Customer Security
Programme (CSP)
Client Briefing
July 2016
v05
Customer Security
Programme
Objective
and scope
Scope
Objective
CSP will reinforce
and evolve the
security of global
banking, in the face
of ever-increasing
cyber threat,
consolidating and
building upon existing
SWIFT and industry
efforts
CSP will define an operational and security baseline for SWIFT-related
customer infrastructure that customers must meet to protect the processing
and handling of their SWIFT transactions
CSP will define an assurance framework to ensure SWIFT customers are
taking appropriate measures to protect the SWIFT ecosystem and their endto-end processing of global payments
CSP will reinforce cyber security intelligence sharing and work to improve
transaction pattern detection for SWIFT customers
CSP will be limited to customer infrastructure and operations related to
SWIFT, both SWIFT products and services as well as third party software
products
2
Customer Security
Programme
STREAMS
CSP Overview
Enhance SWIFT-related tools for customers
3
Enhance security guidelines
4
Support increased transaction pattern
detection
5
Enhance support by third party providers
E2
E3
Programme communications
2
E1
Customer and third
party engagement
Improve information sharing amongst the
global community
Build customer and 3rd party
assurance frameworks
5 streams + 3
enablers
1
ENABLERS
3
Customer Security
Programme
STREAMS
Enhance SWIFT-related tools for customers
3
Enhance security guidelines
4
Support increased transaction pattern
detection
5
Enhance support by third party providers
E2
E3
Programme communications
2
E1
Customer and third
party engagement
Improve information sharing amongst the
global community
Build customer and 3rd party
assurance frameworks
Information
sharing
1
ENABLERS
Information sharing
•
Response team - Undertakes
cyber forensics and analysis
•
Malware inventory - Maintain
detailed case inventory, e.g.
malware file hashes / Indicators of
Compromise / Modus Operandi /
FAQs …
•
SWIFT ISAC - Share curated
information and best practice with
the cyber intelligence community
and SWIFT community
4
Customer Security
Programme
STREAMS
Enhance SWIFT-related tools for customers
3
4
5
Enhance security guidelines
Support increased transaction pattern
detection
Enhance support by third party providers
E2
E3
Programme communications
2
E1
Customer and third
party engagement
Improve information sharing amongst the
global community
Build customer and 3rd party
assurance frameworks
Enhance
SWIFT-related
tools
1
ENABLERS
SWIFT-related Tools
•
Harden flows between Back
Office & SWIFT – e.g. enhanced
authentication and encryption
•
Enhance User / Password
Management
•
Harden Customer Footprint –
e.g. enhanced integrity checking
•
Enhanced Logging / Reporting
5
Customer Security
Programme
STREAMS
Enhance SWIFT-related tools for customers
3
Enhance security guidelines
4
Support increased transaction pattern
detection
5
Enhance support by third party providers
E2
E3
Programme communications
2
E1
Customer and third
party engagement
Improve information sharing amongst the
global community
Build customer and 3rd party
assurance frameworks
Guidelines and
audit
frameworks
1
ENABLERS
Security Guidelines
Prevention and detection measures
for security of SWIFT infrastructure,
including operational and
implementation best practices, e.g.
physical / logical access control and
segregation of duties
6
Customer Security
Programme
STREAMS
Enhance SWIFT-related tools for customers
3
4
5
Enhance security guidelines
Support increased transaction pattern
detection
E2
E3
Programme communications
2
E1
Customer and third
party engagement
Improve information sharing amongst the
global community
Build customer and 3rd party
assurance frameworks
Payment
pattern
controls
1
ENABLERS
Transaction Pattern Detection
•
Appropriate use of existing
transaction controls such as
RMA, RMA+
•
Market practice for pattern
controls and fraud prevention
•
Enhanced transaction controls for
business environments
•
Explore identification of
anomalous transactions and
behaviours
•
Improve analytics and
intelligence capabilities
Enhance support by third party providers
7
Customer Security
Programme
STREAMS
Enhance SWIFT-related tools for customers
3
Enhance security guidelines
4
Support increased transaction pattern
detection
5
Enhance support by third party providers
•
E2
E3
Programme communications
2
E1
Customer and third
party engagement
Improve information sharing amongst the
global community
Build customer and 3rd party
assurance frameworks
Third party
providers
1
ENABLERS
Third-Party Providers
Enhanced operational
requirements baseline to ensure
security of service bureaus
8
Customer Security
Programme
STREAMS
Enhance SWIFT-related tools for customers
Assurance Framework
3
•
4
increased
transaction
•Support
Develop
audit framework
to certifypattern
third-party auditors
detection
5
Enhance support by third party providers
DevelopEnhance
assurancesecurity
frameworks
guidelines
around Security Guidelines
E2
E3
Programme communications
2
E1
Customer and third
party engagement
Improve information sharing amongst the
global community
Build customer and 3rd party
assurance frameworks
Assurance
framework
1
ENABLERS
9
Customer Security
Programme
STREAMS
Improve information sharing amongst the
global community
Enhance
SWIFT-related
tools for
•
General
client engagement
to customers
raise
awareness of Customer Security
Programme through information
sharing, meetings and webinars
Enhance security guidelines
3
•
4
Community engagement through
local events and NMG engagement
Support increased transaction pattern
Deep client engagement
detection
•
undertaken on a bilateral basis with
CISOs and Subject Matter Experts,
prior to Sibos
5
Customer and third
party engagement
2
E2
E3
Programme communications
Customer Engagement
E1
Build customer and 3rd party
assurance frameworks
Customer
engagement
1
ENABLERS
Enhance support by third party providers
10
Customer Security
Programme
STREAMS
Comms
Enhance SWIFT-related tools for customers
External Communications
3
4
5
•
Dedicated SWIFT.com page
•
Customer collateral
•
SWIFT Regional Events
Enhamce security guidelines
•Support
Sibos increased transaction pattern
detection
E2
E3
Programme communications
2
E1
Customer and third
party engagement
Improve information sharing amongst the
global community
Build customer and 3rd party
assurance frameworks
1
ENABLERS
Enhance support by third party providers
11
Customer Security
Programme
Communications
via SWIFT.com
https://www.swift.com/ordering-support/customer-security-programme-csp
12
www.swift.com
13