Namjerno ranjiva implementacija PSD2 sučelja za demonstraciju OWASP Top 10 API ranjivosti

master's thesis

• Title (english): Intentionally vulnerable implementation of PSD2 interfaces to demonstrate OWASP Top 10 API vulnerabilities
• Author: Saša Lončarević
• Mentor: Stjepan Groš (mentor)
• Committee member: Gordan Gledec (predsjednik povjerenstva)
• Committee member: Adrian Satja Kurdija (član povjerenstva)
• Committee member: Leonardo Jelenković (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2024-07-01, Croatia

Abstract

Ovaj rad istražuje revidiranu direktivu o platnim uslugama (PSD2), regulatorni okvir Europske unije koji ima za cilj povećati konkurenciju i sigurnost u financijskom sektoru putem obaveznog otvaranja API-ja za bankarstvo. Ispituje ciljeve direktive u jačanju sigurnosti, fokusiranjem na OWASP Top 10 sigurnosnih rizika za API-je, ističući kritične ranjivosti u XS2A sučeljima. Ranjivosti su obrad̄ene na praktičnoj implementaciji XS2A sučelja. Rad opisuje ključne sigurnosne mjere i najbolje prakse za zaštitu osjetljivih financijskih podataka i osiguravanje usklađenosti s PSD2 regulativom, čime se podiže razina sigurnosti okruženja digitalnih bankarskih usluga.

Abstract (english)

This paper explores the Revised Payment Services Directive (PSD2), a regulatory framework by the European Union aimed at enhancing competition and security in the financial sector by mandating open banking APIs. It examines the directive’s goals of fostering security by focusing on OWASP Top 10 API security risks, highlighting critical vulnerabilities in XS2A interfaces.The vulnerabilities are addressed on a practical implementation of XS2A interface. The paper outlines essential security measures and best practices to protect sensitive financial data and ensure compliance with PSD2 regulations, thereby securing the evolving landscape of digital banking services.

• Keywords: Kibernetička sigurnost; FinTech; API; PSD2; OWASP Top 10
• Keywords (english): Cyber security; FinTech; API; PSD2; OWASP Top 10
• Language: croatian
• URN:NBN: urn:nbn:hr:168:541759
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2024-10-12 21:20:49