Financial Regulations

5 automated security scanners

SOX Compliance

Purpose: The SOX Compliance Scanner is designed to analyze and evaluate a company’s compliance with the Sarbanes-Oxley Act (SOX) of 2002, particularly focusing on the documentation and adherence to internal controls related to financial reporting. This scanner helps identify weaknesses in SOX compliance, such as inadequate audit logging, lack of strong password policies, or insufficient multi-factor authentication measures.

What It Detects:

SOX Statements Analysis: The scanner identifies and evaluates the presence and content of Sarbanes-Oxley Act statements within a company’s public documents or SEC filings.
IT Governance Compliance Checks: It verifies the existence and effectiveness of internal controls such as access management, change management, and security practices against predefined standards.
Material Weaknesses and Deficiencies: The scanner detects any significant deficiencies in control activities that could lead to material misstatement in financial reporting.
Documentation Review: It reviews the company’s documentation for adherence to SOX requirements, including audit trails, segregation of duties, and other relevant controls.
Risk Assessment: Based on the findings, it assesses the overall risk level associated with the identified deficiencies and compliance gaps.

Inputs Required:

Domain: The web address of the company’s main website or a specific page where SOX statements might be published.
Company Name: The official name of the company being assessed.

Business Impact: The Sarbanes-Oxley Act is crucial for ensuring transparency and accountability in corporate America, particularly with respect to financial reporting practices. Compliance with SOX requirements is not only a legal obligation but also a critical component of maintaining investor trust. Failure to comply can lead to severe penalties, including criminal charges and significant fines.

Risk Levels:

Critical: The scanner flags major compliance failures that directly impact the integrity of financial reporting or could lead to substantial financial loss.
High: Significant deficiencies in internal controls that pose a high risk of misstatement or non-compliance with SOX regulations.
Medium: Moderate risks associated with incomplete or partially effective control frameworks.
Low: Minimal compliance issues that do not significantly impact the overall regulatory posture but still need attention for continuous improvement.
Info: Informal findings indicating areas where improvements could enhance future risk assessments and compliance efforts without immediate operational impacts.

Example Findings:

The company lacks a documented audit logging policy, which is a critical component of maintaining financial transaction integrity.
There are no provisions for mandatory multi-factor authentication for all users accessing sensitive financial data, posing significant security risks.

This scanner plays a vital role in ensuring that organizations adhere to stringent regulatory standards, thereby mitigating potential legal and operational risks associated with non-compliance.

Payment Service Regulations

Purpose: The purpose of this scanner is to analyze and assess compliance with payment service regulations for given domains and companies. It collects information about Strong Customer Authentication (SCA) implementations, API security measures, dispute procedures, confirmation requirements, regulatory licensing, and fraud prevention mechanisms from the provided domain’s public statements.

What It Detects:

Strong Customer Authentication Implementation: This scanner identifies whether the company has documented its implementation of Strong Customer Authentication, including support for biometrics and exemptions handling.
API Security Measures: The scanner checks if API security measures such as OAuth2 documentation, client certificates, webhook signatures, rate limiting, and overall API authentication are in place.
Dispute Procedures: It evaluates the presence of documented dispute filing processes, chargeback handling policies, refund policies, and evidence requirements for transactions.
Confirmation Requirements: The scanner verifies if there is a documented process for transaction confirmations, receipt generation, status notifications, real-time updates, and content confirmation.
Regulatory Licensing: It assesses the disclosure of payment service licenses and compliance with card network regulations.
Fraud Prevention Mechanisms: This includes evaluating the presence of fraud detection capabilities and velocity controls implemented across the platform.

Inputs Required:

Domain: The target domain for analysis, which is used to fetch public statements from the company’s website or API endpoints.
Company Name: Identifies the entity whose compliance with payment service regulations needs to be assessed.

Business Impact: Ensuring compliance with payment service regulations is crucial as it directly impacts consumer trust and security in financial transactions. Non-compliance can lead to severe penalties, legal issues, and damage to a company’s reputation. This scanner helps organizations identify gaps in their regulatory compliance, enabling them to take proactive steps towards improvement and mitigation of potential risks.

Risk Levels:

Critical: The critical risk level is triggered when there are significant non-compliance findings that pose immediate threats to financial security and consumer trust.
High: High risk levels are assigned when multiple important compliance gaps are identified, indicating a substantial vulnerability in the regulatory compliance framework.
Medium: Medium risk levels are set for moderate compliance deficiencies that could lead to operational disruptions or legal consequences but do not pose an immediate threat.
Low: Low risk levels are indicated by minor non-compliance issues that have minimal impact on security and operations, typically considered acceptable based on the context of the findings.
Info: Informational findings are noted for conditions that are purely informative and do not indicate any significant compliance gaps or vulnerabilities.

Example Findings:

The company has not documented its implementation of Strong Customer Authentication, which is a critical requirement for enhanced security in financial transactions.
There is no evidence of OAuth2 documentation for API authentication, posing a high risk as it directly affects the security and integrity of data exchanges with third-party services.

GLBA Compliance

Purpose: This scanner is designed to evaluate the compliance of a company with the Gramm-Leach-Bliley Act (GLBA) regarding privacy and information security. It checks for the presence of privacy statements, disclosure of information sharing practices, opt-out rights, existence of an information security program, enforcement of HTTPS, documentation of encryption safeguards, and employee training in security.

What It Detects:

Presence of Privacy Statements: The scanner identifies whether a company has published any privacy or security notices that are crucial for GLBA compliance.
Information Sharing Practices: It checks if the statements disclose how personal information is shared with third parties, which is mandatory under GLBA.
Opt-Out Rights: It verifies if there’s a clear process for customers to opt out of sharing their information, essential for GDPR compliance as well.
Existence of Information Security Program: The scanner looks for documented policies and procedures that outline how the company manages and protects customer data according to GLBA requirements.
Enforcement of HTTPS: It assesses whether the main website enforces secure communication using HTTPS, which is necessary for protecting sensitive information during transmission.
Documentation of Encryption Safeguards: The scanner checks if encryption methods are documented in privacy policies, ensuring that data handling complies with GLBA’s security standards.
Employee Training: It evaluates whether there’s evidence of regular training programs for employees to ensure they understand the importance of protecting customer information as per GLBA regulations.

Inputs Required:

<domain>: The internet domain name under investigation, e.g., “acme.com”.
<company_name>: The official or recognizable name of the company associated with the domain, e.g., “Acme Corporation”.

Business Impact: Ensuring compliance with GLBA is crucial for maintaining trust and confidence in financial institutions by protecting consumers’ personal information from misuse. Non-compliance can lead to severe penalties, legal issues, and damage to reputation.

Risk Levels:

Critical: The scanner flags critical findings if the domain does not have a privacy statement or if there’s evidence of non-compliance with GLBA requirements despite warnings in earlier risk levels.
High: This severity level is triggered when significant gaps in compliance are identified, such as missing encryption documentation or incomplete information security programs.
Medium: Medium risk findings occur when the scanner detects partial compliance or where there’s a lack of transparency regarding data handling practices and policies.
Low: Low risk findings are observed for minor non-compliance issues that do not significantly impact trust in the company’s financial services.
Info: Informational findings are noted for scenarios where compliance is marginally adequate but does not meet all GLBA requirements, prompting further investigation or improvement.

Example Findings:

A prominent bank fails to mention its adherence to GLBA in any privacy policy, indicating a critical gap in compliance.
An e-commerce site lacks HTTPS encryption on its main page despite handling sensitive financial data during transactions, posing a high risk of data breach and significant non-compliance with GLBA.

PCI DSS Compliance

Purpose: This scanner evaluates the PCI DSS compliance of a given domain and company by analyzing various aspects such as HTTPS enforcement, TLS version support, mixed content, card input detection, tokenization status, iframe isolation, local storage usage, autocomplete settings, insecure scripts, missing SRI, weak security headers, and presence of PCI DSS compliance documentation.

What It Detects:

HTTPS Enforcement: Checks if the domain enforces HTTPS for all pages.
TLS Versions Supported: Identifies the supported TLS versions on the server.
Mixed Content Detected: Scans for mixed content where both HTTP and HTTPS are served from the same origin.
Card Input Detected: Detects presence of card input fields that could be vulnerable to attacks.
Tokenization Detected: Verifies if tokenization is implemented on payment forms to protect sensitive data.
Iframe Isolation: Checks for improper configuration in iframes which might lead to security risks.
Local Storage Usage: Monitors the use of local storage that could expose user data.
Autocomplete Enabled: Identifies whether autocomplete functionality is enabled on card input fields, potentially exposing sensitive information.
Insecure Scripts: Detects scripts loaded over HTTP instead of HTTPS which are less secure.
Missing SRI: Checks for Subresource Integrity metadata missing in critical payment scripts to prevent tampering.
Weak Headers: Identifies the absence or weakness of security headers that could be bypassed by attackers.
Compliance Documentation Found: Verifies if there is any documentation available regarding PCI DSS compliance.

Inputs Required:

Domain: The target domain for assessment.
Company Name: The name of the company associated with the domain.

Business Impact: Ensuring PCI DSS compliance is crucial as it directly impacts the security and integrity of financial transactions, potentially leading to significant fines and reputational damage if not adhered to properly. Compliance also helps in safeguarding sensitive customer data from breaches.

Risk Levels:

Critical: If multiple critical issues are found such as missing HTTPS enforcement or presence of high-risk vulnerabilities like insecure scripts without SRI.
High: Issues that significantly impact security, such as weak headers and improper configuration of iframes.
Medium: Vulnerabilities with moderate risk but still need attention, including mixed content detection and local storage usage in sensitive areas.
Low: Informal findings or minor issues that do not pose a significant threat to the system’s security.

Example Findings:

The domain does not enforce HTTPS for all pages, which is a critical issue as it exposes data in transit to potential eavesdropping.
A card input field lacks autocomplete protection, risking exposure of sensitive information when users navigate away from the form and then return.

AML Compliance

Purpose: This scanner analyzes Anti-Money Laundering (AML) compliance statements for a given domain and company. It identifies key components of AML compliance, such as Customer Identification Program (CIP), Customer Due Diligence (CDD), Transaction Monitoring, Sanctions Screening, and SAR filing procedures. The findings are used to assess the overall risk level based on identified gaps in compliance documentation.

What It Detects:

Customer Identification Program (CIP): Identifies whether the company has documented its CIP components such as identity verification and collection of necessary documents.
Customer Due Diligence (CDD): Scans for evidence of risk-based approach, enhanced due diligence, ongoing monitoring, and proper screening against Politically Exposed Persons (PEP).
Transaction Monitoring: Checks for the existence of a transaction monitoring system, detection of suspicious activities, threshold monitoring, and pattern recognition.
Sanctions Screening: Evaluates the presence of sanctions screening procedures including OFAC screening and real-time updates.
SAR Filing Procedures: Assesses whether SAR filing is documented and adheres to retention requirements.

Inputs Required:

domain: The target domain for which AML compliance statements are sought.
company_name: The name of the company whose AML compliance is being assessed.

Business Impact: Ensuring robust Anti-Money Laundering practices is crucial to prevent financial crimes and maintain trust in the financial system. Poor AML compliance can lead to severe legal consequences, reputational damage, and loss of customer confidence.

Risk Levels:

Critical: The company has no documented CIP components, lacks risk-based approach in CDD, does not implement transaction monitoring or sanctions screening, and fails to file SARs according to regulations.
High: Incomplete documentation of AML practices such as missing identity verification steps, insufficient due diligence, or inadequate transaction monitoring.
Medium: Partially documented compliance processes that partially meet regulatory requirements but have significant gaps.
Low: Well-documented compliance with minimal identified gaps that do not significantly impact financial risks.
Info: Informal compliance without critical flaws but with some room for improvement in documentation and implementation.

Example Findings:

A company fails to provide evidence of identity verification during customer onboarding, which is a significant gap in their AML practices.
The transaction monitoring system lacks provisions for identifying suspicious transactions or thresholds that are not clearly defined, posing potential risks for financial irregularities.