Соответствие требованиям

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

SWIFT Customer Security Controls Framework v2022

Framework

6 - 6.2 - Control Definition

Для проведения оценки соответствия по документу войдите в систему.

Список требований

6 Detect Anomalous Activity to Systems or Transaction Records
6.2 Software Integrity

Обязательно для типа архитектуры A1 A2 A3 A4

Область требования: Коннектор SWIFT | Коммуникационный интерфейс SWIFT | Приложение управления взаимоотношениями | Интерфейс обмена сообщениями SWIFT | Графический пользовательский интерфейс SWIFT
Control Definition

Control Objective: Ensure the software integrity of the SWIFT-related components and act upon results.

In-scope components:
SWIFT connector
GUI to the messaging and communication interface
messaging interface
communication interface
RMA
SNL
[Advisory A4: Customer connector]
Risk Drivers:
unauthorised system changes
Implementation Guidance

Control Statement:
A software integrity check is performed at regular intervals on messaging interface, communication interface, and other SWIFT-related components and results are considered for appropriate resolving actions.

Control Context:
Software integrity checks provide a detective control against unexpected modification to operational software.

Implementation Guidelines:
The implementation guidelines are common methods to apply the relevant control. The guidelines are a helpful way to begin an assessment, but should never be considered as an "audit checklist" as each user’s implementation may vary. Therefore, in cases where some implementation guidelines elements are not present or partially covered, mitigations as well as particular environment specificities must be considered to properly assess the overall compliance adherence level (as per the suggested guidelines
or as per the alternatives).
Software integrity checks are conducted on in-scope components upon start-up, and additionally at least once per day. Options for implementation:
Integrated in the product
Third-party file integrity monitoring (FIM) tool
Integrity check of downloaded software is conducted through verification of the checksum at the time of its deployment.
Optional Enhancements:
An integrity check is performed in memory.
An integrity check is performed at the operating system level.
File Integrity Monitoring covers the products with integrated mechanisms.
Systems within the secure zone implement application allow listing on the operating system, which allows only known and trusted applications to be executed.

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.