Masterclass: INTERNET BANKING SECURITY: PRESENT AND FUTURE

As the number of tech companies grow in our ecosystem, and security becomes more and more sensitive for any digital company, internet banking is an issue to address.

This event will be divided in two parts:

1. Masterclass: Internet banking applications’ security, with Wojtek Dworakowski
2. Discussion Panel: Internet Banking Challenges Ahead - current and future threats

The Masterclass

All internet banking applications are different but all of them share many common security features which are very specific to this domain of web and mobile applications. It is not very rare that these safeguards are incorrectly implemented leaving the internet banking application vulnerable.

In this sessions, multiple case studies and attack scenarios characteristic to internet banking will be addressed. Common vulnerabilities will be addressed and recommendations on how to properly implement security features will be provided.

Among others, transaction authorization, limits, notifications, authorization schemes, trusted recipients, two-factor authentication will be discussed. Recent challenges like PSD2 and API access to banking systems will be covered. The agenda will include:

• Security features of contemporary internet banking.

• Examples of vulnerabilities in implementation of these safeguards (logical and technical flaws) and recommendations.

• Upcoming changes due to PSD2 implementation (Payment Initiation Services, Account Information Services, Strong Customer Authentication)

Discussion Panel

In this discussion panel, we will explore how threats to Internet banking have evolved in the last couple of years, what banks are doing to address them and what they are lacking in order to effectively mitigate them. With the help of the panelists and the attendees, we'll try to answer questions such as:

• What has changed in the last couple of years? Are changes in the economics of malware promoting changes in how attacks are being perpetrated? What are the new types of attacks?

• Is the threat landscape changing due to recent European regulation like the PSD2 or even the GDPR?

• We'll delve on the challenges in adopting these regulations from a security point of view, but also from an organizational perspective.

• Are banks are embracing Responsible Disclosure as a way to scale their application security efforts and reduce the risk of compromises? Should they? What about (private) bug bounties?

Agenda:

• 10h-11h20 - Masterclass: Internet banking applications’ security with Wojtek Dworakowski
• 11h20-11h40 - Coffee Break
• 11h40-13h - Discussion Panel: Internet Banking Challenges Ahead - current and future threats

THE GUESTS

• Wojtek Dworakowski, Managing Partner, SecuRing

Wojtek is an application security consultant with over 15 years of experience and a managing partner of SecuRing, a company dealing with application security testing and advisory. Over last years he has been helping banks, major financial institutions, and software vendors to achieve proper level of application security, including ING, BNP, KBC, UniCredit Group, Sage, Sodexo. Member of Crisis Management Board during national elections in Poland (2006-2008). OWASP Transaction Authorization Cheat Sheet author. Wojtek has been Polish OWASP Chapter Leader from 2011 to 2017.

• Liliana Vilela

Security Architect, Natixis

Liliana Vilela is a Security Architect at Natixis, focusing on secure development and web application security. Her goal is to educate developers on how to create applications resilient to attacks, and provide them with the best tools to integrate security into their everyday development process.

• Jorge Pinto

BPI

• Pedro Fortuna

CTO and Co-Founder, Jscrambler

Pedro Fortuna is CTO and Co-Founder of Jscrambler where he leads the application security research activities and lays out the technical vision for all the products developed by the company. Pedro holds a degree in Computing Engineering and a MSc in Computer Networks and Services, and has more than a decade of experience researching and working in the application security area. He is a regular speaker at cybersecurity conferences and software development events. His research interests lie in the fields of Application Security, Reverse Engineering, Malware and Software Engineering. Pedro is also the author of several patents in application security.