API Security Questionnaire

Cybersecurity is an increasingly important topic for bank leaders.

The number of cyber attacks continues to rise, and the sophistication of those attacks is escalating. Further, customers are demanding data portability, open networks that enable connections to third party applications, and new products that require banks to partner with fintechs to integrate new offerings into their existing systems. To address these security challenges in modern software head-on, application programming interfaces (APIs) need to be developed with security in mind.

The members of the Alloy Labs Alliance (“Alliance”) — a consortium of innovative community and midsize banks — are keenly attuned to this tension. The bankers involved in the Alliance’s Cybersecurity Center of Excellence (“Cyber group”) identified the need to secure third-party APIs that are used to connect systems and transfer data as a priority. To that end, the group co-created API security focus points.

Co-Creating API Security Focus Points

By organizing in a Center of Excellence, the cybersecurity leaders from a dozen banks were able to come together for regular, monthly working sessions. Alloy Labs runs several Centers of Excellence covering a wide array of topics. The goal of every group is to share the knowledge and workload required to develop tangible resources that can be used at each of the members’ institutions internally. For this project, the Cyber group enlisted the help of the Alliance’s consultant, Crowe, LLP, a public accounting, consulting, and technology firm. Crowe worked with the Alliance’s Cyber group through a series of discussions. These discussions focused on the API Top 10 list of security vulnerabilities developed by the Open Web Application Security Project® (OWASP) as a framework. The resulting questionnaire is comprised of over forty security questions broken down into two categories: initial/ongoing due diligence and event-driven due diligence.

Using This Questionnaire

This questionnaire is for informational purposes only. It is designed to provide considerations for a bank’s approach to hardening third party APIs, though each institution is responsible for establishing its own policies in accordance with their unique needs and risk policies.

These questions may aid in banks’ efforts to craft their own API security strategies. The questionnaire can be used to solicit information from vendors and technology providers about the security of their APIs. It can also be provided to a bank’s internal teams to help them gauge connectivity requests before they’re submitted to the bank’s security team. Finally, the questions may aid in banks’ efforts to craft their own API security strategy strategies.

Download the industry insight to read the full text.