Security Challenges in the World's Largest Open Finance Ecosystem

Security Challenges in the World's Largest Open Finance Ecosystem

Speakers: Fábio Szecsik, Lead, Cybersecurity, Privacy, and IT Operations, Open Finance Brazil

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=gLuth3M00DU

Overview

In this compelling talk at RSAC 2024, Fábio Szecsik, a veteran in cybersecurity now leading the charge for Open Finance in Brazil, delved into the unique security and privacy challenges inherent in operating the world's largest open financial ecosystem. Brazil's Open Finance initiative, a groundbreaking evolution of traditional Open Banking, facilitates the secure sharing of a vast array of personal financial data—from banking accounts to payroll, crypto, student loans, and investments—among over 800 financial institutions. This talk illuminated the monumental task of safeguarding such a complex and decentralized network, which processes billions of API calls annually.

Szecsik highlighted that the sheer scale and scope of data sharing in Brazil necessitate a robust, standardized security framework. The presentation focused on the critical role of Financial-grade API (FAPI), an advanced security profile built atop OAuth 2.0 and Open ID Connect, in ensuring the integrity and confidentiality of transactions and data. Furthermore, Szecsik introduced an innovative use case demonstrating the integration of FAPI with FIDO2 for a seamless, passwordless payment experience, underscoring Brazil's commitment to both cutting-edge security and enhanced user experience.

The importance of this discussion extends beyond Brazil, offering valuable insights for any country or organization navigating the complexities of open data initiatives. By detailing the architectural decisions, the evolution of authentication mechanisms, and the strategic adoption of global security standards, Szecsik provided a blueprint for building trust and fostering innovation in the rapidly expanding digital economy. The talk served as a testament to the collaborative effort required between regulators, technology groups, and financial institutions to secure an ecosystem designed to empower consumers with greater control over their financial data.

Background

▶ Watch: Speaker's cybersecurity background and path to RSAC (2:00)

The concept of Open Banking, which allows consumers to share their banking account information with third-party providers, has been evolving globally. Brazil, however, has taken this a significant step further with Open Finance. Unlike Open Banking, which primarily focuses on checking and savings accounts, Open Finance broadens the scope to include a comprehensive range of financial data, such as payroll, cryptocurrency holdings, student loans, retirement plans, investment portfolios, and credit card information. This expansion aims to provide consumers with more tailored financial products, better credit options, and more competitive rates by enabling a holistic view of their financial health.

The scale of Brazil's Open Finance ecosystem is unprecedented. Since 2022, it has processed an astounding 20 billion API calls and recorded 27 million given consents for data sharing. Over 500,000 payments have been executed through the system, involving more than 800 registered financial institutions. To put this into perspective, Szecsik noted that the UK, a pioneer in Open Banking, has approximately 80 institutions. This immense network is orchestrated by the Banco Central do Brasil (Central Bank of Brazil), which defines the implementation requirements, such as the widely adopted Pix instant payment system. A collaborative effort involving around 600 individuals across various tech groups (cybersecurity, privacy, specification, UX) ensures that business models are architected securely and effectively before implementation by financial institutions.

The key objectives driving Brazil's Open Finance are multifaceted: to re-establish control of data by its real owner (mirroring principles of GDPR and Brazil's LGPD), to facilitate free and transparent data sharing, and to stimulate innovation in current and future business models. However, this ambitious vision comes with significant security challenges. The entire ecosystem relies heavily on API communications, making robust API security paramount. Historically, API authentication methods have evolved from simple but insecure approaches like Basic Authentication (sending Base64 encoded username/password) and API keys (vulnerable to interception) to more sophisticated token-based authentication systems like OAuth 1.0 and OAuth 2.0. While Open ID Connect added an identity layer and introduced JWT tokens for encryption, the inherent flexibility of these frameworks, relying on various RFCs (Requests for Comments) with optional security features, proved insufficient for the stringent demands of a financial ecosystem. This necessitated the development of a specialized, mandatory security framework: FAPI.

Key Findings

▶ Watch: Impressive scale of Brazil's Open Finance ecosystem (6:30)

The central finding of this talk is that securing a vast, decentralized financial ecosystem like Brazil's Open Finance demands a multi-layered and continuously evolving security strategy, with Financial-grade API (FAPI) as its cornerstone. Fábio Szecsik demonstrated that standard API security protocols, while foundational, are insufficient for the unique risks associated with financial data. FAPI addresses this by imposing mandatory, stringent security controls atop existing frameworks.

A significant discovery highlighted was the evolution of FAPI itself, from FAPI 1.0 to FAPI 2.0. While FAPI 1.0, adopted by Brazil in September 2022, already mandated strong authentication protocols like MTLS (Mutual TLS) and signed/encrypted ID tokens, FAPI 2.0 elevates security by making Pixie (Proof Key for Code Exchange) mandatory. This crucial enhancement provides robust protection against code interception attacks, a common vector for token theft. Furthermore, FAPI 2.0 introduces PAR (Pushed Authorization Requests) and JAR (Signed Authorization Requests), which significantly fortify the authorization request process against replay attacks and other manipulations.

Beyond API security, the talk underscored the critical importance of data privacy. Brazil's LGPD (Lei Geral de Proteção de Dados), akin to Europe's GDPR, dictates strict requirements for data prevention, protection, security, and transparency. Szecsik detailed the consent management framework, ensuring that user data is shared only with explicit permission and for the original stated purpose, thereby maintaining user control and trust.

Finally, a key finding was the innovative integration of FAPI with FIDO2 (Fast IDentity Online 2) for a "journey payment without redirect" use case. This integration offers a paradigm shift in online payments, enabling passwordless, biometric-based transactions directly within an e-commerce platform. This not only dramatically enhances user experience by minimizing friction but also significantly boosts security by leveraging strong cryptographic authentication and mitigating risks associated with traditional redirects and credentials. This demonstrates that advanced security can, and should, go hand-in-hand with improved usability in modern financial services.

Technical Deep Dive

▶ Watch: Regulatory structure and collaboration in Brazil (8:30)

The security architecture of Brazil's Open Finance ecosystem is fundamentally built around API security. As Fábio Szecsik explained, every interaction, from data sharing to payment initiation, is an API call. The core flow involves a user making an API call to their institution, which then communicates with an authorization server to verify the user's identity and grant access to a resource server. Supporting this basic functionality are critical components such as digital certificates, Open ID providers, and robust security monitoring systems.

The linchpin of this security framework is the Open ID Foundation compliance and the adoption of FAPI (Financial-grade API). FAPI is not a standalone protocol but rather a profile or certification developed by the Open ID Foundation that specifies mandatory security requirements for financial institutions built on top of OAuth 2.0 and Open ID Connect. This is crucial because, while OAuth 2.0 and Open ID Connect provide flexible frameworks, their underlying RFCs often include optional security features. FAPI, however, mandates specific cryptographic keys, authentication methods, and protocol versions to meet the elevated security demands of financial data.

Szecsik outlined the evolution of API authentication methods that led to the necessity of FAPI:

1. Basic Authentication: The earliest and least secure method, where username and password are sent in a header, often Base64 encoded. As Base64 is not encryption, this method is highly vulnerable to interception, especially without HTTPS.
2. API Keys: A slight improvement, where a key generated from user information (like IP address, username) is used for authentication. However, API keys are still susceptible to interception and replay attacks if not properly secured.
3. OAuth 1.0/2.0: Introduced token-based authentication, separating the client's credentials from the resource access. OAuth 2.0 further enhanced this with access tokens and refresh tokens, improving security by limiting the lifespan of access tokens.
4. Open ID Connect: Built on OAuth 2.0, Open ID Connect added an identity layer, allowing clients to verify the identity of the end-user. It utilizes JWT tokens (JSON Web Tokens), which can be signed and encrypted, providing a more secure way to transmit identity information.

Despite these advancements, the financial sector required a more prescriptive and robust standard. FAPI addresses this by enforcing:

• Stronger Authentication: Often requiring MFA authentication.
• Enhanced Authorization: Tighter controls over what resources can be accessed.
• High Security Protocols: Mandating specific versions and configurations of cryptographic protocols.
• Protection Against Attacks: Specific mechanisms to thwart common attack vectors.
• Auditability and Compliance: Ensuring transactions and data sharing can be tracked and meet regulatory standards.

The origins of FAPI trace back to the PSD2 (Payment Services Directive 2) regulation in Europe in 2017, subsequently adopted by initiatives like UK Open Banking, FDX in the US/Canada, and CDR in Australia, before its implementation in Brazil in September 2022.

Szecsik detailed the two main versions of FAPI:

• FAPI 1.0: Based on OAuth 2.0 and Open ID Connect. It requires MTLS (Mutual TLS) for client authentication (Brazil uses MTLS) and mandates signed encrypted ID tokens with strong encryption algorithms. While Pixie was recommended, it was not mandatory.
• FAPI 2.0: Represents a significant leap in security. Pixie (Proof Key for Code Exchange) becomes mandatory, effectively preventing code interception attacks by introducing a code challenge and code verifier generated by the client application, which cannot be intercepted. FAPI 2.0 also mandates JAR (Signed Authorization Requests) and PAR (Pushed Authorization Requests). PAR, in particular, enhances security by pushing authorization request parameters directly to the authorization server, preventing them from being exposed in the browser's URL and mitigating replay attacks.

Beyond API security, Szecsik emphasized the critical role of data privacy, governed by Brazil's LGPD, which aligns closely with GDPR. The law's Article 6 mandates principles like data prevention, protection, security, and transparency. The consent management process is central to LGPD adherence:

1. A receiving institution requests customer consent to share data.
2. The customer is redirected to the transmitting institution for authentication and confirmation of the data they wish to share.
3. Upon confirmation, the data is securely shared with the receiving institution, strictly adhering to the user's defined purpose and scope.

This comprehensive technical framework ensures that Brazil's Open Finance ecosystem maintains high levels of security and privacy, capable of handling the vast scale of financial data sharing. The decentralized infrastructure, primarily running on AWS cloud, further supports this by distributing risk and promoting resilience among participating banks.

Demo / Proof of Concept

▶ Watch: Overview of API security challenges and FAPI framework (11:50)

Fábio Szecsik presented a compelling use case, referred to as "journey payment without redirect," which perfectly illustrates how advanced security protocols like FAPI can be combined with user-centric authentication methods like FIDO2 to create a seamless and highly secure payment experience. The problem it addresses is common in e-commerce: when a user wants to pay using their bank account, they are typically redirected to their banking app or website for authentication, a process that introduces friction and potential drop-offs.

The proposed solution integrates FAPI with FIDO2 (the underlying technology for passwordless authentication, often seen in features like Windows Hello using biometrics). The goal is to enable users to authenticate and authorize payment transactions directly within the e-commerce checkout flow, eliminating the need for redirects and password entries. The process involves two main phases:

Phase 1: Account Linking (One-time Setup)

1. User Enrollment: When a user first decides to use this payment method, they are prompted to enroll through a one-time setup process. This links their banking account to the e-commerce platform using their device and FIDO2.
2. FIDO Key Creation: FIDO2 leverages a combination of factors: "what you know" (e.g., a PIN or password), "what you are" (biometry like fingerprint or facial scan), and "what you have" (the physical device like a smartphone or laptop). These elements are used to create a unique cryptographic key pair: a private key that remains securely on the user's device and a public key that is stored by the e-commerce platform and associated with the user and their chosen payment method. This public key is then registered with the user's bank via FAPI-protected APIs.

Phase 2: Checkout and Payment Initiation (Subsequent Transactions)

1. Purchase Initiation: When the user makes a purchase, they select their linked payment method at checkout.
2. Payment Request: The e-commerce platform initiates a payment request to the bank's API, which is protected by FAPI. This request includes transaction details and a nonce (a unique, one-time use number to prevent replay attacks).
3. In-App Authorization: Crucially, instead of redirecting the user, the e-commerce platform triggers a FIDO2 authentication prompt directly within its interface.
4. Biometric Authentication: The user authenticates on their registered device (e.g., using a fingerprint or facial scan). The device then uses the securely stored private key to generate a digital signature for the transaction.
5. Bank Verification: The bank receives this signature and verifies it against the public key it has on file for the user, along with the nonce to ensure the request's freshness.
6. Confirmation: Upon successful authentication and payment authorization, the bank sends a confirmation back to the e-commerce platform, which then displays a confirmation message and receipt to the user.

A critical aspect highlighted by Szecsik is that after the initial account linking, the user no longer interacts directly with their bank account during subsequent payment journeys. All interactions for payment authorization occur between the user's device, the Payment Service Provider (PSP), and the Account Servicing Payment Service Provider (ASP), with the user simply providing biometric confirmation.

To further enhance security, the system integrates risk signals. If the system detects any abnormal activity during the payment flow (e.g., unusual location, device, or transaction amount), it can trigger additional authentication challenges or request further information from the user, adding another layer of robustness.

The benefits of this FAPI-FIDO2 integration are significant:

• Enhanced User Experience: Frictionless checkout, no redirects, leading to higher conversion rates for e-commerce platforms.
• Regulatory Compliance: The solution meets SCA (Strong Customer Authentication) requirements under regulations like PSD2, as FIDO2 provides strong, multi-factor authentication.
• Increased Security: Leveraging FIDO2 for authentication and FAPI for secure API communications offers robust protection against fraud, unauthorized transactions, and common API attacks.

This proof of concept demonstrates that a seamless, secure, and compliant payment journey is not only achievable but also essential for meeting the demands of modern consumers and the stringent requirements of the financial industry.

Defensive Implications

▶ Watch: Restaurant analogy explaining API functionality and security needs (13:00)

The insights from Brazil's Open Finance ecosystem offer critical defensive implications for financial institutions, technology providers, and regulators worldwide, especially those involved in open data initiatives.

1. Prioritize FAPI Adoption for API Security: The most significant takeaway for defenders is the indispensable role of Financial-grade API (FAPI). Any organization handling sensitive financial data via APIs must move beyond generic OAuth 2.0 and Open ID Connect implementations. Instead, they should adopt FAPI profiles, specifically targeting FAPI 2.0 with its mandatory Pixie (Proof Key for Code Exchange) and PAR (Pushed Authorization Requests). This ensures robust protection against common API vulnerabilities like code interception and replay attacks, which are particularly damaging in financial contexts. Institutions should regularly audit their API implementations against the latest FAPI specifications.

1. Embrace Passwordless and Strong Authentication (FIDO2): The integration of FIDO2 with FAPI for "journey payment without redirect" showcases a powerful defensive strategy. By moving towards passwordless, biometric-based authentication, organizations can drastically reduce the attack surface associated with traditional credentials (phishing, credential stuffing, brute-force attacks). Defenders should invest in FIDO2-compliant solutions to offer stronger, more user-friendly authentication, thereby enhancing both security and user experience.

1. Implement Comprehensive Data Privacy Frameworks: Adherence to stringent data privacy laws like LGPD and GDPR is not merely a compliance burden but a fundamental defensive measure. Organizations must establish robust consent management systems, ensure strict purpose limitation for data usage, and implement transparent data sharing practices. This builds trust with users and mitigates legal and reputational risks associated with data misuse or breaches. Defenders need to ensure that data flows are auditable and that privacy-by-design principles are embedded into all system architectures.

1. Establish Continuous Security Testing and Compliance Programs: The dynamic nature of cyber threats and regulatory landscapes necessitates ongoing vigilance. Defenders must implement continuous security testing, including regular penetration testing, vulnerability assessments, and compliance audits. This "continuous test and compliance" cycle, as highlighted by Szecsik, is crucial for adapting to evolving threats and ensuring that security measures remain effective against new attack vectors.

1. Leverage Risk Signals and Behavioral Analytics: Integrating risk signals into transaction flows provides an additional layer of defense. By monitoring user behavior, device context, and transaction parameters, organizations can detect anomalous activities in real-time. If a transaction deviates from established norms, the system can trigger adaptive security measures, such as requesting additional authentication or blocking the transaction, thereby preventing fraudulent activities.

1. Secure Decentralized Cloud Infrastructure: Given that Brazil's Open Finance operates on a decentralized cloud infrastructure (e.g., AWS), defenders must ensure that all participating financial institutions maintain high security standards for their cloud environments. This includes strong access controls, encryption of data at rest and in transit, network segmentation, and continuous monitoring of cloud resources. Collaboration on security best practices across the ecosystem is vital for collective defense.

By proactively adopting these defensive strategies, organizations can build resilient and trustworthy open financial ecosystems that protect sensitive data while fostering innovation and empowering consumers.

Key Takeaways

• Brazil's Open Finance is the world's largest and most comprehensive open financial ecosystem, extending beyond traditional banking to include diverse financial data like payroll, crypto, and investments, serving over 800 financial institutions and processing billions of API calls.
• FAPI (Financial-grade API) is essential for securing open financial ecosystems, providing a mandatory, standardized security profile built on OAuth 2.0 and Open ID Connect, with strict requirements for cryptography, authentication, and authorization.
• FAPI 2.0 significantly enhances security by making Pixie (Proof Key for Code Exchange) mandatory to prevent code interception attacks, and introducing PAR (Pushed Authorization Requests) and JAR (Signed Authorization Requests) to fortify authorization flows against replay attacks.
• Integrating FAPI with FIDO2 enables seamless, passwordless, and highly secure payment experiences, eliminating redirects and improving user experience while meeting strong customer authentication (SCA) regulatory requirements.
• Robust data privacy compliance (LGPD/GDPR) and continuous security testing are non-negotiable for maintaining trust and adapting to evolving threats in a dynamic financial ecosystem.
• Decentralized cloud infrastructure (like AWS) supports the scalability and resilience of open finance, but requires consistent security standards across all participating institutions.

About the Speaker(s)

Fábio Szecsik is a highly experienced cybersecurity professional from Brazil, with a career spanning over two decades since 1999. He has a rich background working with prominent "Big Four" companies such as KPMG, EY, and PWC. His expertise also includes serving as the head of cybersecurity for various organizations, including banks and industrial companies. Approximately a year prior to this talk, Fábio joined the Open Finance team in Brazil, where he currently leads the critical areas of cybersecurity, privacy, and IT operations for the nation's expansive open financial ecosystem. This presentation marked his first time speaking at the RSA Conference, an experience he described as both exciting and nerve-wracking.