Among other things, Swift is a cooperative organization of financial institutions who agree to using the same standardized messaging system for financial transactions. As such, they publicly promote the use of ISO 20022 as their primary standard for messaging between financial institutions. That said, each member may implement this standard using a very wide variety of software on different platforms each of which can have its own security vulnerabilities. The standard itself is a bit dated and probably could be improved, but the bigger issue creating vulnerabilities for financial institutions is each entity’s implementation and choice of security controls.
The ISO 20022 standard is accessible for review but each vendor’s implementation of it is probably not. As far as certification goes, these components would most likely be certified for ISO 20022 compatibility if anything, and not for security from an attacker’s perspective; so this is probably not something meaningful from the standpoint of your question.
I think it would be wise for the organization to create a more rigorous set of security standards which members must adhere too, possibly similar to but stronger than PCI-DSS, but I suspect there would be a lot of objections to this from member organizations that do not want the additional requirements. That said, I think you are bringing up very valid points and I think it would be very wise for organizations using Swift to put pressure on their peers to help address the security needs. More importantly, I think a lot of these member organizations are currently stuck using traditional security methods to fight much more high-tech adversaries. Now would be a great time for that organization to put a stronger emphasis on increasing the strength of its network to reduce future expenses related to breaches.
One thing that seems to also have emerged during the recent string of attacks is that SWIFT put out a request to all of the connected banks asking them to report potential breach information and cyber-attacks. As such it appears that SWIFT left a lot of the security responsibility in the hands of the individual banks and did not account for banks which would not perform appropriate security measures to defend the SWIFT network. Aspects of the attacks which have occurred may also imply that there is very little internal monitoring of SWIFT transactions from a purely fraud-detection standpoint. The following Reuters article points out that it appears that the relationships between banks is also fragile and that many of the weaker banks are unlikely to admit their security short-comings and that these short-comings may be somewhat common among all of the smaller banks participating in the network. Likewise the article goes on to talk about the importance of SWIFT participants to also increase their own non-SWIFT verification methods to add security to the less secure SWIFT process as such it would appear to imply that industry insiders don't have a lot of faith in the security of the SWIFT network and that it's a known risk in many ways.
http://www.reuters.com/article/us-cyber-heist-swift-specialreport-idUSKCN0YB0DD
Finally it should be noted that the ISO 20022 standard does not have much in the way of security within the standard itself. This is a very old communication standard without requirements for many modern security controls which is in need ofwould probably be required if a major update at this pointsimilar network were architected today.
