What CSP-Assessor Questions and Answers feature?

This question addresses the types of Hardware Security Module (HSM) devices offered by SWIFT:

Step 1: SWIFT HSM Overview

SWIFT provides HSMs to secure Public Key Infrastructure (PKI) certificates and cryptographic operations for its users. The CSCF and related security documentation specify two primary types:HSM tokens(portable devices) andHSM boxes(rack-mounted hardware).

This question addresses the scope of penetration testing for Swift-related components under theSwift Customer Security Programme (CSP).

Step 1: Understand Penetration Testing Requirements

TheCSCF v2024, underControl 4.1: Penetration Testing, mandates penetration testing to identify vulnerabilities in Swift-related systems. The scope is defined by theSwift Testing Policy, not arbitrarily applied to all components.

Step 2: Analyze the Statement

The statement suggests that penetration testing "must be performed at application level against the Swift-related components, such as the interfaces, Swift and customer connectors." We need to verify if this is a mandatory scope.

Step 3: Evaluate Against Swift Guidelines

Control 4.1: Penetration Testingrequires testing of in-scope components, but theSwift Testing Policy(referenced in theCSCF v2024andSecurity Best Practices) specifies which components (e.g., messaging interfaces, connectors) must be tested based on risk and architecture.

The policy does not mandate testing all listed components (e.g., interfaces, connectors) at the application level unless they are identified as high-risk or in-scope per the user’s assessment. For example, customer connectors might be excluded if managed by a Service Bureau, per theSwift Outsourcing Guidelines.

The statement’s assertion of a broad mandate is incorrect; the scope is limited to components defined in theSwift Testing Policy, which provides a tailored approach.

Step 4: Conclusion and Verification

The answer isB, as penetration testing must follow theSwift Testing Policy, which defines the specific components to test, rather than mandating all Swift-related components like interfaces and connectors.

References

Swift Customer Security Controls Framework (CSCF) v2024, Control 4.1: Penetration Testing.

Swift Testing Policy, Section: Scope Definition.

Swift Security Best Practices, Section: Penetration Testing.

This question pertains to Local Security Officer (LSO) and Remote Security Officer (RSO) accounts on SWIFT Alliance Access, a key component of the SWIFT infrastructure. Let’s evaluate each statement:

A. They are local Security Officers

LSOs and RSOs are indeed Security Officers responsible for managing security functions on Alliance Access. LSOs operate locally, while RSOs can perform tasks remotely, but both are classified as Security Officers under SWIFT’s terminology.