Request for Feature Enhancement to Ensure Compliance with RBI Guidelines on Encryption of User Credentials on the IBM APIC Developer Portal

On the API Connect Developer Portal, individuals accessing the Bank's API Developer Portals use TLS encryption at the network layer, which is the only encryption method provided by API Connect for data in transit. When customers submit their usernames and passwords on the Bank's side, the data is routed through the Bank's Web Application Firewall (WAF) and other network devices. According to the Bank's network layer security protocols, the internal network team intercepts and logs the traffic on network devices to identify any malicious activities. However, during this process, the network team can see usernames and passwords in plain text. This situation raises concerns for the Bank's team, as the plaintext passwords are accessible to individuals with access to the bank's private key, such as the WAF admin team and network device administrators. There are significant social engineering risks if someone were to obtain these plaintext passwords. Additionally, this practice is not compliant with the Reserve Bank of India's (RBI) security guidelines, which mandate that all passwords submitted to any web application exposed to the internet must be encrypted in the application layer. Moreover, several other major banking customers in India are experiencing same security compliance issue with IBM APIC developer portal. We will provide you the detailed message flow diagram from customer's PoV understand the issue in detail.