According to the study, banking and wealth management sectors were the most likely to suffer a data breach through their CMS in the last three years. Edinburgh-based Forrit announced the findings in their report: The Content Management System market in 2023: what marketers in financial services really think. 

In the report, Forrit, an Azure-based CMS, pointed to a few key factors that would contribute to increased web vulnerabilities. Notably, 88% of financial services organisations use multiple platforms, which Forrit says contributes to their challenges. 

“A single platform which is secure, flexible, easy to use, and scalable is the simplest way to overcome all the pitfalls marketers identified around their CMS. It’s more secure and can develop alongside your organisation as it grows,” said Forrit CEO and Founder, Peter Proud, at the time of the report. 

Making a secure CMS

When looking at due diligence in keeping a CMS secure from the perspective of a CTO, Cunningham said; “It starts and continues throughout the software development lifecycle, it’s never complete and evolves for as long as the website is published.” 

“At Forrit we have built security into the core,” says Cunningham. “Our pipelines execute static, dynamic code analysis and we run open source scanning tools to ensure external packages are secure and up to date”

“Anything published is penetration tested by a certified 3rd party and is always behind a set of locked down resources that are protected by a firewall and private endpoints.  Ensuring the attack surface area is low and any of those have been extensively tested,” he said. 

Aside from addressing web vulnerabilities during the product lifecycle, vulnerabilities still exist after the product is launched. Common in content management systems, especially in financial services, is account takeover fraud, which makes up over one in ten (13%) of fraud cases in the UK. 

Researchers from Juniper research, have pointed out that because of its unique challenges in digital transformation, the banking sector will run roughly 37 billion verification checks next year, which amounts to 53% of the global verification market size in 2024. 

Cunningham points out that two factor authentication is critical to the security of a CMS. On top of this, he also recommends developing specific permissions for certain users depending on their workflow. 

“Following the principle of least privilege, only give users the level of permission for them to do their job. So if a user is a content editor, they only get the content edit role. They can’t approve content because that requires another permission level that’s maybe not part of their job, somebody else has that permission and will complete that task,” he said.

This functionality helps in situations where the CMS needs to be compliant with certain frameworks according to Cunningham. He pointed to the example of working with Tesco Bank, where the CMS it used had to be compliant with Prudential Regulatory Authority (PRA) regulations. 

“Forrit One helps companies stay compliant. Features like workflow, approval stages, audit logs, four-eye checks and the implementation of the customer’s web framework into the CMS help them stay compliant,” he said. “Once that web framework is implemented, then anyone authoring content can’t go off piste and start authoring their own mode, brand, colours, fonts or ideas.”

Part of Forrit’s strength comes from collaboration with other organisations. For example, Forrit collaborates with a company called Quorum Cyber to detect new and emerging threats. Further, the whole CMS system is built on Microsoft Azure PaaS services, meaning Forrit leverages the scale and investment Microsoft makes in the platform that underpins Forrit services. 

Sitting on top of Azure, Cunningham says that means they have to be constantly evolving. “There’s new services arriving on Azure all the time, we’ve got such a tight relationship with Azure, we’re keen to onboard all those new cognitive services as they come,” he said. 

“We’ve already got some AI integrations built into the platform,” said Cunningham. “It’s fairly subtle, like the Vision API, Search and Translate.” 

“Those services enhance the features in the CMS, the Vision API for example will generate metadata around media assets uploaded,” he continued. “The idea is to make the discovery of content within the CMS easier.”

Recommended reading

• Report: State of UK Content Management Systems
• Is Compliance-driven Tech Adoption Hurting Financial Services?
• Forrit Investing in Future with Five New Apprentice Hires

Who is Forrit

Forrit is an Edinburgh-based company founded in 2014. In April, the company raised a £5 million Series A led by the Scottish National Investment Bank. At the time, the company said they would use the funding to expand the workforce and target new markets. 

“We’ve increased the company size by about 20%,” said Cunningham. “That 20% growth has mainly come from new sales and marketing functions, however there’s been a few tech roles. We’re also still actively trying to recruit .Net Developers locally.”

While some of the new roles in marketing and sales were based in London, Cunningham said he was keen to keep the tech and engineering roles based in central Scotland, “so that we can meet up as often as possible.”

“It helps build relationships and team culture, it’s completely different to meet someone over the phone than it is to meet them in person,” he said. “You can lose that if you’re remote 100%.”