Page History

...

There are multiple ways to enhance the security that is built into Fineract, but none of them are bullet proof and so you must have defense in depth. One key thing is to run the fineract instance behind an API gateway, and to prevent certain API patterns or calls that are likely to be fraudulent.  The important thing is to recognize that while you may not be a target institution now, at any moment this can change, and your IP will be listed on the dark web as a potential target for exploit.  Your IT team must also have ways to quickly turn off services to limit the damage.  

It is recommended to run it with at least API Gateway, WAF (Web Application Firewall) and SQL Injection filtering tool if connecting to the internet.  Fineract must be hardened to run in production.  

Fraud Prevention 

Even if you have secured your infrastructure, you will need the ability to monitor fraudulent traffic, and then to stop that fraud in real time. Fraud can occur even when your infrastructure is good, but a user account has been accessed through a phishing attack or similar vector. And, in the world of real time payments and multiple payment types and channels, there is a need for additional real time monitoring, and inline processing of potential fraudulent transactions.  Detection and blocking needs to occur in real time and then resolution can occur more leisurely with additional manual and help desk interventions.  

...