Banking system SWIFT was anything but on security, ex-boss claims

There was a assumption that the new customers would be capable of looking after their own money, like the traditional customers. That turned out to be false. The new customers are Lusers, and need to have their hands held, their noses wiped, and their nappies changed.

That's a problem for namagement.

But it doesn't indicate that management were more interested in bonuses than security. It indicates that management failed to appreciate changes in their security environment.

Having worked for SWIFT as a contractor - over a couple of decades ago - I can attest that the offices were very fancy indeed (including specially-commissioned light fittings and carpets) and that the staff canteen provided exceptionally good food at a heavily-subsidised price.

There were also an awful lot of contractors working there. I never really found out what I was supposed to be doing - apart from showng up and taking the money - and. presumably, serving as a indicator of some manager's growing empire.

However, having worked in and around other financial institutions, they all seemed to be basically the same: lots of contractors with a vested interest in prolonging their gigs and managers who were acquiring bodies in order to impress their next employer with the size of their present team - none of them having any real interest in their supposed deliverables.

And whereas banks don't have the money to slosh around that they once did. I suspect that has only made things worse as the few permanent staff who actually knew what they were doing are likely to have been shown the door.

I'm astounded that financial IT systems don't exhibit more problems than they do.

Re: "we adapt as the threat changes"

~ What's worse, a lot of these smaller banks and emerging markets outfits don't even know how the system works. For example Intermediary bank charges and circumstances where Swift transfers get returned.

~ Added to which, Swift offer zero options for consumer contact, there's not even a FAQ!

~ How much work would it have been to have a more layered system to accommodate frontier banks that are less sophisticated in their controls and are at a higher risk regarding fraud...

~ Face it! You just wanted to grow the business aggressively without dealing with any of the associated costs of security, which you viewed as other people's problems! Which is why you-like-so-many-other-cheap-outsourcing-corporations right now are getting humiliated...

Re: SWIFT and Microsoft Windows

Linux isn't much better and gets also hacked regularly. Low cost standard IT infrastructure that hackers can simulate on ordinary laptops does not provide the kind of protection needed for financial transactions - especially if those are of high value.

Half the money that passes hands each day is transferred across the SWIFT network. You are quite correct that actual money doesn't travel across their network, only messages, but duh! A physical £50 note is only a message too.

SWIFT do provide secure communications to their users, in the same way the Bank of England/ Bank of Scotland RBS and Clydesbank provide secure £50 notes to their users. If you get mugged walking down the street or accept obviously fake £50 notes then you can't blame the currency. The weak point is the banks, aka between the chair and the keyboard.

Re: Lack of trust

First, neither Linux or Windows is used on the main network.

Second, why on earth is SWIFTs self-signed root PKI cert a 'dodgy security practice'? It's entirely their network so outsourcing trust would be a vulnerability. Banks trust SWIFT for a good reason, they are unhackable. Other root certifiers are not.

Re: Lack of trust

If you're already trusting SWIFT to transfer money to/from your bank, what's wrong with a self-signed certificate?

How would getting it signed by (eg) Verisign help with security?

Re: I interviewed there last year. . .

I'm interested in knowing how you assumed they were all Hindu's? did you ask them all their religion? Or was this a veiled reference to the colour of their skin?

Quote from wiki "Traditionally, Hindu men wear a dhoti kurta and women wear a sari. The clothing of Hindu people varies depending on the time of year and the area in which they live."

So how exactly did you tell?

Re: swift .... really archaic

Well, it was either you or your bank who can be described as really archaic.