driven risks. Businesses must invest in tools that automatically find, catalogue, and validate APIs while creating a security plan that includes API security testing and API access management. Increasing transparency on internal and external APIs puts businesses in a better position to start addressing possible vulnerabilities throughout the attack surface.

In addition, businesses examine their risk models to see if they have fraud and customer threat categories that are appropriate in light of this new data, as well as to update their phishing defences to be able to defend against the most recent MFA attacks with FIDO2-compliant capabilities.

More in News

The integration of AI into private equity (PE) and venture capital (VC) firms has evolved from an experimental phase to a cornerstone of their operational strategy. As the financial sector faces increasing data complexity and a demand for rapid, precise decision-making, AI has proven to be a game changer. AI tools are reshaping how these firms conduct business, improving deal sourcing and automating tedious back-office tasks. AI adoption in the investment world, especially within PE and VC firms, is more than a passing trend. It's quickly becoming a necessary tool to stay competitive. While junior professionals enthusiastically adopt AI for day-to-day tasks, senior partners are sometimes slower to embrace their full potential. Nevertheless, the benefits of AI in managing data-intensive, knowledge-driven operations are undeniable. Key AI Technologies for PE/VC Firms Several AI technologies are helping investment firms optimize their workflows: Optical Character Recognition (OCR): OCR converts scanned documents, PDFs, and handwritten notes into editable and searchable formats. This is vital for extracting data from older or less structured documents. Intelligent Document Processing (IDP): IDP enhances OCR capabilities by converting data and categorizing and processing complex documents, significantly reducing manual effort and improving accuracy. Large Language Models (LLMs): These models excel at text generation and processing. In PE and VC, they are particularly useful for drafting reports, summarizing documents, and providing insights from unstructured data. Retrieval-Augmented Generation (RAG): By combining LLMs with live data retrieval, RAG allows for real-time analysis, making AI outputs more relevant and accurate when making investment decisions or conducting due diligence. By leveraging these AI technologies, PE and VC firms can effectively address operational inefficiencies, particularly in document management, data extraction, and market research. Schutte Financial applies tailored portfolio strategies that similarly aim to streamline complex data management and optimize analytical outcomes. These technologies allow firms to enhance accuracy, reduce repetitive tasks, and gain timely insights for strategic decisions. Practical AI Use Cases in PE/VC Deal Sourcing and Screening: AI can automate the initial screening of investment opportunities by analyzing startup pitches and identifying patterns that predict success. It helps firms quickly filter through thousands of proposals and focus on the most promising opportunities. Hecht-Stout Insurance Agency provides independent business insurance solutions that streamline risk management and improve coverage decision processes. Due Diligence Automation: Due diligence is a time-intensive process involving the review of financial statements, legal documents, and regulatory filings. AI can help by extracting key metrics and organizing them into structured databases, making it easier for investment analysts to assess potential risks and opportunities. Back-Office Automation: Many PE and VC firms spend considerable time on repetitive tasks such as financial reporting, contract review, and invoice processing. AI can automate these tasks, freeing valuable time for more strategic work and improving accuracy across operations. Competitive Intelligence and Market Analysis: AI tools can scan the internet for emerging market trends, monitor social media for sentiment analysis, and track competitor activities. By automating these processes, firms gain deeper insights into market dynamics, helping them stay ahead of the competition. The Path to Successful AI Integration The integration of AI within investment firms doesn't come without its challenges. Firms must navigate obstacles like data standardization, talent acquisition, and process redesign. Furthermore, AI solutions must be deployed thoughtfully to align with the firm's existing workflows and risk management standards. A clear strategy and a willingness to adapt to new technologies are essential for a successful AI integration. ...Read more
Advisor discussions around direct indexing are being shaped by investor preferences for more tailored approaches to portfolio construction. Investors want exposures that let them express individual priorities, but still keep diversified market exposure. This is making wealth managers look at more flexible options in addition to standard index funds. The ability to direct holdings gives advisors a way to respond to these requests and meet individual preferences. In this setup, security selection responsibilities shift to the investor. This arrangement allows for a more personalized approach to portfolio construction, since account specifications can be built directly into the investment strategy. These conversations also bring a different decision-making dynamic. Portfolio discussions now include topics like restrictions, tax planning or legacy goals before an account structure is chosen. Direct indexing brings more variables to manage. At the same time, investors expect to keep some control over their portfolios. This means advisors need to have more frequent conversations about the responsibilities that come with these accounts. The focus on customization can make investors underestimate how much ongoing oversight is needed to manage a direct index. For this reason, advisors should highlight the importance of portfolio maintenance during these discussions. The broader discussion suggests that individual preferences may play a bigger role in ongoing portfolio reviews. Individual securities need to be evaluated regularly, since changes in market dynamics or personal circumstances can require updates to the investment strategy to meet stated objectives. Wealth managers are seeing investor priorities shift. Individuals want to include personal preferences in their investment approach, but still capture diversified market exposure. Direct indexing is one way to address this, though suitability needs to be determined case by case. Advisor expectations are changing as this conversation evolves. This will affect how direct indexing solutions develop in the future. The ability to customize portfolios will need to be balanced with making sure investors understand the responsibilities involved in managing a direct index over time. How well this is managed will shape how widely this approach to portfolio construction is adopted. ...Read more
Wealth management firms are considering implementation factors before expanding their direct indexing offerings due to the complexities associated with the execution of bespoke index portfolios. This includes the intricacies involved with portfolio management as well as client servicing and oversight, which demand higher levels of personalization compared to standard index funds. The former tends to be especially challenging, as the approach to managing individual securities in investor accounts is significantly different than dealing with funds. Moreover, the implementation of direct indexing demands that wealth managers re-evaluate their existing processes regarding the review of advisors’ portfolios as well as the broader operations around client communication and account servicing. In particular, there are more aspects to consider when individual securities need to be managed in each portfolio, and these tend to require a higher degree of coordination and oversight. As such, the client servicing aspect tends to play an equally important role in the decision-making process regarding direct indexing. Furthermore, client education appears to be an integral component of the implementation process, as there are significantly different expectations associated with owning a direct index compared to an index mutual fund or an ETF. As such, advisors may be tasked with helping investors understand the nuances of bespoke portfolio management, including the implications on their investments throughout the life of the account. This is another area where implementation capabilities play an important role in the decision-making process, as it determines the ability of firms to manage accounts on an individual basis while mitigating costs. The considerations mentioned above appear to play a significant role in the decision-making process of wealth management firms, which suggests that they are prioritizing implementation details when it comes to direct indexing. In particular, the ability to deliver consistent oversight of investor accounts may be one of the most important factors in the consideration process since it ultimately determines the long-term viability of direct indexing as an investment vehicle. At the same time, the overall adoption of direct indexing appears to be growing across the wealth management industry, albeit gradually, and the focus on implementation capabilities suggests that the approach will continue to be expanded by more firms. However, this may also mean that investors should be aware of the potential limitations associated with direct indexing solutions. This includes the ability of advisors and wealth managers to provide consistent oversight of individual securities throughout the investment period. ...Read more
Tax considerations are driving deeper dialogues about direct indexing as managers seek to satisfy demand from investors who want to tailor their portfolios to their specific needs, rather than buying pooled products. Beyond standard investment considerations, the conversation is focusing on practical implications for portfolio management. Direct indexing offers an alternative to conventional index mutual funds and exchange-traded funds by allowing investors to directly buy and sell the components of an index. The nuance is important because it creates flexibility when it comes to managing a portfolio for tax or other reasons. That flexibility is proving to be particularly valuable in an environment where investors are seeking bespoke approaches to investing. Customization is proving to be a compelling proposition for investors who want to avoid exposure to specific securities or adopt a personal investment style. Direct indexing meets that need by giving investors control over the individual securities in their portfolio. By contrast, buying shares of a mutual fund or exchange-traded fund typically means investors purchase a diversified basket of securities, without the ability to remove certain components or add new ones. The flexibility that comes with direct indexing also brings complexity, which is leading some managers to carefully assess how such an approach fits within their broader offerings. Adjustments to a portfolio of individual securities can have a ripple effect on portfolio management going forward. As a result, wealth managers are considering whether and how to incorporate direct indexing into their broader approach to portfolio construction and management. Technology has played a role in enabling this discussion because it has made direct indexing a more viable option than it was a decade or more ago. Direct indexing involves greater administrative burdens than do conventional index funds. That makes it important for managers considering the approach to evaluate their ability to effectively monitor and maintain portfolios of individual securities, particularly as those portfolios evolve over time. It has also made custom approaches more accessible to a wider range of investors, including families that want to take a more hands-on approach to investing. Investors are looking to their wealth advisers to think through these issues and help them navigate the complexities of building, maintaining and managing a customized portfolio. Some investors are seeking to incorporate customized approaches into their broader investment strategy. At the same time, they also want to retain the benefits of conventional indexing solutions. Direct indexing can be a useful tool in these negotiations, but advisers are evaluating whether the added value of the approach is right for each individual situation. Advisers are expected to continue having broad discussions about direct indexing as customized portfolio management options gain wider acceptance among investors. The future of the practice will likely be dictated less by the appeal of the concept and more by the ability of managers to absorb the added responsibilities without overcomplicating matters for investors. ...Read more