Why Cabling Security Matters: A Guide to ISO 27002 Control 7.12
Most modern technologies would not function properly without cables such as fibre, network, or power cables.
While cables are essential to the transmission of information assets, and to the provision of information services, they expose risks to the availability and confidentiality of information assets and also to continuity of business operations.
These risks may arise from damage to, interception, or interference with these cables. Furthermore, personnel with access to these cables may accidentally cause damage.
For example, cyber criminals with access to fibre cables can use simple techniques such as ‘bending the fibre’ to interrupt all network traffic, resulting in the loss of availability of information.
Control 7.12 addresses how organisations can maintain the security of information assets transmitted via cables by implementing appropriate measures.
Purpose of Control 7.12
Control 7.12 enables organisations to achieve two distinct purposes:
- Protecting information assets carried via cables against unauthorised access, use, damage, or destruction by implementing appropriate measures;
- Ensuring the continuity of business operations by maintaining the security of cables that carry information assets, power, and electricity.
Attributes Table of Control 7.12
Control 7.12 is preventive in nature as it requires organisations to apply precautionary measures against the risks to the availability and confidentiality of the information and other critical assets carried through cables.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #Physical Security | #Protection |
| #Availability |
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Ownership of Control 7.12
Compliance with Control 7.12 requires creating an inventory of all cables, identifying appropriate security measures, carrying out a risk assessment and maintaining the security of cables.
While the facilities management team’s role and efforts are critical, the information security manager should bear the responsibility for compliance with Control 7.12.
General Guidance on Compliance
Control 7.12 recommends organisations take into account the following four criteria for compliance:
- Telecommunications and power cables connected to the information processing facilities should be placed underground to the extent it is feasible. Furthermore, cables laid down in the underground should be protected against accidental cuts through suitable techniques such as armoured conduits. If placing the cables underground is not possible, organisations can consider implementing alternative protective measures such as floor cable protectors and utility poles.
- Power and communications cables should be segregated to eliminate the risk of interference.
- Considering that cables connected to critical information systems present higher risks to the sensitive information assets and to business operations, organisations should consider putting in place the following controls:
- Using armoured conduit, installing locked rooms & boxes, and setting up alarm systems both at inspection and terminal points.
- Applying electromagnetic shielding technique to prevent damage to cables.
- Cables should be subject to inspections at regular intervals and to technical sweeps to ensure that no unauthorised device is connected to the cables.
- Establishing access control procedures and measures for access to cable rooms and patch panels.
- Using fibre-optic cables.
- The source and destination details of each cable should be labelled at both the starting and endpoints of the cable so that the cable can be easily identified and inspected.
Furthermore, organisations are also advised to seek expert advice on how to manage risks that may arise from cable malfunctioning.
Last but not the least, organisations should consider the risks related to the use of communications and power cables by more than one organisation when they are on shared premises.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
27002:2022/7.12 replaces 27002:2013/(11.2.3)
While the Control 7.12 is similar to its 2013 counterpart to great extent, the Control 7.12 introduces the following requirement in the general guidance:
- The source and destination details of each cable should be labelled at both the starting and endpoints of the cable so that the cable can be easily identified and inspected.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
ISMS.Online is a complete solution for ISO 27002 implementation.
It is a web-based system that allows you to show that your information security management system (ISMS) is compliant with the approved standards using well thought out processes and procedures and checklists.
Get in touch today to book a demo.
