...

See apache security practices for more information. https://security.apache.org 

Also, we recommend you familiarize yourself with the OWASP foundation and the "Cheat Sheet" series https://cheatsheetseries.owasp.org 

OPTIONS for Securing the Fineract Infrastructure 

...

There is a way to run those APIs endpoint (re-written but consistent) in a separate isolated component, where there is a way to control the ingress and egress of data.  Once that component is linked up with authenticated users with a fully designed authorization scheme, then the APIs can be accessed.   This is an area of exploration by the project.  Currently, Fineract should not be run in a way that allows access to those APIs.  We strongly advise against using any APP that connects to those APIs without revising the architecture as described, except in a test or demo environment.  

Additional Good Practices

(Thank you Yash Sancheti for these suggestions) 

User Education and Training:

Educating and training your team is another limb of your organizational cybersecurity defense. Equipped with engaging security awareness training sessions, end-users can be prepared with both knowledge and skills on how to identify potential security threats and react to them. You can get more information from some of the resources offered in the course during CISA Training: https://www.cisa.gov/c

Regular Security Audits and Compliance Checks:

Regularly conduct routine security audits and compliance checks. This can be helpful in finding all the vulnerabilities and their fix prior to exploitation, thereby helping to reduce the exposure window. A combined automated tool with manual expert reviews provides complete coverage.  There are multiple vendors available that scan for compliance with existing security standards.  We don't recommend any vendor in particular, but for illustration you can look at 

https://www.qualys.com/free-services/

more here... 

Key Management and Data Encryption Strategies:

Implement strong data encryption strategies to protect sensitive information. Key management should be something that your IT team does for you and utilizes best practices for this.  
You would probably want to encrypt the data at rest with AES-256 and in transit via TLS 1.3.  And remember, key management to encryption is the key.  Every cloud providers provides key management services that help you manage and secure your keys.

example:  https://aws.amazon.com/kms/

Secure Coding Practices:

Secure code by following secure coding practices and standards, such as OWASP's top ten, for any kind of vulnerability at the code level. Use tools like SonarQube for finding security problems in your source code through static application security testing (SAST) prior to deploying an application. Note that SonarQube has already been integrated into our automation build process.  

Apache Software Foundation has an account with SonarQube and fineract scans can be found in that account.  

Implementing Multi-factor Authentication (MFA):

Enhance your security layers with MFA. One such approach, built on three things: something the user knows (like a password), something the user has (like a security token), and something the user has (biometric verification, for example). When MFA is used, it adds another layer of security. Solutions such as Duo Security may be a good implementation for MFA.

Leverage Community Support:

You should stay engaged with the Fineract community to stay on top of security updates, patches, and best practices. Also, look for the possibility of collaboration with cybersecurity firms that would help you increase the capability of your threat detection and response system. Such relationships may avail specialized skills, technologies, and intelligence that may strengthen the security posturing of your organization. 

If you are a Fineract contributor, please feel free to suggest edits to this page.  

...