Maintain Compliance with SWIFT Security Standards

Transcription

1 Solution Brief Maintain Compliance with SWIFT Security Standards Maintain Compliance with SWIFT Security Standards Using Citrix solutions to secure and control high-value apps and data to protect financial institutions from threats. Learn how banks and financial services organizations are leveraging their Citrix investment to reduce risk and comply with new SWIFT requirements. As modern IT environments become more complex, fragmented and porous, businesses face a critical need to update their security architecture. This is especially true for the financial services industry, where high-value apps and data including those that initiate, process, complete and store financial transactions make organizations a prime target for hackers and thieves. Adding to the urgency of the challenge, users of the Society for Worldwide Interbank Financial Telecommunication (SWIFT) financial messaging platform now face a deadline of December 31, 2017, to achieve compliance with new core security standards designed to reduce financial, legal, regulatory and reputational risks. These requirements are only the latest additions to a long list of security and risk management issues, from regulatory compliance, customer privacy and the ever-present threat of ransomware to insider threats and cyber attacks of all kinds. In order to manage risk and protect high-value apps and data, IT and security teams at financial services organizations must address challenges related to secure access, mobile security, and the protection of data and intellectual property while ensuring continuity of operations. For more than a quarter-century, customers in highly regulated industries including financial services have trusted Citrix to help protect sensitive apps and data without compromising productivity. Citrix enables financial institutions to address complex security challenges and maintain the controls required under the latest SWIFT standards by focusing on creating a software-defined perimeter that: Unifies and enriches end user experience within a secure digital workspace Secures all types of enterprise applications and data while providing contextual access from any device, anywhere Simplifies IT s ability to manage increasingly complex, hybrid and multi-cloud environments Extends control and offers visibility and behavior analytics across devices, networks and clouds New SWIFT Standards Address Rising Threats to Financial Institutions Over the summer of 2016, hackers used malware to bypass the security systems of three international banks. Once inside, the hackers initiated unauthorized money transfers from one bank to another. More recently, large-scale ransomware attacks have crippled thousands of major organizations around the world and put their sensitive business data at risk of compromise or loss. Considering the many forms today s attacks can take, including malware and ransomware, Trojan horse, keylogger, DNS, phishing and advanced persistent threats (APTs), it s no wonder IT and security departments at financial institutions are on edge. Recognizing the urgency of the situation, SWIFT has taken aggressive action to strengthen security standards and reduce risk of its member community. The SWIFT Customer Security Citrix.com 1

2 Citrix Solution at Work The Citrix approach to securely delivering apps and data is endpointagnostic. In fact, for many Citrix customers, all endpoints are initially deemed untrusted until they pass a series of tests for verification. All users are proxied through Citrix NetScaler, where they are authenticated and given the appropriate level of access. NetScaler is also the control point where traffic is inspected and encrypted between the user and the internal network, as well as providing visibility and analytical insights into traffic entering the network. Citrix XenApp and XenDesktop enable IT to centralize and virtualize applications and data with a hosted delivery model, and enforce limited, policy-based control over connected peripherals and functions including Internet browsing, printing, copy/ paste and drive mapping. For example, by publishing virtual web browsers and clients with XenApp, IT can isolate endpoints from the corporate network and ensure that infected hosts are unable to further spread ransomware and place more of the organization s data at risk. Citrix XenMobile enterprise mobility management software enables secure mobility through containerization to protect data on smartphones and tablets. The Citrix ShareFile solution for enterprise file sync and share captures versions of files in real time to ensure that a clean version is always available to replace a file that has been affected by ransomware. In this way, IT can provide the level of access employees need to be productive while maintaining a secure, compliant environment. Programme (CSP), launched in June 2016, is a dedicated initiative designed to reinforce and evolve the security of global financial services institutions, consolidating and building upon existing SWIFT and industry efforts. The CSP encompasses 27 controls, of which 16 are mandatory and 11 advisory. These controls are designed to help financial institutions remain compliant as well as secure. The controls aim to reduce risks by focusing on three overarching objectives: Secure your environment, know and limit access, and detect and respond. All SWIFT users must submit their self-attestation by December 31, 2017, and will be required to resubmit their attestation on an annual basis thereafter. The attestations are made available to all SWIFT member banks. Non-compliance may result in SWIFT reporting the non-attestation to local authorities in charge. A New Approach to Security for a Changing Environment Achieving a higher level of security and control can be extremely difficult with traditional architecture a challenge widely recognized across the industry. In a recent survey by Ponemon Institute, commissioned by Citrix, 83 percent of respondents, including many from the financial services industry, reported that their technology is outdated or inadequate, while 74 percent said that a new IT security architecture is needed to improve security. With proliferating numbers and types of devices, apps, data, networks and clouds in use, financial industry IT environments are becoming increasingly complex, creating a larger, more fragmented and more porous perimeter to secure. To overcome the security and compliance challenges posed by this changing environment, financial services IT and security personnel must address challenges across user access, mobility, and data and IP protection while ensuring compliance and continuity of operations. Citrix security solution creates a software-defined perimeter that combines secure access to apps and data with contextual control, visibility and behavior analytics across devices, networks and clouds. By extending control beyond the traditional datacenter to mediate user interactions with apps and data, IT can proactively secure, detect, and mitigate risk with intelligence applied to each unique scenario. The Citrix architecture is designed and purpose-built for security, and is hardened from the ground up through: Contextual control over access to apps and data based on dynamic, scenario-specific parameters Network security with encrypted application and desktop delivery, network segmentation and intelligent health monitoring Application security through centralized management, micro-vpn, and protection against zero-day, logic and DDOS attacks Data security through centralization to keep data off endpoints, containerization and encryption for data on mobile devices, file-level access and control (DLP and IRM) for data in motion, and secure enterprise file sharing, sync and collaboration Analytics and insights to detect misconfigurations and attacks with detailed logging, and secure traffic from the endpoint to the data center These measures ensure security and compliance today, while also providing flexibility and agility to accommodate emerging technologies and requirements without having to redesign the architecture. At its core, the architecture gives control back to IT and delivers the best balance between security and user experience. 2

3 Securing Your SWIFT systems Whether deployed in a full stack, partial stack, or connector architecture, Citrix aids compliance with the new SWIFT CSP framework by providing direct controls to secure access to the SWIFT network. In the full stack architecture diagram below, a secure zone is established around the SWIFT systems. Operator access from within the general enterprise IT environment is controlled through multifactor authentication to a jump to a server within the secure zone. Internet access within the secure zone is restricted. Figure 1 Secure zone example: full stack within the user location. General Enterprise IT Environment Admin End-User Controlled Internet Server Environment Secure Zone General IT Services End-User Admin IT Services Jump Server Jump Server Controlled Back Office or Middleware Messaging Interface Communication Interface GUI Monitoring SWIFT Network This type of architecture, together with Citrix solutions, can help organizations meet the control requirements detailed in SWIFT CSP requirements. The following table (Table 1, Page 4) illustrates how Citrix can address some of the relevant security controls. 3

4 Table 1 SWIFT Security Controls and Citrix Solution Principles. SWIFT Control Categories SWIFT Controls Citrix Solution Principles 1. Restrict Internet Access and Protect Critical Systems from General IT Environment 2. Reduce Attack Surface and Vulnerabilities 1.1 SWIFT environment protection 1.2 Operating system privileged account control 2.1 Internal data flow security Segmentation between the user's local SWIFT infrastructure and its larger enterprise network reduces the attack surface. Citrix can decouple the web browser, client and critical apps from the endpoint, and deliver hosted apps virtually from the datacenter or cloud. Operators connect from their general-purpose operator PC to the SWIFT secure zone via a jump server located within the secure zone, as can be enabled using Citrix. Internet access from systems within the secure zone is highly restricted, and ideally blocked with browsers published separately via Citrix for security critical apps. Applying strict protection for administrator-level accounts within the operating system reduces the opportunity for an attacker to use the privileges of the account as part of an attack. The communication between the operator PC and the SWIFT-related applications is protected using a secure mechanism (for example, oneway TLS). 2.2 Security updates A security update process that is effective, repeatable and timely is essential to continuously close these known vulnerabilities when security patches become available. With centralized and virtualized apps using Citrix in the datacenter, IT only needs to apply the security patches once, quickly and efficiently. Containerization protects data on smartphones and tablets to enable secure mobility. 2.3 System hardening Features and services that are not required for normal system operations can be disabled. IT can use memory-based malware scanning, reputation-based URL, whitelisting, consistent security configurations such as disabling macros, innovations in malware detection using Bitdefender HVI on Citrix XenServer, and with Citrix NetScaler Secure Web Gateway. 2.5A External transmission data protection 2.6A Operator session confidentiality and integrity 2.9A Transaction business controls For data being transmitted outside of the SWIFT secure network, it can be encrypted using the SSL/TLS through Citrix NetScaler. All interactive sessions are protected by a cryptographic protocol such as SSH or HTTPS. Restrict or monitor SWIFT transactions and approvals outside of normal business hours. The restrictions can be configured in Active Directory or under user profile in Citrix NetScaler. 4

5 SWIFT Control Categories SWIFT Controls Citrix Solution Principles 3. Physically Secure the Environment 3.1 Physical security While IT centralization and datacenter consolidation can help reduce the physical attack surface area, including the endpoints, Citrix does not address physical security controls. 4. Prevent Compromise of Credentials 5. Manage Identities and Segregate Privileges 6. Detect Anomalous Activity to Systems or Transaction Records 4.2 Multifactor authentication 5.1 Logical access control 6.1 Malware protection Multi-factor authentication is implemented on at least one operator authentication stage within the end-to-end SWIFT application access chain. Applying the security principles of (1) needto-know, (2) least privilege and (3) segregation of duties is essential to restrict access to the local SWIFT infrastructure. Citrix NetScaler can consolidate access control across all apps and devices. Anti-malware software from a reputable vendor can be installed on all computing platforms and updated in line with the scanning frequency, such as Bitdefender HVI on Citrix XenServer. 6.2 Software integrity Centralizing SWIFT components into a segregated space using Citrix XenApp or XenDesktop - instead of installed in disparate endpoints - where access to them is restricted means risk to software integrity is reduced. 7. Plan for Incident Response and Information Sharing 6.4 Logging and monitoring 7.1 Cyber incident response planning 7.2 Security training and awareness Logging capabilities are implemented to detect abnormal usage within the secure zone as well as any attempts to undermine the effectiveness of controls within the secure zone. Session and login attempt recordings from Citrix can be made available for audit when required. Single image management quickly patches all systems while centralized management can improve response times. Security logs, and session and log-in recordings can be leveraged as an available tool to aid in incident forensics. Citrix offers security training materials and train-the-trainer sessions. 5

6 Figure 2 Reference architecture for global financial institution. Reference Architecture Hardware Layer User Layer Access Layer Resource Layer External Users SSL NetScaler Gateway 11.1 Radius Server Hosted Applications Catalog Windows 2012 R2 vcpu: 4 RAM: 32 GB Tanium Agent Cylance Agent UPM and WEM McAfee Agent Virtual Delivery Agent 2x18 CPU 768 GB RAM Domain Controller StoreFront 3.8 Pooled Desktop Catalog Tanium Agent Cylance Agent UPM and WEM McAfee Agent 4 Hosts 202 VMs Internal Users SSL NetScaler Gateway 11.1 NetScaler Load Balancer Windows 7 vcpu: 2 RAM: 8 GB Virtual Delivery Agent VM Control Plane Control Layer Director 7.13 Delivery Controller 7.13 License Server 7.14 Provisioning Services 7.12 XenApp Local Storage 2x18 CPU 512 GB RAM Virtual Machine Storage NAS User Data SQL 2012 R2 Enterprise AOAG Provisioning Services 7.12 XenDesktop Local Storage 2 Hosts 32 VMs VM Control Plane SCCM SCCM Distribution Distribution SCCM App-V Distribution SCCM UPM and Distribution WEM SCCM McAfee Distribution MOVE SCCM Stratusphere Distribution Case Study: Strengthening Security While Improving Performance and Scalability A global financial institution with over 30,000 employees and services including custodian banking, investment management and trading needed to address rising security risks while improving the performance and scalability of its systems. The measures adopted by the institution, as reflected in the reference architecture above, included: The deployment of external and internal NetScaler appliances to replace earlier appliances that had shown functional issues. The NetScaler appliances are used to encrypt internal traffic with TLS 1.2. Multi-factor authentication for local and remote operator access, enabled through a NetScaler integration. Network segmentation to publish SWIFTin a dedicated secure zone, separated from other applications. The restriction of Internet access within the SWIFT secure zone. The use of Citrix Provisioning Services (PVS) to quickly and efficiently deploy security updates, and to enable single-image management with non-persistent virtual machines. In the event that a VM is infected with malware, it can be quarantined, shut down and replaced with a pristine new instance. 6

7 Conclusion Facing constant and increasingly sophisticated threats to high-value apps and data, including the SWIFT messaging platform among many others, financial services organizations must continuously raise the bar for defense. Citrix solutions help financial institutions maintain security, control and compliance by creating a software-defined perimeter that combines secure access to apps and data with contextual control, visibility and behavior analytics across devices, networks and clouds. By extending control beyond the traditional datacenter to mediate user interactions with apps and data, IT can proactively secure, detect, and mitigate risk with intelligence applied to each unique scenario. A future-proofed security architecture helps the institution easily accommodate emerging requirements and challenges. Learn more about Citrix and SWIFT at now.citrix.com/swift. For more information about Citrix security solutions visit citrix.com/secure and for more information about Citrix financial services solutions please visit citrix.com/financialservices. Additional Resources The Citrix Synergy breakout session video recording, SYN124: Securing high-value applications in bank IT infrastructure, is available on-demand at Presentations can be downloaded from your MySynergy Account. Enterprise Sales North America Worldwide Locations Corporate Headquarters 851 Cypress Creek Road Fort Lauderdale, FL 33309, United States Silicon Valley 4988 Great America Parkway Santa Clara, CA 95054, United States 2017 Citrix Systems, Inc. All rights reserved. Citrix, the Citrix logo, and other marks appearing herein are property of Citrix Systems, Inc. and/or one or more of its subsidiaries, and may be registered with the U.S. Patent and Trademark Office and in other countries. All other marks are the property of their respective owner(s). 7