How To Comply With RBI Guidelines On Security Of Mobile Banking Applications And Transactions?

India is one of the largest markets of mobile banking in the world. As per the Indian Department of Financial Services, the number of financial transactions through mobile phones in India is 18,592 crore. Unified Payments Interface (UPI), a Made in India technology is ruling the world of Fintech. It's used in India, as well as Singapore, UAE, France, Mauritius, Nepal, Bhutan, and Sri Lanka.

As the number of transactions is huge and increasing continuously, it's necessary that the mobile banking applications have the best security architecture, to keep the users information secure. Otherwise the sensitive financial and personal data of billions of people will be at risk.

And to take care of the security of mobile banking apps, the Reserve Bank of India (RBI) has set up guidelines that the companies and developers developing banking apps should follow to protect the information of those app users. These guidelines apply to the Regulated Entities (REs) listed below:

• Scheduled Commercial Banks (excluding Regional Rural Banks)
• Small Finance Banks
• Payments Banks
• Credit card issuing Non-Banking Financial Companies (NBFCs)

Table of contents

• RBI Guidelines for Mobile Banking Apps Security
• Bugsmirror MASST: Seamless Security Solutions for RBI Compliance

What should organisations check for RBI mobile app security compliance?

The REs must know, understand and follow these guidelines:

1. They shall conduct security testing including source code review, Vulnerability Assessment (VA) and Penetration Testing (PT) of their digital payment applications, etc., to assure that their application is secure.

2. The communication protocol in the digital payment channels (especially over Internet) shall adhere to a secure standard. An appropriate level of encryption and security shall be implemented in the digital payment ecosystem.

3. In case of any anomalies or unexpected behavior for which the mobile app was not designed, customers should be prompted to remove the current version and install a fresh copy. REs must verify the app version before enabling transactions.
4. Implement a feature that checks whether the device is rooted or jailbroken before installing the app. If the device is rooted/jailbroken, the app should be prevented from installing or functioning.
5. Incorporate code obfuscation techniques to protect the apps source code from reverse engineering or tampering. This ensures that sensitive logic remains difficult to decipher by malicious actors.
6. Host the checksum of the current version of the app on a public platform to allow users to verify it.
7. REs must ensure proper device binding for the mobile application.
8. They should consider alternatives to SMS-based OTP mechanisms for additional layers of authentication.
9. Apps should detect inactivity over a specified period, new network connections, or connections from unsecured networks (e.g., unsecured Wi-Fi). They must implement proper authentication measures for transactions under these conditions.
10. The apps should not store or retain sensitive information such as user IDs, passwords, keys, hashes, or hard-coded references on the device.
11. Implement native encryption and decryption for local data storage, including temporary files.
12. Integrate anti-malware features within the mobile app.
13. Protect mobile applications from SQL injection vulnerabilities.
14. Ensure secure download and installation of the mobile app once baseline security requirements are met.
15. Deactivate older versions of the app in a phased but timely manner. Aim to maintain only one active version, excluding the overlap period during the phase-out of older versions.
16. Implement sandboxing or containerization for the application.
17. The mobile banking application should have the capability to identify remote access applications, where feasible, and block remote login access to the app.

By complying with these guidelines the REs can ensure that their mobile banking apps do not fall short on transaction security and user information security.

How does Bugsmirror MASST support RBI Complaince?

Bugsmirror ensures easy compliance with all RBI-mandated security requirements for mobile banking apps with its Mobile Application Security Suite & Tools (MASST):

• Threat Detection: Detect security threats with CodeLock for static code analysis across 50+ attack vectors, RunLock for deep runtime security assessments covering 25+ attack vectors, APILock for testing the security of mobile APIs, and ThreatLock for expert Red Teaming evaluations.

• Threat Mitigation:

Bugsmirror Defender provides runtime application protection for Android and iOS applications. It can detect and respond to runtime threats such as device compromise, application tampering, debugging, hooking, and other runtime attack conditions.

Static protection: Bugsmirror Shield provides code and application protection capabilities designed to increase resistance to reverse engineering and protect sensitive application components.

Server-side RASP Validation: With Trust API Bind (TAB), APIs get extra security validation from your server not just depending upon app or device side validation as it can be sometimes compromised or manipulated. Server-side RASP validation make sure that every API request is coming from the genuine application which is protected by Defender (RASP).

Read more about TAB on our document "Runtime API Security for Mobile Apps"

• Threat Visibility: Leverage ThreatLens & OTA, a dashboard for mobile apps that provides real-time data and advanced analytics on the threats detected and prevented by Bugsmirror Defender.

With threat visibiltiy, you can update security measures wihout resubmitting app again over app markets with OTA (Over-The-Air-Update). It allows you to directly update security changes without any delay.

Companies can whitelist genuine users with device level disfunction due to which they are unable to use any application. These device level implications sometime prevent an app to run due to security reasons. By whitelisting such devices you can increase your user base and their trust over your applications.

Businesses should go for a Free Runtime Security Audit to test their app's security and experience Bugsmirror Defender with a 14-day free trial.

Ensure your mobile banking app is RBI-compliant and secure with Bugsmirror. Contact us today to stay ahead of evolving threats.

FAQs:

1. What are RBI guidelines for mobile banking app security?
   Ans: RBI's Digital Payment Security Controls Directions establish security requirements for regulated entities operating digital payment products and services. The requirements cover areas including application security, secure development, security testing, authentication, device binding, data protection, application integrity, and fraud-risk management.

2. Which entities must follow RBI digital payment security controls?
   Ans: The directions apply to Scheduled Commercial Banks excluding Regional Rural Banks, Small Finance Banks, Payments Banks, and credit card issuing NBFCs.

3. Does RBI require mobile banking applications to undergo security testing?
   Ans: Yes. The RBI directions require regulated entities to conduct security testing of digital payment applications, including source-code review, Vulnerability Assessment, and Penetration Testing.

4. Does RBI require device binding for mobile applications?
   Ans: Yes. The RBI directions state that REs shall ensure device binding of mobile applications. The directions also specify that device binding should preferably use a combination of hardware, software, and service information.

5. Does RBI require root and jailbreak detection?
   Ans: The RBI directions state that REs may consider implementing a mechanism to check whether a device is rooted or jailbroken before installation and disallow the application from installing or functioning if the device is rooted or jailbroken.

6. How can Bugsmirror support RBI mobile application security requirements?
   Ans: Bugsmirror provides security testing, runtime protection, application protection, API security testing, red team assessment, and threat visibility capabilities through MASST. These capabilities can support specific areas of a broader mobile application security and compliance programme.