• Cognizant 20-20 Insights

Mobile Banking Security:

Challenges, Solutions
To offer the best feature-packed online banking mobile applications that
can be delivered, organizations need to carefully consider both functional
as well as security implications to ensure that customers and assets are
protected from malware and wrongdoers.

Executive Summary willingness to try mobile banking services in a

similar survey conducted in 2006.4
There are over 1.2 billion smartphone users
worldwide.1 Individuals adopt smartphones not Globally, banks offer a variety of mobile banking
only to surf the Internet but to download and services; and those banks that do not currently
use entertainment, information, social sites, provide m-banking services claim they plan to do
shopping, travel and banking apps — among other so in the near future to remain relevant, according
things. This has led to numerous opportunities to a recent survey conducted by the Aite Group.5
for organizations to roll out mobile applications And according to a study from the University of
that not only engage and drive loyalty but also Hamburg, Germany, m-banking mobile applica-
garner additional revenue. Organizations are tions are growing exponentially; roughly 69% of
substantially increasing spend on mobile applica- banks already offer such services.6
tion development to help employees/customers
increase their productivity while delivering a However, there is a downside to this market
more intuitive user experience.2 momentum. The MQA survey revealed that
security remains a major concern in adopting
Moreover, an increasing number of individuals m-banking. Approximately 72% of respondents
are using mobile applications compared with said they worry about the security of accessing
traditional desktop/Web-based applications. A financial data on a mobile device. Nevertheless,
research report from ComScore shows that apps 79% of respondents said they would sign up for
account for a majority of consumers’ mobile account balance alerts by mobile. Our research on
minutes, and 80% of their media time is spent consumer segments reinforces the importance of
on app usage compared with only 20% on Web security features for choosing banks that offer
browsers.3 Recently published data from MQA mobile banking.7
Research shows that consumer interest in mobile
banking and payments services in the U.S. has Addressing Mobile Security
increased significantly in the past two years.
Mobile device productivity comes at a price —
Roughly 75% of those surveyed say they would
increased security risks. Mobile applications
consider using mobile banking services if offered,
create yet another path into enterprise networks,
compared with only 49% who expressed their

cognizant 20-20 insights | july 2014

Analysis and Recommendations
Title Description Recommendations
Strong authentication mechanism. Multistep authentication on secured XML-based
Web services for user ID plus password and
Authentication secure ID/SMS is recommended. An additional
recommendation is to check for user location
using a GPS during authentication.

Allow authenticated users access After a user has authenticated, the application
only to business functionality to can check with the back-end services to determine
which they are entitled. if the user has the required access to the applica-
tion data (i.e., whether the user is mobile-enabled
or not). The client displays a secure navigation
Authorization menu based on the entitlements/access rights
of the user. The entitlements/access rights are
checked at the back end for each request before
making calls to business functions.

Sensitive data should be kept in The application cache manager should clear
memory (and not on disk) only while the data when the application operates in the
it’s needed. The application must not background. If sensitive data needs to be handled
Data store any sensitive data on the file on iOS, use C and not ObjectiveC. The logs and
Confidentiality system. Sensitive information should error messages should be suppressed using a
not be leaked through logs and error tool like Dexguard8 for the Android platform and
messages. Arxon’s EnsureIT9 for iOS.

All secure objects in the system (data Secure objects and data structures should be
requests, account data, user-related cleaned when a log-off is triggered. In a case
information etc.) must be securely where application tampering is detected, the
Secure Data wiped when a log-off is triggered. application should be forced shut. For checking
Cleanup if the application is tampered with, the Dexguard
library can be used. In a case where a Webview
API is used, then it should be cleared during
log-off.

The application should prevent any Remove the data from the clipboard when the
Local Data data from being locally transferred app operates in the background so it cannot be
Transfer outside the application (e.g., copying transferred outside the application. Disable long
Prevention it or sending it to an unauthorized press for sensitive fields.
external application).

All network traffic is encrypted. HTTPS protocol should be used to connect to

the back-end applications. An additional white
Connection list of IP addresses and domain names should
Encryption be maintained on the client side to prevent apps
from talking to other domains not specified on
the white list.

Detect if the application is running on Trusteer Mobile SDK10 is recommended. Trusteer

a jail-broken/rooted/malware-infect- provides a score on OS security updates and
ed device. malware detection. Based on the score, the appli-
OS Security cation can make the decision to close the app or
Check the score can be passed to the back-end systems
over a secured channel for further investigations/
actions.

Continued on next page

cognizant 20-20 insights 2

Analysis and Recommendations cont’d
Title Description Recommendations
Application must prevent hackers Trusteer Mobile SDK is recommended to check
from accessing the app in a case if the device is rooted. Trusteer provides a score
where the device is rooted or jail- if the device is rooted. Based on the score the
Jail-Break/ broken. application can take the decision to close the app
Rooted Device or the score can be passed to back-end systems
Check over a secured channel for further investiga-
tions/actions. Root Tools is another open source
API that can be used to conduct a rooted device
check.11

Eliminate any plain-text resources Dexguard/EnsureIT tool is recommended for

from the application’s bundle. This this purpose. Dexguard/EnsureIT is used to
prevents malicious attackers from preprocess the application code and encrypt the
gathering insights on the applica- classes, methods and string constants. Dexguard
Preprocessing/ tion internals. The symbol table is also used to obfuscate the plain-text files and
String should be stripped, thus leaving static contents.
Obfuscating/ only unresolved symbols and forcing
Symbol an attacker to trawl for data in the
Stripping runtime code, decrypt the binary or
use more complex debugger tactics
to obtain a map of the application
symbols for class names, methods
and function names.
To secure the communications with The SSL certificate should be bundled with
the back-end server, a certificate the application. It should be encrypted using
Root Certificate check should be created on the client a tool like Dexguard/EnsureIT. The SSL certifi-
Check side to ensure that it is signed by the cate should be checked to see if it is signed by
organization. the respective authority. If the certificate is not
signed, then the app should be closed.
Application must prevent debuggers In the Android manifest, one can define
Anti-Debugging from attaching to it (e.g., to read debuggable property to be false. A tool like
Mechanism sensitive data from memory in use by Dexguard/EnsureIT supports removal of logging,
another running application). debug or test code for production release.
The application should check to see if A tool like Dexguard/EnsureIT is recommended.
it’s being tampered with. For example, A tamper check can be conducted using the
Tamper debug flags can be checked to Dexguard library. The application should be
Checking determine if the application is being checked for tampering during launch and should
debugged. be closed if it is found to have been tampered
with.
It should be possible to block certain A server-side filter can be used to check for
Blacklisting
older versions of the app on the blacklisted application versions. If an app version
Older Versions
back-end server if there is a security is blacklisted, then the user will receive an error
of the App breach. message and be asked to upgrade the app.
All security events that happen inside This is achievable using a secured Web service
the application should be logged and provided at the back end. All security events are
Security sent to the back-end server. temporarily stored on the device and sent to the
Logging server periodically. During log-off, the device data
is sent to the server to ensure no confidential
data remains on the device.
The app should prevent the redirec- Trusteer Mobile SDK provides a feature to protect
tion of its traffic to a malicious server the application from anti-pharming.
Anti-pharming12 by checking that the host-name
Protection look-up with DNS resolves to a white- Custom implementation is possible to verify a
listed IP. URL against a preconfigured white list for every
outgoing service call.
Hide important data – like property A tool like Dexguard/EnsureIT can encrypt asset
Encrypt Assets files. files transparently, so hackers won’t be able to
abscond with them.
Figure 1

cognizant 20-20 insights 3

allowing criminals, fraudsters and hackers to New threats are always emerging so security
propagate malicious code. Sensitive data stored architects need to be forewarned and forearmed
on a mobile device could be lost or stolen, leading on the trends and vulnerabilities to ensure their
to data breaches, compliance violations and organizations’ mobile apps are safe and hard to
expensive/embarrassing public disclosures. Large hack, if not impenetrable, before they are imple-
organizations recognize mobile device threats mented.
and vulnerabilities and understand that they
need proper security protection. Just what types Mobile applications and related security breaches
of security controls are needed? Figure 1 provides receive much media attention and can undermine
a list of top security requirements and suggested a company’s reputation. The above guidelines
remedies. offer a comprehensive approach and tangible
recommendations for defending mobile apps
Looking Forward from security breaches. By building comprehen-
Given existing competitive market dynamics, sive security features into strategic, feature-rich
even small banks now offer mobile solutions mobile apps from the get-go, organizations can
to their customers. Online banking, or for that keep sensitive transactional and interactional
matter any important financial mobile application data from the prying eyes of those who wish to
rollout, takes on increased strategic importance do them harm over the near and long term.
since success there is critical to moving forward.
Securing any and all feature-packed mobile apps
is therefore exceedingly critical.

Footnotes
1
“There Will Soon Be One Smartphone For Every Five People In The World,” www.businessinsider.in/There-
Will-Soon-Be-One-Smartphone-For-Every-Five-People-In-The-World/articleshow/21375608.cms.
2
“Why Your Enterprise Must Rethink Mobile App Development,” www.wired.com/2013/02/why-your-
enterprise-must-rethink-mobile-app-development/.
3
“Mobile Marketing Statistics 2014,” www.smartinsights.com/mobile-marketing/mobile-marketing-analyt-
ics/mobile-marketing-statistics/.
4
“Security: a major concern for the adoption of m-banking,”
www.vasco.com/Images/Mobile_Banking_Security_VASCO.pdf.
5
“Corporate Mobile Banking: A Look at J.P. Morgan ACCESS Mobile,” www.jpmorgan.com/treasury/jpm_
access/doc/Corporate_Mobile_Banking_A_Look_at_JP_Morgan_ACCESS_Mobile.pdf.
6
“The Mobile Commerce Prospects: A Strategic Analysis of Opportunities in the Banking Sector,”
www.postbank.de/postbank/docs/HamburgUP_Tiwari_Commerce.pdf.
7
“Segment-based Strategies for Mobile Banking,” www.cognizant.com/InsightsWhitepapers/Segment-
Based-Strategies-for-Mobile-Banking.pdf.
8
Dexguard, www.saikoa.com/dexguard.
9
Arxon EnsureIT, www.arxan.com/products/mobile/ensureit-for-apple-ios/.
10
Trusteer Mobile SDK, www.trusteer.com/products/trusteer-mobile-sdk.
11
Root Tools, https://github.com/Stericson/RootTools.
12
Anti-Pharming, http://en.wikipedia.org/wiki/Anti-pharming.

cognizant 20-20 insights 4

About the Authors
Amit Tank is a Solutions Architect within Cognizant’s Banking and Financial Services Business Unit.
He has over 12 years of industry experience across several industry sectors including (but not limited
to) software product development, professional services, research and development, manufacturing
engineering and software applications. Amit has architected, designed and developed critical business-
centric enterprise applications for companies in the insurance, mortgage, banking and financial services
industries. He earned his bachelor’s degree in engineering from NIT Durgapur, India and is a TOGAF 9
certified enterprise architect. Amit can be reached at [email protected].

Chintan Desai is a Project Manager within Cognizant’s Banking and Financial Services Business Unit. He
has 10-plus years of experience leading all phases of diverse technology projects, and more than seven
years of computer programming experience using C and Java in projects involving mobility (Android),
enterprise content management and portals. He received a bachelor of engineering degree in computer
science from DDIT, Nadiad. Chintan can be reached at [email protected].

About Cognizant
Cognizant (NASDAQ: CTSH) is a leading provider of information technology, consulting, and business process out-
sourcing services, dedicated to helping the world’s leading companies build stronger businesses. Headquartered in
Teaneck, New Jersey (U.S.), Cognizant combines a passion for client satisfaction, technology innovation, deep industry
and business process expertise, and a global, collaborative workforce that embodies the future of work. With over 75
development and delivery centers worldwide and approximately 178,600 employees as of March 31, 2014, Cognizant
is a member of the NASDAQ-100, the S&P 500, the Forbes Global 2000, and the Fortune 500 and is ranked among
the top performing and fastest growing companies in the world. Visit us online at www.cognizant.com or follow us on
Twitter: Cognizant.

World Headquarters European Headquarters India Operations Headquarters

500 Frank W. Burr Blvd. 1 Kingdom Street #5/535, Old Mahabalipuram Road
Teaneck, NJ 07666 USA Paddington Central Okkiyam Pettai, Thoraipakkam
Phone: +1 201 801 0233 London W2 6BD Chennai, 600 096 India
Fax: +1 201 801 0243 Phone: +44 (0) 20 7297 7600 Phone: +91 (0) 44 4209 6000
Toll Free: +1 888 937 3277 Fax: +44 (0) 20 7121 0102 Fax: +91 (0) 44 4209 6060
Email: [email protected] Email: [email protected] Email: [email protected]

­­© Copyright 2014, Cognizant. All rights reserved. No part of this document may be reproduced, stored in a retrieval system, transmitted in any form or by any
means, electronic, mechanical, photocopying, recording, or otherwise, without the express written permission from Cognizant. The information contained herein is
subject to change without notice. All other trademarks mentioned herein are the property of their respective owners.