As discussed earlier, the Customer Security Program was introduced and mandated for all the consumers of the SWIFT services in order to maintain and ensure a minimum guaranteed security to avoid fraudulent transactions.
The customers should consider the requirements of SWIFT with the highest priority. Failure to comply is usually to be reported to the regulators on an annual basis. Every member should go through different steps such as assessment, defining, documentation, implementation, and attestation to demonstrates how the compliance of their SWIFT Local infrastructure processes and technologies with SWIFT controls mentioned below.
SWIFT CSP controls are designed to enhance the security posture of SWIFT environments operated by members and have a total of To raise the security standard of SWIFT to international standards such as NIST, PCI-DSS and ISO 27002, the authorities managed to present twenty-seven controls. They were keen to divide the security requirements into three stages such as: These are divided into 3 categories as follows.
Each of this division is again divided into several mandatory and advisory controls. After assessing each of these controls, the users must self-attest the compliance of their SWIFT local environments against Customer Security Controls Framework.
1. SWIFT Environment protection
The CSP guidelines mandate all the SWIFT related systems, data and services to be separated from the general IT environment of the organization. It is done to protect the SWIFT environment from the potential compromises and threats faced by the general IT infrastructure. This secure zone comprises of a collection of systems that works under the same access control policy. The following are the requirements at a high level.
The operator PCs and the components (defined in the CSCF) within the secure zone should not have access to the internet or whitelisted to a select few destinations that are mission-critical.
2. Operating system privileged account control
CSP guidelines mandate the operators and other users to have the bare minimum access level required to conduct business. This is mandated to prevent inadvertent or /deliberate execution of malicious programs by the operators. The privileged user events should be logged in order to maintain an audit trail in case of an incident.
During emergencies, individual accounts having administrator-level privileges or accounts having capabilities to rise to administrative access can also be used. For tracking the incidents easily, SWIFT enforced to log the administration accesses and usage. If there is no such emergency, then an account having minimum privilege is required to access.
3. Virtualization Platform Protection
For CSP-2019, the virtualization platform protection is added as an advisory control group. This specific control mandates the virtual assets hosting the SWIFT components within the secure zone to comply with international standards such as NIST, CIS, etc.
4. Internal data flow security
Another requirement of SWIFT’s CSP is to safeguard the internal data flow to minimize information leakage. It also mandates to use crypto protocol and the size of the key to be in line with international banking standards to keep the encrypted data from being breached by making use of readily available exploits to decrypt the traversing traffic. This can be done by using a single secure browser application having a multi-factor authentication system.
5. Security updates
One of the major requirements is to keep the software and hardware on operator workstations and inside the secure zone up to date. The mandatory software updates and security updates should be carried out promptly and periodic checks should be conducted to keep the services from being exploited against known available vulnerabilities. The user should frequently conduct a security risk assessment process to check for security updates and patches.
6. System hardening
The Ssystem hardening is very important to maintain good operational state for messaging interfaces. The usual system operations that are not required must be disabled to harden the services, environment, and features and a s. A Minimum Securityminimum-security bBaseline maintained in compliancet with international standards. Following requirements must be complied to achieve this:
7. Back-office data flow security
Another major requirement is to create a secure mechanism between the messaging interface and back-office applications to assure the integrity, mutual authentication, and confidentiality of the data flows between SWIFT infrastructure and applications.
8. External Transmission Data Protection
In case SWIFT related data is being transmitted for some reason to another system outside the organization’s designated Secure zone, then SWIFT Advices that the communication is encrypted using any of the encryption algorithms with a key size mandated for international banking standards.
9. Operator session confidentiality and integrity
SWIFT mandates all the interactive sessions to be encrypted. An inactive timeout should be set to a minimum timeframe within which the session to the SAA is forcefully made to expire and if the operator PC is idle for a minimum period of time, then the system should be locked requiring the operator to re-type the password.
10. Vulnerability Scanning
SWIFT mandates frequent and regular vulnerability scanning to be done against the assets within the SWIFT secure zone and the operator PCs and a mechanism to patch open vulnerabilities. And that the automated scans should be done using a reputed tool
11. Critical Activity Outsourcing
If the organization has outsourced any part of its SWIFT activity, SWIFT advices to perform a risk assessment on the third party at the start of the engagement and that the SLA/contracts reviewed regularly.
12. Transaction Business ControllsControls.
SWIFT also advises the partners to have appropriate Know Your Customer procedure to be placed for creation and maintenance of Relationship Management Application relationships and that these should be reviewed at least annually. Also, it mandates controls to be in place to monitor, flag or block any transaction initiated/approved after the bounds of business hours.
13. Application Hardening.
SWIFT advices all the applications operating within the bounds of the secure zone to a minimum-security baseline/vendor guidelines/regulatory guideline.
14. Physical Security
SWIFT mandates partners to have strict physical security in place to the housings of environment hosting the SWIFT components. This includes stringent access controls to the premises, access to the removable disks/devices, fire suppressant and electricity backup and proper CC monitoring of the premise. Also, all access should be logged and monitored
15. Password policy
SWIFT escalated the password policy to current industry standards by enforcing certain criteria:
16. Multi-factor authentication
One of the considerable prime requirements of SWIFT is multi-factor authentication which provides additional security to sensitive components of the SWIFT infrastructure. SWIFT mandates MFA to be either implemented at the Operator PCs and /PCs responsible for managing the security and network components within the secure zone or at the individual applications or at the jump server. Also, no shared account should be used.
17. Logical access control
SWIFT mandates the access to the applications and the secure zone should be provided on a need to know basis. Only the operators and application administrators should have access to the SWIFT application (through whitelisting and specific credentials). For those who have access, the privileges should be provided based on the least privilege principle. And all the processes especially the financial transaction and critical configuration changes should go through the 4-Eyes process.
18. Token Management
SWIFT mandates the distribution, access, destruction of all the tokens, PEDs, etc to be access controlled, logged and audited.
19. Personnel Vetting Process
All the operators and administrators of SWIFT related assets should be vetted periodically and assessed
20. Physical and Logical Password Storage.
SWIFT mandates the privileged passwords in the physical form to be stored in a safe which is access controlled to as few personnel as to possible and every entry and withdrawal of a credential should be logged in a physical log book mentioning, who, what, which and when.
Also, the credentials stored in the logical vault should be encrypted and logical access to the vault to be provided only to those required.
21. Malware Protection
SWIFT mandates all the endpoints to be monitored by a reputed anti-malware solution/endpoint security solution. The administrative operations of the solutions are to be disabled to the users of that endpoint and requires the endpoints to be continuously monitored. Any deviation from the acceptable configuration and action against malware should be alerted.
22. Software Integrity
SWIFT mandates integrity check on the software installed on all operators and the servers within the secure zone to be done at least once a day in addition to every time a system starts up.
23. Database Integrity
SWIFT mandates integrity checks to be conducted on the database on services hosted inside the secure zone, at a the record level ensuring there are no gaps in sequential transaction numbering.
24. Logging and monitoring
SWIFT enforced logging and monitoring system to track unusual and illicit activities in the SWIFT infrastructure within the secure zone. SWIFT mandates logging of all events of the operator PCs, the application, communication interface and the messaging interface. Logs should be offinclude but not limited to command-line history for privileged operating systems, Messaging and communication interface application and operating system, firewall and database logs.
It also mandates a defined monitoring and alerting process based on the information collected from the logs. Appropriate alerts are to configuredbe configured for any suspicious security events
25. Intrusion Detection
In addition to the basic set of controls, SWIFT also advises to incorporate and IDS solution and mechanism at either the network level or host level or both to provide an additional layer of security and to enforce Data Loss Prevention.
26. Cyber incident response planning
For effective cyber incident response and reporting, the system should require updated contact details and escalation timers. On an annual basis, a proper review should be conducted and tested to ensure secure recovery of critical business operations. AlsoAlso, if any cyber-attack took place:
27. Security Training and Awareness
SWIFT mandates all its operators and IT admins to undergo mandatory security awareness training incorporating high-level information of the various threat vectors, mechanisms and chronology of the attacks.
28. Penetration Testing
SWIFT also advices organizations to perform scenario-based penetration testing on modules of programs interacting with the SWIFT environment and the outcome documented for remediation planning
29. Scenario Risk Assessment
SWIFT advises a Scenario-based Risk assessment and planning to be conducted against the components to identify how an adversary can make a fraudulent transaction and also to identify new threat vectors. The outcome is used to plan for mitigation, incident identification and strategize contingency.
.svg)
