Control Definition
Control Objective: Ensure the proper management, tracking, and use of connected and disconnected hardware authentication or personal tokens (when tokens are used).
In-scope components:
- connected and disconnected hardware authentication or personal tokens used for SWIFT operations or secure zone access
- PIN Entry Device (PED) used for HSM operations
Risk Drivers:
- authentication token theft
- lack of traceability
- HSM management misused
Implementation Guidance
Control Statement:
Connected and disconnected hardware authentication or personal tokens are managed appropriately during their assignment, distribution, revocation, use, and storage.
Control Context:
The protection of connected and disconnected hardware authentication or personal tokens is essential to safeguarding the related operator or system account. It also reinforces good security practice by providing an additional layer of protection from attackers.
Implementation Guidelines:
The implementation guidelines are common methods to apply the relevant control. The guidelines are a helpful way to begin an assessment, but should never be considered as an "audit checklist" as each user’s implementation may vary. Therefore, in cases where some implementation guidelines elements are not present or partially covered, mitigations as well as particular environment specificities must be considered to properly assess the overall compliance adherence level (as per the suggested guidelines
or as per the alternatives).
- A controlled process is used for the assignment and distribution of connected and disconnected hardware or personal tokens used for SWIFT operations (for example USB token, HSM token, smart card).
- Token assignment, including those delegated to a provider, is reviewed at least annually (more frequently is recommended).
- Personally assigned hardware tokens, including those delegated to a provider, are revoked when the individual no longer requires access and should be recalled (for possible disposal or reassignment as appropriate).
- A record is maintained of assigned hardware token ownership.
- Hardware tokens are physically removed from the system and secured or supervised when not in use.
- When a remote PED is used, the following security practices apply:
- PED keys must be stored and only accessible by relevant staff (originals and copies should be stored in a safe with access tracking)
- Although the HSM PED keys are not personally assigned, usage should be controlled, tracked and monitored. In case a PIN is set on the PED keys and a person with access to these keys and PIN is leaving the company, the PIN codes should be changed
- The flows to the HSM must be secured as per the Alliance Security Guidance considering also the CSP FAQ (SWIFT Knowledge Base article 5021823) to properly establish and manage the connection.
