Online Banking Assessment (OBA)

CastleGarde’s Online Banking Assessment centers around the Federal Financial Institutions Examination Council (FFIEC) guidance on Authentication and Access to Financial Institution Services and Systems, in addition to NCUA regulatory guidance and risk management. This assessment is focused specifically on the Online Banking application (Internet Banking), utilizing client supplied application credentials (White Box Testing) to gain access for the purpose of testing the application for vulnerabilities.

Specifically test the ability to perform functions that the system should not allow

Being able to view transaction history for a different account than the one you signed into
Being able to transfer funds into the account you are signed into from some other non-related account
Test the session security to see if it can be modified to gain access to other accounts
Attempt to perform any function that would not normally be available to a user

Evaluation of the administration and end-user access of the online banking application platform

Identification of threat landscape
Risk assessments
Layered security and Multifactor authentication
Monitoring, logging and reporting
Call center and IT help desk authentication
Data aggregators and other CPE’s (Customer Permissioned Entities)
User (customer/member) awareness and education
User (customer/member) identity verification
Privileged user (administrative) access controls