Bluebank on the way to improve security; 19 authentic reports in the second Bagbanti event

The second Bugbunty Blue event, beyond a specialized competition, is part of the series' path to strengthen digital banking security and develop collaboration with the community of cybersecurity professionals. The participation of 80 experts and the registration of 19 valid reports have provided an opportunity to identify points that can be improved and continuously improve the Blue platform. The collection's plan to extend BugBunity to APIs and other parts of the infrastructure also suggests that this path will be a limited event.

The second Bluebank Bug Bunty event ended with the presence of 80 cyber security experts and the registration of 19 valid reports; An event in which security experts competed to identify the weak points of the Blue application. The managers of this digital bank say that security cannot be added at the end of product development, and they plan to expand the scope of these tests to APIs and other parts of the platform. According to Ambassador Arjan, in digital banking, customer trust depends on something that is not usually seen; The security of the infrastructure that is supposed to protect his money, information and everyday transactions. When transferring money or getting paid, the customer expects everything to go smoothly with a few taps on the mobile screen. But behind this simple experience, there is a set of technical and security processes that must be continuously reviewed. The second Bluebank Saman Bugbunty event was held with the same approach; A program in which cyber security researchers examined the Blue application to identify potential vulnerabilities. According to the information announced at the closing ceremony, 1465 people participated in the CTF online competition, and in the Bugbunty stage, 80 experts in the form of 25 teams reviewed the application in two days. The result of this process was the registration of 19 valid security reports. Bugbunty is one of the methods of evaluating the security of digital products, in which companies invite security researchers to identify the possible weak points of their products and report them responsibly. This method helps businesses learn about a vulnerability before it becomes a serious threat and take action to fix it.

the trust of 28 million users; A responsibility beyond a number

In the closing ceremony of the second Bugbunty event of this series, Reza Heidari, the CEO of Blue, considered user trust to be one of the most important responsibilities of digital banking and emphasized that security should be considered from the beginning of product design to the time of its use. Referring to the experience of users in using banking applications, he said: "Trust in digital banking is formed behind the mobile screen. With a few touches, the user expects to receive the services he needs with security, smoothness, and a suitable experience." Haidari, remembering the importance of money in people's daily lives, considered the responsibility of banking service providers beyond providing the possibility of making transactions. According to him, the money kept in bank accounts may be the result of a business, a family's savings, or a part of the children's future. Blue's CEO also announced the trust of 28 million people and said that this number is not just a statistical indicator, but behind each user, there is trust and expectation that creates more responsibility for the group. From this point of view, security in digital banking is not only a technical issue in the IT unit; Rather, it is part of the group's commitment to customers who have entrusted their property and part of their daily life to its services.

Why can't security be added to the product at the end?

One of the main points of Blue's CEO's speech was the necessity of continuous attention to security in all stages of product development. Heydari emphasized that security should not be added to the product as a separate feature at the end of the development process. He said: "It is not like we build an application or a product and add security to it like a spice at the end. Security begins with design and architecture, it continues in development, and the responsible discovery of vulnerabilities is part of this process." This approach is important because digital products do not remain static even after release. Changing capabilities, developing infrastructure, updating software, and changing attack methods can all transform a product's security posture. Therefore, the security evaluation of a product at the time of release is not a guarantee for its security in the following months and years. Referring to this issue, Haidari considered the activity in the field of security to be a continuous process that does not have a definite end and requires continuous review and improvement. He also described the role of security researchers as complementary to the activities of internal developers. According to Blue's CEO, the development team usually knows the expected paths for the product to be used, but the security researcher tries to find other paths that may not have been considered during design and development.

Explaining this difference, Heydari said: "The developer knows where the customer is going to go with these clicks, but the security researcher thinks what other paths these clicks can lead to." Not all clicks necessarily end up in the path we envisioned." The importance of this view is that a feature may work well under normal circumstances, but combining it with other features or using it in unforeseen circumstances can create a vulnerability. Independent security testing can help identify such situations.

19 authentic reports; The end of competition or the beginning of reform?

In another part of the ceremony, Blue's CEO appreciated the efforts of researchers to identify vulnerabilities and emphasized the importance of the process that goes through before filing a report; A process that includes trial and error, checking different paths and trying to reach a result. Heydari emphasized that the security report is not just one or two pages written, but is the result of a series of checks and technical efforts. However, the final value of these reports depends on the actions that are taken after receiving them. He said: "These reports are just the beginning of the story, we need to review them, take action and see how we can use them in the best way." In fact, registering a valid report does not mean the end of the work. The findings should be reviewed by the responsible teams, their importance and possible effect should be determined, and if confirmed, necessary measures should be taken to correct the vulnerability. Along with these measures, re-evaluation can also determine whether the correction has solved the problem or not. Heydari found the result of this cooperation to be visible in the daily experience of customers; However, users are usually not informed about security reports and details of corrections. He said: "Customers don't see your reports, but we can see their results in the peace of mind that they have when using the application, receiving payments and transferring money." CEO Blue also emphasized the need to create a culture in which identifying and announcing vulnerabilities is considered part of the product improvement process instead of causing concern or resistance. From his point of view, accepting the existence of weaknesses and making it possible to report them responsibly is a kind of investment to increase security.

From online competition to Blue application review

At the closing ceremony, Primah Mohammadpour, Chief Audit Manager of Bluebank Saman, provided more details about the structure of the second Bugbunty event of this group. According to him, Blue has been seriously pursuing activities in the field of cyber security for the past two years, and this year's event has been held as a continuation of last year's program. However, the structure of holding and the method of selecting participants have changed compared to the previous course. Mohammadpour explained that the first course was held publicly last year and a diverse range of white hat hackers and cyber security experts participated in identifying possible security challenges of the Blue application. But this year, in the second period, the process was designed in two separate parts, and the main part of Bagbanty, unlike last year, was mainly private and invitation-based. The first part was the CTF online competition "Capture the Flag". In this type of competition, the participants must solve a set of technical challenges within a certain period of time and obtain a certain badge that is intended for each challenge. According to the explanation of the chief audit manager of Bluebank Saman, 1465 cyber security experts participated in this competition. The purpose of holding CTF, in addition to solving technical challenges, was to create a path to identify and enter specialists in the Bugbunty stage. The participants of the second stage were selected from three groups: the winners and experts identified in the CTF competition, people who had an effective participation in the previous Bugbunty Blue period, and well-known figures of the cyber security community. Finally, 80 researchers were invited to participate in the Bugbunty stage. These people, in the form of 25 teams, reviewed the Blue banking application in two days to identify vulnerabilities and security issues. Mohammadpour announced that these reviews led to the registration of 19 valid reports. According to him, three teams were selected as selected teams for presenting the most important reports and were honored at the closing ceremony. Other eligible participants will also receive their awards from Blue. He also announced the change in the structure of the awards compared to the previous period and said that this year's CTF department awards are considered to be gold.

Jamal Ghazanfari, Senior Technical Vice President of Bluebank, pointed out the technical changes in the banking industry and the need to expand security assessments. According to him, the use of technologies such as microservice architecture, artificial intelligence, and automation allows for increasing the agility of operations and improving the user experience; But at the same time, it increases the complexity of the infrastructure and the scope of the parts that need to be checked for security. In such a situation, continuous security assessment becomes more important. Referring to the necessity of maintaining the trust of users and complying with the requirements of the regulatory body, Ghazanfari said that continuous testing is one of the necessary conditions to ensure the security of services. He explained: "One of the necessary conditions is continuous testing. A program like BugBunty is one of the ways in which we continuously expose ourselves to the test." BlueBank's Senior Technical Vice President also pointed out that organizations may be confident that their technical decisions are correct, but an independent review can reveal weaknesses that were not previously identified. He said that Blue has tried to expose its products to external expert evaluation despite such concerns. The cooperation of the cyber security community should be used to improve the platform. Ghazanfari stated that the goal of this cooperation is to develop an ecosystem for modern, resilient and scalable banking and asked researchers to report unknown weaknesses and vulnerabilities in a safe and responsible manner. However, the scope of this year's event reviews was mainly limited to the Blue application. According to the senior technical vice president of Bluebank, the expansion of this program to other parts was proposed in the previous period, but the conditions of the country and the events of last year limited its implementation. In explaining the future program of Blue, he said: "Our program is to give more depth to Bugbunty and expand it to public and non-public APIs and other parts that the Blue application makes available." APIs are interfaces that enable communication between software and They provide different services. In a digital banking platform, these interfaces can be part of the service delivery path to other applications and systems. Their security review, along with the evaluation of the application itself, can help identify weak points that are not necessarily visible through the normal use of the user interface. The expansion of BugBunty to these sectors, if implemented, will extend the scope of Blue's security assessment beyond what the user sees directly on the mobile screen. The second BugBunty Blue event, beyond a specialized competition, is part of the series' path to strengthen the security of digital banking and develop cooperation with the community of cyber security professionals. The participation of 80 researchers and the registration of 19 valid reports have provided an opportunity to identify points that can be improved and continuously improve the Blue platform. The group's plan to extend BugBunity to APIs and other parts of the infrastructure also shows that this path is not limited to one event.

Ultimately, the goal of these efforts is simple but important: users can use digital services more confidently and their trust supports the development of digital banking by continuously improving security and service quality.