Purpose of Control 8.16
Network monitoring is the cornerstone of any successful IT support and information security operation.
It is vitally important for organisations to promote a proactive approach to monitoring that seeks to prevent incidents before they happen, and works in tandem with reactive efforts to form an end-to-end information security and incident resolution strategy that ticks every last box.
Attributes Table of Control 8.16
Control 8.16 is a dual-purpose detective and corrective control that modifies risk by optimising monitoring activities to identify anomalous behaviour and assists in the prompt analysis of information security events and incidents.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Detective | #Confidentiality | #Detect | #Information Security Event Management | #Defence |
| #Corrective | #Integrity | #Respond | ||
| #Availability |
Ownership of Control 8.16
Control 8.16 deals with ICT operations that are performed using system administrator access, and fall under the umbrella of network management and maintenance.
As such, ownership of Control 8.16 should rest with the Head of IT, or organisational equivalent.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
General Guidance on Compliance
Monitoring should be first and foremost carried out in line with any regulatory requirements or prevailing legislation, and any records retained in accordance with company retention policy.
Suspect events should be reported to all relevant personnel in order to maintain network integrity and improve business continuity alongside the following processes (see Control 5.25):
- Auditing
- Security and risk evaluation
- Vulnerability scanning
- Monitoring
Organisations should include the following in their monitoring operation:
- Both inbound and outbound network traffic, including data to and from applications
- Access to business critical platforms, including (but not limited to):
- Systems
- Servers
- Networking hardware
- The monitoring system itself
- Configuration files
- Event logs from security equipment and software platforms
- Code checks that ensure any executable programs are both authorised and temper-free
- Compute, storage and networking resource usage
Guidance – Behavioural Analysis
Organisations should gain a firm understanding of normal user activity and network behaviour, and use this as a baseline to identify anomalous behaviour across the network, including:
- Sudden closure or termination of processes and applications
- Network traffic that is recognised as emanating to and/or from problematic IP addresses and/or external domains
- Well-known intrusion methods (e.g. DDoS)
- Malicious system behaviour (e.g. key logging)
- Network bottlenecks and high ping and/or latency times
- Unauthorised or unexplainable access to and/or scanning of data, domains or applications
- Any attempts to access business critical ICT resources (e.g. domain controllers, DNS servers, file servers and web portals)
To establish a successful baseline, organisations should monitor network utilisation and access times at normal working levels.
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Guidance – Monitoring tools
The organisations should optimise its monitoring efforts using specialised monitoring tools that are suited to the type of network and traffic that they deal with on a daily basis.
Monitoring tools should be able to:
- Handle large amounts of monitoring data
- React to suspect data, traffic and user behaviour patterns and one-off activities
- Amend any monitoring activities to react to different risk level
- Notify organisations of anomalous activity in real time, through a series of proactive alerts that contain a minimal amount of false positives (see Control 5.26)
- Rely on an adequate level of application redundancy in order to maintain a continuous monitoring operation
Guidance – Security Monitoring
Security monitoring should be optimised through:
- Dedicated threat intelligence systems (see Control 5.7) and intrusion protection platforms
- Machine learning platforms
- Whitelists, blacklists, block lists and allow lists on IP management platforms and email security software
- Combining logging and monitoring activities into one end-to-end approach
- A dedicated approach to well-known intrusion methods and malicious activity, such as the use of botnets, or denial of service attacks
Supporting Controls
- 5.25
- 5.26
- 5.7
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
ISO 27002:2022-8.16 is a new control that isn’t featured in ISO 27002:2003.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
ISMS.online makes implementing ISO 27002 easier by providing a set of tools to help you manage information security in your organisation. It will help you identify risks and develop controls to mitigate those risks, and then show you how to implement them within the organisation.
Contact us today to book a demo.
