Story image

Securing SWIFT networks vitally important for cyber attack prevention

11 May 2018

Businesses that use the SWIFT network must comply with SWIFT’s Customer Security Programme (CSP) or face the risk of attacks.

Those attacks, which can cost both organisations and their customers money, can be prevented with a strong security posture and absolute visibility, says ForeScout. The company believes that visibility should be non-negotiable.

ForeScout CMO Steve Redman explains that SWIFT is a banking communications platform that manages most financial transfers between banks and organisations.

“The number and severity of cyber attacks targeting SWIFT networks is growing. However, attacks happen entirely through the customer enterprise, as opposed to the infrastructure that SWIFT owns and operates, putting the onus for security squarely on banks and businesses,” he says.

The SWIFT Customer Security Programme (CSP) is designed to drive security improvement and transparency for the world’s financial community, and also to help customers prevent cyber fraud.

“SWIFT hacks happen when cybercriminals get in between the customer’s network and the SWIFT network. There, they can change or reroute messages and even currency, making a successful SWIFT hack highly lucrative for cybercriminals,” Redman continues.

“It is therefore absolutely critical to gain 100 per cent visibility into all SWIFT components. 99.999999%  isn’t good enough. From clients and servers to gateway devices and network fabric, no part of the network should remain invisible. Many of these devices can’t or shouldn’t run agents but that shouldn’t prevent customers from gaining visibility into them. They simply need to run an agentless solution to get that visibility. Anything left unseen is a potential attack vector.”

ForeScout says the CSP provides a common set of security standards and requirements, not just a technology solution. It includes three key objectives: secure the environment; know and limit access; and detect and respond to threats. 

There are also eight principles that govern the CSP:

1.  Restrict internet access 2.  Protect critical systems from the general IT environment 3.  Reduce attack surface and vulnerabilities.  4.  Physically secure the environment 5.  Prevent compromise of credentials 6.  Manage identities and segregate privileges 7.  Detect anomalous activity 8.  Plan for incident response and information sharing

“It’s also essential to understand the context and severity of risks and potential consequences so the customer can take intelligent action to mitigate that risk. Customers need to be able to control how risks are dealt with so the entire system doesn’t come to a stop just because someone forgot their password, for example,” Redman says.

“There is no silver bullet to prevent SWIFT attacks but organisations can make themselves very unattractive targets by hardening their security and gaining that complete visibility,” he concludes.

Ping Identity offerings accelerates cloud MFA and SSO adoption
90% of respondents trust MFA as an effective security control to protect identity data in public clouds, yet only 60% of organisations have formally adopted it.
Trend Micro introduces cloud and container workload security offering
Container security capabilities added to Trend Micro Deep Security have elevated protection across the DevOps lifecycle and runtime stack.
Veeam joins the ranks of $1bil-revenue software companies
It’s also marked a milestone of 350,000 customers and outlined how it will begin the next stage of its growth.
Veeam enables secondary storage solutions with technology partner program
Veeam has worked with its strategic technology alliance partners to provide flexible deployment options for customers that have continually led to tighter levels of integration.
Veeam Availability Orchestrator update aims to democratise DR
The ability to automatically test, document and reliably recover entire sites, as well as individual workloads from backups in a completely orchestrated way lowers the total cost of ownership (TCO) of DR.
Nuix eyes legal sector as eDiscovery demand skyrockets
eDiscovery must encompass so much more than email and documents. If you haven’t looked at text messages and online chats, digital images, mobile devices, data in the cloud and social media, you’re not getting the whole story.
EXCLUSIVE: Forcepoint global channel chief talks strategy
As a solution sold 100% via the channel, cybersecurity solutions company Forcepoint places a strong emphasis on its partner relationships.
Salesforce continues to stumble after critical outage
“To all of our Salesforce customers, please be aware that we are experiencing a major issue with our service and apologise for the impact it is having on you."