How Brazil's Banco Inter provides cybersecurity in a 100% cloud environment

Companies in the financial sector are a target for cybercriminals, but the cloud can be a very useful ally to ensure their security.

Banco Inter, one of the pioneers of digital banking in Brazil, is expanding in the US with its cloud partner AWS, where it aims to take services to the Latino community.

“The challenges [in cybersecurity] are the same anywhere in the world, but we also have a regulatory challenge because each US state has its own rules,” Douglas Rocha, director of security at Banco Inter, told journalists during the AWS Re:Inforce event in the US.

The bank participated in the legislative changes made in Brazil that allowed the modernization of banking by permitting, among other things, 100% digital operations, migration to the cloud and expansion into non-financial services.

Inter operates 100% in the cloud and AWS's infrastructure is used to maintain security for customer data.

AWS offers several layers of security, including artificial intelligence to prevent vulnerabilities in code development. 

Rocha explained that the bank has deployed the same infrastructure in the US as it has in Brazil.

Banco Inter has close to 26mn clients in Brazil and 2mn accounts in the US. In January, the company announced plans to reach 60mn clients and deliver a 30% return on equity through 2020, with a net profit of more than 5bn reais (US$1bn).

In the US, it is licensed to provide digital accounts and investments, and expects to receive a license to operate as a banking entity soon.

The company stores the information on its US and Brazilian customers in each respective country to comply with local regulations on processing personal data.

It also uses additional security measures, such as mobile phone validation, as a second authentication factor. This means that no biometric confirmation or password is required to carry out transactions as long as they are done from a validated device.

SECURITY FOR CODE

“We have code blueprints that developers and engineers can use. As a security team, we put some controls [on the code] to avoid vulnerabilities,” Rocha said.

He added that no resource can be deployed without approval. “The new code that goes into production isn't delivered to all users immediately. Only a portion of users are tested with two or three different versions in order to identify whether the new code is stable before deploying it among more customers," he said.

The most important threat that banks are currently facing has to do with social engineering. “It's a big problem, so we help fraud teams provide data for their investigations,” Rocha added.

Another area of interest for the bank involves new artificial intelligence tools. “It's something that we're continually discussing with regard to how to handle it,” he said.