By Derek Kiely, Vice President of Product, Progress
The APAC Fintech industry is flourishing, with a robust ecosystem offering innovative financial solutions to both domestic and international markets. The APAC Fintech market is actually expected to grow at a CAGR of greater than 16% between 2024-2029, reaching USD 310.88 billion by 2029.
However, as digital transformation accelerates, so do the risks associated with cyberattacks. And no matter how large or small a business is, its website is a target. Cybercriminals have nothing to lose by attempting to breach a website and web applications: failure costs them nothing, while success can yield them any number of advantages.
Network firewalls are the most widely known line of defense here. However, with Fintechs heavily reliant on web applications, there is another kind of firewall, one just as essential but comparatively under-discussed: the web application firewall (WAF).
How web application firewalls work
WAFs function at the application layer and inspect the contents of web traffic. This allows them to detect and block malicious behavior, something a traditional network firewall cannot do. They function as an additional frontline layer of defense, positioned squarely between endpoint devices and web application servers in the web traffic path.
Picture a parking attendant in a booth but operating at 100x speed: each aspiring visitor is assessed in milliseconds and either waved through or left stranded outside the gate.
This rapid-fire assessment is accomplished through the analysis of the HTTP/HTTPS protocols used by web traffic. WAFs speedily parse network packets to surface threats (think a border agent searching a car’s trunk), and in so doing, they thwart the kinds of threat exploits that network firewalls are unequipped to detect.
Understanding the need for WAF in the Fintech industry
In the Fintech landscape, where sensitive financial data and customer trust are at stake, the risk of exploitation by cybercriminals is ever-present.
A good, well-provisioned WAF can automatically detect and block the most common types of attacks against web applications. A WAF can protect against the most dangerous and prevalent security risks. These include:
- Cross-Site Request Forgery (CSRF) is one of the most prominent web exploits – it accounted for almost 5% of all application layer attacks in 2022. In a CSRF attack, an attacker seeks out a victim who is authenticated for a given web application and effectively poses as them to gain access to the application and execute unwanted commands. WAFs can block these attacks by checking referral headers – which can tell them where the request originated. Accordingly, they significantly reduce the risk of CSRF attacks.
- Injection attacks are another notable use case here. In an injection attack, a malicious actor sends a specially crafted attack payload to try to read or modify privileged data or execute unauthorised administrative operations. The use of a WAF dramatically mitigates the risk of these attacks through the dynamic monitoring of client traffic flows: they are designed to recognise, flag and block malicious injection patterns and can prevent unauthorised execution accordingly.
- Data Loss Prevention (DLP), i.e., the unauthorised transfer of sensitive information out of a network. While this might happen by accident or maliciously, in either case WAFs are an invaluable tool through their ability to inspect and deny egress traffic containing unauthorised data.
These are just a handful of the most notable malicious actions against Fintech organisations that WAFs can prevent.
WAF: one part of a bigger cyberdefense strategy
While WAFs are tremendously valuable, they can only ever be one part of a layered defense in-depth approach that considers the full range of cybersecurity solutions currently available to businesses. The goal should be to have as many defensive layers as possible in place around applications so that if one fails, others are in place to pick up the slack. But while they may not win the game on their own, WAFs will always be a vital part of the team – one that most businesses can’t afford to live without.
Furthermore, with the recent updates to PCI DSS 4.0 which will become effective March 2025, the requirement outlined in section 6.4.2 will be forcing some organizations to adopt WAF technologies to help protect public facing web applications. This is a change from the prior version (PCI DSS 3.2.1) which had a softer stance on the requirements for Web Application Firewalls.
By implementing WAFs, Fintechs can demonstrate their commitment to safeguarding customer data while fostering a culture of innovation and resilience. As the APAC Fintech sector continues to grow, WAFs will remain a cornerstone of effective cybersecurity strategies, ensuring businesses stay ahead in a highly competitive and regulated market.
