The team behind the SWIFT financial transaction network is taking another look at its security after several hacking attempts against its customers.
In February, hackers managed to siphon off $81m from Bangladesh's central bank in a raid that – but for a spelling mistake that alerted an analyst – could have taken a lot more. Vietnam's Tien Phong Bank has since admitted that it too has lost money in a similar attack, and now SWIFT (Society for Worldwide Interbank Financial Telecommunication) is taking another look at how to protect its customers.
"SWIFT has recently shared information regarding a number of fraudulent payment cases where affected customers suffered a breach in their local payment infrastructure," the group said in a letter to customers.
"We would like to reassure you again that SWIFT's network, services and software were not compromised. While customers are responsible for the security of their own environment, security is our top priority and as an industry-owned cooperative we are committed to helping our customers fight against cyber-attacks."
For a start, SWIFT has set up a centralized hub for information on cybersecurity through KB tip 5020928 in the restricted customer section on its website. The repository will hold details on malware and any security issues that its customer base is having.
SWIFT reminded its users that its terms and conditions require them to report security information to the company, and said it would also be asking for additional diagnostic data from them in some cases.
"Your organisation's role in this effort is critical," it said.
"Incorporating these steps as part of your security protocol will allow SWIFT to better support your institution in solving any issues that may arise, to understand any patterns between cases, and to provide general advice and alerts to other users in order to protect them from similar cases."
The changes come after some in the security industry have criticized the organization, saying its current security model is outdated and designed to protect against "types of attacks that were prevalent a decade ago." It doesn't even require the use of two-factor authentication, although it does support and recommend it.
Then again, no system is perfect, and if you're stealing a few million dollars then bribing someone on the inside isn't going to cut into profits too much. ®