This post is part of an ongoing blog series examining predictions and recommendations for cybersecurity in 2018.
After a series of high-profile attacks against its members in 2016, the Society for Worldwide Interbank Financial Telecommunication (SWIFT) established a Customer Security Controls Framework that includes a set of 16 mandatory controls. SWIFT requires self-attestations to be completed by the end of 2017. These will be made available to SWIFT counterparties in support of the transparent exchange of security status information. Without going out on a limb, my prediction is that some SWIFT members will not be able to comply with all mandatory controls by that deadline.
That being said, my recommendation for financial institutions is to incorporate the best practices for cyber hygiene found in the SWIFT mandatory controls into your overarching security program. Avoid the temptation to treat the SWIFT controls as “one-offs” to be addressed separately. Integrating them into your cybersecurity program will provide a more holistic approach and enable you to ensure ongoing compliance.
The SWIFT mandatory security controls can be viewed as measures of good cyber hygiene for their members. I won’t cover all 16 here, but I will highlight a few to provide some flavor for the controls.
The two most recently publicized attacks on SWIFT members occurred in October 2017 (Taiwan and Nepal). Prior to these, there was an attack in December 2016 (Turkey). Although one could say the pace of attacks against SWIFT members has slowed from the peak seen in mid-2016, it would not be prudent to ignore the recommended security controls. Whether or not you are a SWIFT customer, ensuring that basic cyber hygiene is part of your overall security program is well worth the time and effort.
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.