1. Customer Security Programme ACSDA Cyber Security Workshop
Dan Moran, SWIFT Solution & Security Architecture

2. Customer Security Work Session

3. CSP | An Overview
Customer Security Programme (CSP) Launched in May 2016, the CSP supports all customer segments in reinforcing the security of their local SWIFT-related infrastructure
You
Secure and Protect
SWIFT Tools
Security Controls Framework
Your
Community
Share and Prepare
Intelligence Sharing
SWIFT ISAC Portal
Your
Counterparts
Prevent and Detect
Transaction Pattern Detection –
RMA, DVR and ‘In Flight’ Sender Payment Controls
Customer Security Work Session

4. CSP | Modus Operandi Attackers are well- organised and sophisticated
There is no evidence that SWIFT’s network, core messaging services or OPCs have been compromised
All IOC details are published on the SWIFT ISAC portal
Step 1
Step 2
Step 3
Step 4
Attackers compromise customer's environment
Attackers obtain valid operator credentials
Attackers submit fraudulent messages
Attackers hide the evidence
Malware injected by phishing, USB device, rogue URL or insider
Long reconnaissance period monitoring banks’ back office processes
Keylogging / screenshot malware looking for valid account ID and password credentials
Attacker impersonates the operator / approver and submits fraudulent payment instructions
May happen outside the normal bank working hours / over public holiday
Gain time by:
Deleting or manipulating records / log used in reconciliation
Wiping Master Boot Record
Heat
Customer Security Work Session

5. CSP | A case study
Customer Security Work Session

6. Ab(use) of New Technology
CSP | Evolution of the Threat Landscape
Industry Reliance on the Cloud
Overhead of constantly patching critical software vulnerabilities
'Arms-Race' as New Technologies Mature – AI and Machine Learning
Ab(use) of New Technology
Rise in intense DDoS Attacks
Rise in Ransomware
Evolving Zero-Day APTs
Advanced ‘Undetectable’ Malware
Larger Data Breaches
(Possible) Targeting of Critical Infrastructure
Evolving
Cyber
Threat
Landscape
Endless (Spear) Phishing
Rise in Insider Threats – The Enemy Within
Deep Skills Shortage
Evolving
Attack Vectors
The
Weakest
Link
Geo-political tensions, macro- economic trade instability and ongoing conflicts
Nation states have used cyberattacks as a way to counter aggression from geopolitical rivals
GDPR with Fines for PII Breaches
CPMI-IOSCO Cyber Resilience for FMIs
ECB Cyber Resilience Oversight Expectations for FMIs
Geo Political
Tensions
New
Regulation
Customer Security Work Session

7. CSP Security Controls Framework
CSP | Secure and Protect – Customer Security Controls Framework v1
Security Controls
CSP Security Controls Framework
Secure Your Environment 1.
Restrict Internet access 2.
Segregate critical systems from general IT environment 3.
Reduce attack surface and vulnerabilities 4.
Physically secure the environment
Know and Limit Access 5.
Prevent compromise of credentials 6.
Manage identities and segregate privileges
Detect and Respond 7.
Detect anomalous activity to system or transaction records 8.
Plan for incident response and information sharing 3
Objectives 8
Principles
Applicable to all customers and to the whole end-to-end transaction chain beyond the SWIFT local infrastructure
Mapped against recognised international standards – NIST, PCI- DSS and ISO 27002
16 controls are mandatory, 11 are advisory 27
Controls
Customer Security Work Session

8. CSP | Security Controls – Mandatory and advisory 1/3
Advisory controls are notated with an "A" after the control number (for example, "2.4A")
The security controls applicable for architectures A1, A2, and A3 are identical. These architectures are referenced collectively on the following pages as type “A”. Fewer security controls apply to users that utilise architecture type "B”.
Customer Security Work Session

9. CSP | Security Controls – Mandatory and advisory 2/3
Advisory controls are notated with an "A" after the control number (for example, "2.4A")
The security controls applicable for architectures A1, A2, and A3 are identical. These architectures are referenced collectively on the following pages as type “A”. Fewer security controls apply to users that utilise architecture type "B”.
Customer Security Work Session

10. CSP | Security Controls – Mandatory and advisory 3/3
Advisory controls are notated with an "A" after the control number (for example, "2.4A")
The security controls applicable for architectures A1, A2, and A3 are identical. These architectures are referenced collectively on the following pages as type “A”. Fewer security controls apply to users that utilise architecture type "B”.
Customer Security Work Session

11. CSP Security Controls Framework
CSP | Customer Security Controls Framework v2019
Security Controls
CSP Security Controls Framework
Secure Your Environment 1.
Restrict Internet access 2.
Segregate critical systems from general IT environment 3.
Reduce attack surface and vulnerabilities 4.
Physically secure the environment
Know and Limit Access 5.
Prevent compromise of credentials 6.
Manage identities and segregate privileges
Detect and Respond 7.
Detect anomalous activity to system or transaction records 8.
Plan for incident response and information sharing 3
Objectives 8
Principles
19 controls are mandatory – 3 advisory promoted:
2.6 Secure Operator sessions
2.7 Yearly vulnerability scanning
5.4 Physical and Logical Password Storage
10 controls are advisory - 2 new advisory controls:
1.3A Virtualization Platform Protection
2.10A Application Hardening
Full compliance against mandatory controls by end 2019
CSP will reinforce and evolve the security of global banking, in the face of ever-increasing cyber threat, consolidating and building upon existing SWIFT and industry efforts. Within the scope of CSP:
Define new security guidelines and audit frameworks - We will introduce new audit frameworks and certification processes to help you ensure that your internal procedures meet key security and operational baselines
Enhance SWIFT-related tools - We are strengthening the security requirements for customer-managed software. We will also continue our efforts to harden our own products with further tools and monitoring capabilities
Information Sharing - We are supporting greater levels of information sharing across the global community. This means a greater exchange of cyber threat information between customers and SWIFT, and we’ll be keeping you informed of any preventive and detective measures that will help safeguard the community
CSP will be limited to customer infrastructure and operations related to SWIFT, both SWIFT products and services as well as third party software products. Scope includes cyber security incidents, either actual or planned, that could result in:
Compromise of SWIFT infrastructure, products, services or SDC
Fraudulent SWIFT messages being carried over the SWIFT network, or other networks
Breach of confidential information, e.g. disclosure of SWIFT message payloads
Scope also includes messages generated by back-office applications 29
Controls
Customer Security Work Session

12. CSP Update| Customer Security Controls Framework v2019
Raise the bar – new advisory controls
1.3A Virtualization Platform Protection
2.10A Application Hardening
Control
Request
Proposed Change
1.1 SWIFT Environment Protection
Introduce proper usage of a certified interface
Add an advisory control (to start) asking to configure the certified interface, or implement relevant mitigations, as per vendor security guidance
Introduce guidance on virtualised environment
Add an advisory control (to start) asking to locate and manage the box appropriately ensuring segregation so that compromising one virtual machine doesn’t affect the others
2.3 System Hardening
Introduce Application Hardening
Add an advisory control (to start) asking to configure the interface as per vendor security guidance and conscious risk based approach
Raise the bar – advisory controls promoted to mandatory
Control
Request
Proposed Change
2.6A Operator Session Confidentiality and Integrity
Make mandatory secure protocols for human interactive sessions
Secure protocols, ensuring also confidentiality of privileged credentials, to be ensured for applicative or admin flows towards secure zone components
2.7A Vulnerability Scanning
Make mandatory yearly scanning and act upon results
Vulnerability scans help to identify unpatched or not updated systems prone to defacement in a world where vulnerabilities are almost daily disclosed.
5.4 A Physical and Logical Password Storage
Make it mandatory
Address external storage of credentials
Customer Security Work Session

13. CSP | Evolution of the Controls Framework (CSCF)
2017:
Self-Attestation of your level of Compliance by 31Dec17
2018:
Self-Attestation of Compliance by 31Dec18
2019:
Self-Attestation of Compliance by 31Dec19 (additional controls promoted to mandatory)
With the release of CSCF v2020 we will formally require that All attestations be further substantiated by an Internal or External Assessment
2020:
Independent Assessment to substantiate Attestation of Compliance by 31Dec20
Customer Security Work Session

14. CSP | Compliance with security controls
All customers need to self-attest that they fully comply with all mandatory security controls by 31 December 2018.
Self-attestations need to be renewed every 12 months.
Customer Security Work Session

15. CSP | Regulatory Reporting
To encourage community transparency, SWIFT will report the status of users that fail to complete their self-attestation to their local supervisors.
From Q – and every six months thereafter – SWIFT will report the status of users that have failed to self-attest compliance with all the mandatory security controls to their local supervisors
Customer Security Work Session

16. CSP | Attestation Consultation
Users should consider to consult counterparty attestation data and integrate this into their risk management and business decision-making processes.
Using the KYC-SA, customers can share their attestation data with their counterparties and request data from others.
Customers remain in control of their attestation data – they can grant or deny requests of their attestation data.
Customers may make their compliance status available to their counterparties ,providing transparency and allowing other users on the network to apply risk-based decision making regarding their counterparty relationships.
While each user retains authority over their own data, users will be able to grant access to allow their counterparties to view their self-attestation status.  
This fosters transparency, and creates peer-driven momentum to improve security by allowing other users on the network to apply risk-based decision-making concerning their business relationships.
Customer Security Work Session

17. CSP | Quality Assurance
Risk indicators
Non-Attestation
Irregular Compliance
Low Consultation
Deficient Activity for High Volume/ Connected users
Deficient activity from high-risk regions
SWIFT has identified a set of risk indicators to track the overall effectiveness and quality of the Customer Security Controls Framework and associated activities (i.e., attestation, compliance, consultation)
If the risk indicators (either individually or collectively) suggests an underlying problem, SWIFT will evaluate the information, engage the community or segment, make a formal recommendation, and execute the appropriate corrective actions.
Each risk indicator has specific measurements to track the indicator. Additionally, the QA process will examine compound risk across multiple indicators.
Risk thresholds will not be defined at this time.
Additional insights will be captured through surveys and engagement with Users, Community groups, Vendors, Auditors & Consulting firms, and other stakeholders.
SWIFT has identified a set of risk indicators to track the overall effectiveness and quality of the Customer Security Controls Framework and associated activities (i.e., attestation, compliance, consultation)
If the risk indicators (either individually or collectively) suggests an underlying problem, SWIFT will evaluate the information, engage the community or segment, make a formal recommendation, and execute the appropriate corrective actions.
Each risk indicator has specific measurements to track the indicator. Additionally, the QA process will examine compound risk across multiple indicators.
Risk thresholds will not be defined at this time.
Additional insights will be captured through surveys and engagement with Users, Community groups, Vendors, Auditors & Consulting firms, and other stakeholders.
Auditors & Consulting firms – engage all who have registered on SDC and more specifically those flagged as used by customers in KYC-SA
Vendors – includes SIP, Infrastructure providers and ourselves as an Infrastructure provider, for example monitoring patch/update implementations
Other stakeholders could include
Supervisors/regulators engaging the community
Bi-lateral engagement
Industry views – what we are hearing from other providers
CSI analytics - on segments, locations, providers, etc. that have had incidents
Customer Security Work Session

18. Your Counterparts You Your Counterparts Your Community
SWIFT is helping its customers to improve the prevention and detection of fraud in operational processes.
You
Secure and Protect
SWIFT Tools
Customer Security Controls Framework
Your
Counterparts
Prevent and Detect
Relationship Management Application
Daily Validation Reports
Payment controls
Your
Community
Share and Prepare
Intelligence Sharing
SWIFT ISAC Portal
[Your counterparts]: To improve the prevention and detection of fraud in operational processes
Customer Security Work Session

19. Reporting 1 Alerting 2 Daily Validation Reports
Module 1
Reporting
Daily Validation Reports
Activity and Risk reporting
Inbound and Outbound
Group and/or Entity reporting
Module 2
Alerting
Real-time alerting/blocking
Outbound
Subscriber-controlled rules
Customer Security Work Session 19

20. Module 2
Rule types
Threshold
Protect against individual and aggregated payment behaviour that is a potential fraud risk or falls outside of business policy
Profiling/
Learning
Identify & protect against payment behaviour that is uncharacteristic, based upon past learned behaviour
Identify & protect against payment behaviour that is uncharacteristic, based upon past learned behaviour
Business
Calendars
Identify payments that are sent on non-business days or outside normal business hours
Suspicious
Accounts
Verify end customer account numbers against an institution black list of account numbers believed to be high risk
New
Institutions
Identify payments involving individual institutional participants or chains that have not been seen previously, based upon historical message flows
Badly
Formed
Messages
Identify and stop messages where preceded by repetitive NACKs to the same recipient
Rule types include:
Threshold: Protect against individual payments and aggregated payment behaviour that indicate potential fraud risk or fall outside of business policy
Profile learning: Identify and protect against payment behaviour that is uncharacteristic, based on past learned behaviour
Business calendars: Identify payments sent by the subscribing institution on non-business days or outside of normal business hours
Suspicious accounts: Verify end customer numbers against the customer bank’s ‘black list’ of institutions believed to be high risk
New institutions: identify payments from the customer bank involving new institutions, or payment chains that have not been seen previously in historical message flows
Badly formed messages: Identify and stop messages from the customer bank to the same recipient that have been preceded by repetitive NACKs based on improper formatting
Customer Security Work Session

21. ? ! ü û ü û Monitoring capabilities 2 2 Flexible parameters including:1
Module 2
Monitoring capabilities
ACC:1234 7
Flexible parameters including:
Business hours and days
Currency whitelist / blacklists, single & aggregate payment limits
Country whitelist / blacklists, single & aggregate payment limits
Country & currency threshold combinations
Single & group institution limits
New payment flows
Suspicious accounts
Uncharacteristic behaviours
Across the complete payment chain
60M 4 4M 5 6 ? 8 ! GB US CA CN ü
10M AU AM KZ IR
20M û 3
To demonstrate how you can flexibly institute rules to express your payment policy, real-time monitoring allows you to:
Define your business days and hours
You can blacklist and whitelist single and aggregated payment thresholds across currencies, countries and counterparties and combine these metrics:
I this example I am whitelisting $, €, and £, as well as Australian Dollars up to 10M, Japanese Yen up to 5M and blacklisting Russian Rouble, as I do not transact in this currency.
I can do the same with countries: Here I whitelist US, GB and CA, and CN up to a limit of 10M and AU up to a limit of 20M. All other countries are blacklisted, so if payment go to these countries I want to be alerted on this.
I can combine metrics: Here I send € and £ to the UK but only up to a value of 60M for each currency.
I can set a payment threshold to a specific set of institution: here I am sending Australian Dollars of up to 4M to 5 specific whitelisted entities in Australia.
You can be alerted to new payment flows: here I am sending a payment to China and want to know if this is routed via Africa.
You can define a list of high-risk end customer accounts.
And finally you can be alerted to uncharacteristic behaviour: here I am sending a payment to SA, but wouldn’t send this in USD.
You can monitor across the payment chain, meaning that if you are sending payments as the Originator you can monitor all parties in the payment chain right down to the Beneficiary. If you are the sending correspondent (Counterparty), you may want to understand where the payment is coming from (monitor the Originator) as well as further down the payment chain.
Originator
Intermediary
Beneficiary
Counterparty
Customer Security Work Session 21

22. Your Community You Your Counterparts Your Community
SWIFT has deepened its cyber security forensics capabilities, providing unique intelligence on customer security-related events. This information is disseminated to the community in an anonymised manner.
You
Secure and Protect
SWIFT Tools
Customer Security Controls Framework
Your
Counterparts
Prevent and Detect
Transaction Pattern Detection –
RMA, DVR and Payment Controls
Your
Community
Share and Prepare
Intelligence Sharing
SWIFT ISAC Portal
NOTE FOR THE INSTRUCTOR
[Your community]: To use our position as a global cooperative to drive information and intelligence sharing to prevent future attacks
The financial industry is global, and so are the cyber challenges it faces. What happens to one company in one location can be replicated by attackers elsewhere, so a global community effort will strengthen cyber defences.
(Since March 2016) a dedicated Customer Security Intelligence team has been introduced to help limit community impact by sharing anonymous information in a confidential manner on Indicators of Compromise (IOCs) and by detailing the modus operandi used in known attacks.
(Since August 2016) we expanded notification capabilities to ensure that all customers can subscribe to SWIFT’s latest operational security information.
Prior to and throughout the programme SWIFT has regularly been informing its customers of relevant cyber intelligence, new market practices and recommendations. Specifically SWIFT has been building a Chief Information Security Officer (CISO) network and engaging in bilateral CISO level meetings within the community to increase collaboration and information sharing.
We have now released the SWIFT Information Sharing and Analysis Centre in mySWIFT which will provide this same information in a dynamic format including the list of Bulletins, External References, the relevant details and the ability to download the information.
Customer Security Work Session

23. CSP | From Customer Incident Handling to Information Sharing
User fixes its environment
SWIFT undertakes forensic analysis, with User
User identifies suspicious activity
User informs SWIFT or SWIFT receives an auto-alert
SWIFT publishes anonymised threat intelligence to community
SWIFT Community
ISACs / CERTs
LEAs / Regulators
Customer Security Work Session

24. CSP | SWIFT ISAC Portal
A 2nd release of SWIFT ISAC global information sharing portal was issued in February
This will enable the automated exchange of cyber-threat information using industry standard formats (STIX/TAXII) and allow access for non-SWIFT customers
The SWIFT ISAC continues to share threat intelligence with the community, including, indicators of compromise such as file hashes and details about malware samples observed. When possible, Modus Operandi used by attackers is described and machine-digestible files are provided (YARA rules, OpenIOC, etc.)
Share and Prepare (Your community)
On 15 May we released the SWIFT Information Sharing and Analysis Centre portal in mySWIFT which will provide this same information in a dynamic format including the list of Bulletins, External References, the relevant details and the ability to download the information. Customers can now access the Portal on SWIFT.com. Further information is currently on SDC homepage news.
Customer Security Work Session

25. CSP | Supporting the Community Where can I go if I need help?
CSP pages
Visit the CSP pages for programme news and updates
MySWIFT
A self-service portal containing “how-to” videos, guidance on frequently asked questions and Knowledge Base tips.
swift.com
SWIFT ISAC Portal
Consult the portal for information related to security threats
User Handbook
SWIFT Customer Security Controls Policy
SWIFT Customer Security Controls Framework
KYC-SA Registry Baseline
KYC-SA Registry User Guide
Knowledge Base
KYC-SA Quick-Start User Guide: Tip
How-to video’s:
Tip : KYC-SA Role Families
Tip : KYC-SA Administration
Tip : KYC-SA Data Contribution
Tip : KYC-SA Data Consumption
Customer Security Work Session

26. CSP | Supporting the Community Need more help?
SWIFTSmart
The SWIFTSmart e-learning training platform includes a portfolio of modules, including in-depth modules on each of the mandatory security controls
SWIFT Customer Support
SWIFT Customer Support teams are on hand 24/7 to answer specific queries if you don’t find the information resources you are looking for.
Directory of Cyber Security Service Providers
If you need practical, on-the-ground implementation support, you can consult the Directory of Cyber Security Service Providers on SWIFT.com to help find a third-party project partner that may be suitable for your needs.
SWIFT Services
To support best practices in infrastructure implementation and management SWIFT offers services such as the SWIFT infrastructure security review, Security bootcamps, SWIFT Admin. and Operation certifications, and recurring support contracts such as Alliance Managed Operations, Local support and Premium custom support.
Customer Security Work Session

27. CSP | Call to action for SWIFT users1
Ensure that you fully comply with all the mandatory security controls and re-attest by December 2018 latest. 2
Engage in SWIFT ISAC, sign up for notifications – and contact us immediately if you suspect a breach of your SWIFT related-infrastructure 3
Ensure mandatory security updates of SWIFT software are installed.
Request access to your counterparties attestation and grant access to your institution’s attestation (where appropriate). Consider your institution’s counterparty risk frameworks to utilise counterparty attestation data. 4 5
Consider SWIFT’s anti-fraud tools (Payment Controls, Daily Validation Reports, RMA clean-ups, etc.)
SWIFT ISAC: We are encouraging customers to subscribe to the SWIFT ISAC so they can benefit from details on indicators of compromise (IOC), information about malware samples observed, and descriptions (when possible) of the modus operandi used by attackers. The SWIFT ISAC now allows the automated exchange of information relating to cyber threats, using industry standard formats (STIX/TAXII).
SWIFT software: We are reminding customers about the mandatory Alliance and SWIFTNet Release 7.2, which provides a number of security enhancements and related features and must be implemented no later than November As part of the upgrade to Release 7.2 customers must install the latest software updates, including the latest fixes. Release 7.2 must be implemented before customers can implement release 7.3.
Mandatory security controls: The priority for 2018 is for customers to confirm compliance with all the mandatory security controls and close any gaps they have identified in their initial assessment of compliance with the mandatory controls. There are no changes to the current Customer Security Controls Framework v1 (v2018), against which customers must re-attest before the expiration of the one-year validity period of their current attestation.
Counterparty Risk Frameworks: Customer should start to request access to their counterparties’ attestation details and give permission for counterparties to view theirs, where appropriate. Customers can start an online evaluation of their counterparties’ self-attestation data in the KYC-SA application and to record the high-level outcome of such evaluations against their cyber risk management framework and policies business decision-making processes, along with other risk considerations such as KYC, sanctions and AML.
Anti-fraud tools: Anti-fraud tools (i.e. Daily Validation Reports, Payment Controls) can help customers by analysing data and looking for trends and anomalies that can help to pre-empt potential attacks. SWIFT’s Relationship Management Application (RMA) also plays an important part in supporting trusted communication between different users. We encourage customers to regularly review and clean up RMA relationships and to consider the adoption of RMA Plus, which allows them to control which message types they accept to receive from and send to their counterparties.
Customer Security Work Session

28. What is the local community experience?

29. We asked User Group Chairperson to take a survey on CSP……
Local regulator(s) is strongly supportive and has already initiated rules / policies / initiatives to ensure early compliance with CSP
Local regulator(s) is supportive and actively encouraging local participants to comply with CSP
Local regulator(s) is positive of CSP, either publically or in-person
Local regulator(s) is agnostic / non-judgemental and has not really commented on CSP
Local regulator(s) is sceptical or negative, e.g. have similar 'competing' scheme and CSP confuses the picture and diverts resources
“For your local market, what has been the reaction / perception of the local Regulator(s) / Supervisor(s) for the CSP Programme?
Give positive / negative comments”
Customer Security Work Session

30. Local regulators involvelment

31. NMG/UG survey results – general comments (n=93 comments)
Areas needing attention examples:
Need support for local languages
Lack of skilled resources
Competing projects and priorities
Budget issues
Differing interpretation / overly complex controls
Insufficient implementation time
No regulatory oversight for Corporates
Conflict with internal policies
73%
27%
Positive comment examples:
Raised awareness with senior management
Strong community awareness
Clear controls, definition guidance and support from SWIFT
Alignment with existing controls ISO / NIST frameworks
Some overseers using CSP as role model example
Established strong ties with local community
Strong alignment with local regulation
Strong community / industry support

32. Customer Security Program - Sibos 2018