Purpose of Control 8.11
Data masking is a technique used to protect sensitive data – usually any data that could be deemed personally identifiable information (PII) – over and above an organisation’s standard information security protocols such as access control etc.
Data masking is often mentioned in legal, statutory and regulatory guidelines and laws governing the storage and access of employee, customer, user and vendor information.
Attributes Table of Control 8.11
Control 8.11 is a preventive control that modifies risk by suggesting a series of data masking techniques which safeguard PII, and helps the organisation to remain compliant with what’s asked of it by legal authorities and regulatory agencies.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #Information Protection | #Protection |
Ownership of Control 8.11
Data masking is a complex technical process that involves altering sensitive information, and preventing users from identifying data subjects through a variety of measures.
Whilst this is itself an administrative task, the nature of data masking is directly related to an organisation’s ability to remain compliant with laws, regulations and statutory guidelines concerning the storage, access and processing of data. As such, ownership should reside with the Chief Information Security Officer, or organisational equivalent.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
General Guidance on Compliance
Control 8.11 asks organisations to consider data masking through the scope of two main techniques – pseudonymisation and/or anonymisation. Both of these methods are designed to disguise the true purpose of PII through disassociation – i.e. hiding the link between the raw data, and the subject (usually a person).
Organisations should take great care to ensure that no single piece of data compromises the subject’s identity.
When using either of these techniques, organisations should consider:
- The level of pseudonymisation and/or anonymisation required, relative to the nature of the data.
- How the masked data is being accessed.
- Any binding agreements that restrict use of the data to be masked.
- Keeping the masked data separate from any other data types, in order to prevent the data subject being easily identified.
- Logging when the data was received, and how it has been provided to any internal or external sources.
Guidance – Additional Techniques
Pseudonymisation and anonymisation aren’t the only methods available to organisations looking to mask PII or sensitive data. Control 8.11 outlines 5 other methods that can be used to bolster data security:
- Key-based encryption.
- Voiding or deleting characters within the dataset.
- Varying numbers and dates.
- Replacing values across the data.
- Hash-based value masking.
Guidance – Data Masking Principles
Data masking is an important part of an organisation’s policy towards protecting PII and safeguarding the identity of the individuals whom it holds data on.
As well as the above techniques, organisations should consider the below suggestions when strategising their approach to data masking:
- Implement masking techniques that only reveal the minimum amount of data to anyone who uses it.
- ‘Obfuscating’ (hiding) certain pieces of data at the request of the subject, and only allowing certain members of staff to access the sections that are relevant to them.
- Building their data masking operation around specific legal and regulatory guidelines.
- Where pseudonymisation is implemented, the algorithm that is used to ‘de-mask’ the data is kept safe and secure.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
None. Control 8.11 has no precedent in ISO 27002:2013 as it is new.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
Our cloud-based platform provides you with a robust framework of information security controls so that you can checklist your ISMS process as you go to ensure that it meets the requirements for ISO 27002:2022.
Get in touch today to book a demo.
