Audit Program/Checklist for SWIFT Infrastructure and Operating Environment - $45.00

swift infrastructure audit
swift infrastructure

Terms & Conditions and Privacy Policy

About The Author


Abstract

The SWIFT network provides a platform for participating financial institutions to exchange financial transaction information/messages that enables international payment in a reliable, secure and standardized manner. To do this, each participating financial institution can be identified on the SWIFT platform with Business Identifier Codes (BICs) also known as “SWIFT code”.

Given the volume of transactions that go through SWIFT network on daily basis, which has been estimated to be about 15 million with value in hundreds of billions of dollars (USD), the need to ensure end-to-end transaction and data exchange security on SWIFT platform cannot be overemphasized. With growing and worrisome cyber attacks that were recorded on SWIFT network in the past, particularly in 2016, SWIFT issued a new Customer Security Control Framework (CSCF) program that provided control frameworks for securing SWIFT local infrastructure and operating environment by identifying 22 mandatory and 9 advisory/optional controls (CSCF Version 2021), which participating customers worldwide put at over 11,000 need to comply with and attest to for continued participation in the SWIFT global transaction messaging network.

The control framework was built around 3 objectives, which are; Secure Operating Environment; Know and Limit Access; and Detect and Respond to incidents with 8 core principle that gave rise to 31 security controls (22 mandatory and 9 optional/advisory) as highlighted below.

1. Restrict Internet Access & Protect Critical Systems from General IT Environment

  • 1.1 SWIFT Environment Protection (Mandatory)
  • 1.2 Operating System Privileged Account Control (Mandatory)
  • 1.3 Virtualization Platform Protection (Mandatory)
  • 1.4A Restrict Internet Access (Advisory)

2. Reduce Attack Surface and Vulnerabilities

  • 2.1 Internal Data Flow Security (Mandatory)
  • 2.2 Security Updates (Mandatory)
  • 2.3 System Hardening (Mandatory)
  • 2.4A Back-Office Data Flow Security (Advisory)
  • 2.5A External Transmission Data Protection Security (Advisory)
  • 2.6 Operator Session Confidentiality and Integrity (Advisory)
  • 2.7 Vulnerability Scanning (Mandatory)
  • 2.8A Critical Activity Outsourcing (Advisory)
  • 2.9A Transaction Business Controls (Advisory)
  • 2.10 Application Hardening (Mandatory)
  • 2.11A RMA Business Controls (Advisory)

3. Physically Secure the Environment

  • 3.1 Physical Security (Mandatory)

4. Prevent Compromise of Credentials

  • 4.1 Password Security (Mandatory)
  • 4.2 Multi-factor Authentication (Mandatory)

5. Manage Identities and Segregate Privileges

  • 5.1 Logical Access Control (Mandatory)
  • 5.2 Token Management (Mandatory)
  • 5.3A Personnel Vetting Process (Advisory)
  • 5.4 Physical and Logical Password Storage (Mandatory)

6. Detect Anomalous Activity to Systems or Transaction Records

  • 6.1 Malware Protection (Mandatory)
  • 6.2 Software Integrity (Mandatory)
  • 6.3 Database Integrity (Mandatory)
  • 6.4 Logging and Monitoring (Mandatory)
  • 6.5A Intrusion Detection (Advisory)

7. Plan for Incident Response and Information Sharing

  • 7.1 Cyber Incident Response Planning (Mandatory)
  • 7.2 Security Training and Awareness (Mandatory)
  • 7.3A Penetration Testing (Advisory)
  • 7.4A Scenario Risk Assessment (Advisory)

While the new Customer Security Program (CSP) provided elaborate details on how to implement the 16 mandatory and 11 advisory controls to ensure security compliance in line with SWIFT requirements, risk assurance practitioners (IT Auditors, Cyber/Information Security Analysts, System Control Analysts, IT Risk Analysts) are still finding it difficult to provide assurance on the effectiveness and adequacy of stipulated controls implemented by the business based on our interactions and engagements with industry leaders and stakeholders. In other words, there are still control testing knowledge gaps amongst those with security assurance responsibilities on SWIFT infrastructure and operating environment. Hence, the need for this practical and result oriented audit program/checklist put together to help practitioners in bridging those skill gaps.

The SWIFT infrastructure audit program/checklist provided practical steps of auditing the SWIFT infrastructures and operating environment along the lines of the newly issues Customer Security Program with the sole objective of complying with the requirements of the framework by testing the effectiveness and adequacy of the 16 mandatory and 11 optional controls. The book provided risk assurance practitioners with practical test procedures to follow, things to look out for, evidence/artifacts required to validate control effectiveness and security of the SWIFT local infrastructure and operating environment.

If you are an Auditor, Information Security Analyst, Risk Officer, Security Manager or System Control Analyst looking to carry out self-assessment, audit or security review of your SWIFT local infrastructure and operating environment in readiness for an external assessment or audit, this book is your best guide through what needs to be done beyond passing your assessment to ensure security of your SWIFT infrastructure. With the guide provided in this book, you can comfortably/independently conduct self-assessment or audit of your SWIFT Infrastructure and operating environment with little or no external assistance.

core banking app
 


Customer Reviews System Oxley Technologies
Star Rating Oxley Technologies


Back To Information and Cyber Security Jobs

Learn More About Our Valuable IT Audit Programs/Checklists

Learn More About Our Valuable Risk Assessment & Treatment Templates

Learn More About Leading Practices in Internal Audit Function



IT Audit, IT Risk and Cyber Security eBooks By Nwabueze Ohia



Announcement: Our Book "Auditing Your Information Systems and IT Infrastructure" made it to the Best Database Auditing Books of All Time Ranking By BookAuthority

The best Database Auditing books of all time

Auditing Your Information Systems and IT infrastructure: Practical Audit Programs/Checklists for Internal AuditorsGet Now
IT Infrastructure Risk & Vulnerability Library: A Consolidated Register of Operational & Technology Infrastructure Vulnerabilities for IT Assurance ProfessionalsGet Now
Auditing Your Payment Cards Processes, Systems and Applications: A Step By Step PCIDSS Compliance Audit Program For Brands, Issuers, Acquirers, ProcessorsGet Now
Auditing Your Windows Infrastructure, Intranet And Internet Security: A Practical Audit Program for Assurance ProfessionalsGet Now

Popular Articles

Remote access software are tools used to access or take full control of computing systems from a remote location either to provide support, access files...Learn More
Investing in Information Technology is pivotal to the success of a business and realization of enterprise goals/objectives. To create value for the business using IT.Learn More
Fintech applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. Online Banking application brought about easyLearn More
Audit management software are used to automate the process of auditing. Most standardized audit management software come handy with good audit process automation....Learn More
The 21st century as the information/digital age has presented numerous challenges and opportunities for humanity. From widespread industrial revolution to notable advances in IT.Learn More
The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financialLearn More
Cloud computing is the practice of using network of remote computing infrastructures hosted on the Internet to store, manage, and process data for end users....Learn More
Privilege access mgt is one of the critical elements of user access mgt for every organization & building controls around them is vital for security of information/IT assets.Learn More
Cybersecurity threats and attacks are a real-world problem today with thousands of organizational networks and web facing applications being compromised dailyLearn More
Mobile hacking is an exciting field for cybersecurity enthusiast and at the same time lucrative for hackers. This is given significant rise in the number of mobileLearn More
To ensure the security and performance of application database, it is best to adopt security baselines (a.k.a. minimum security requirements) in addition to other operational controlsLearn More
The factor to consider most in determining the cost of vulnerability assessment is the complex nature of client organization & network environmentLearn More
Management systems certifications are tools that helps organziations meet stakeholders requirements (customer, regulatory & legal), reinforce market leadership.Learn More
Protecting Automated Teller Machine (ATM) network end-to-end requires layered approach to security (implementing security at ATM endpoints, physical and logical network)Learn More