Purpose of Control 8.19
Operational software can broadly be described as any piece of software that the business actively uses to conduct its operation, as distinct from test software or development projects.
It is vitally important to ensure that software is installed and managed on a given network in accordance with a strict set of rules and requirements that minimise risk, improve efficiency and maintain security within internal and external networks and services.
Attributes Table of Control 8.19
Control 8.19 is a preventive control that maintains risk by establishing a set of rules that govern the installation of software on operational systems.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #Secure Configuration | #Protection |
| #Integrity | #Application Security | |||
| #Availability |
Ownership of Control 8.19
Control 8.19 deals with technical concepts relating to the maintenance and management of operational computer systems. As such, ownership should rest with the Head of IT, or organisational equivalent.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
General Guidance on Compliance
In order to securely manage change and installations on their network, organisations should:
- Ensure that software updates are only carried out by trained and competent personnel (see Control 8.5).
- Only install robust executable code that’s free from any bugs and has safely exited the development stage.
- Only install and/or update software after said update or patch has been successfully tested, and the organisation is confident that no conflicts or errors will ensue.
- Maintain an up to date library system.
- Utilise a ‘configuration control system’ that manages all instances of operational software, including program documentation.
- Agree upon a ‘rollback strategy’ prior to any updates or installations, to ensure business continuity in the event of an unforeseen error or conflict.
- Keep a log of any updates performed to operational software, including a summary of the update, the personnel involved and a timestamp.
- Ensure that unused software – including all documentation, configuration files, system logs, supporting procedures – are securely stored for further use, should the need arise.
- Enforce a strict set of rules on the type of software packages that users can install, based on the principles of ‘least privileged’ and in accordance with relevant roles and responsibilities.
Guidance – Vendor Software
Where vendor-supplied software is concerned (e.g. any software used in the operation of machinery or for a bespoke business function) such software should always be kept in good working order by referring to the vendor’s guidelines for safe and secure operation.
It’s important to note that even where software or software modules are externally supplied and managed (i.e. the organisation is not responsible for any updates), steps should be taken to ensure that third party updates do not compromise on the integrity of the organisation’s network.
Organisations should avoid using unsupported vendor software unless absolutely necessary, and consider the associated security risks of utilising redundant applications as opposed to an upgrade to newer and more secure systems.
If a vendor requires access to an organisation’s network to perform an installation or update, activity should be monitored and validated in line with all relevant authorisation procedures (see Control 5.22).
Supplementary Guidance on Control 8.19
Software should be upgraded, installed and/or patched in accordance with the organisation’s published change management procedures, to ensure uniformity with other areas of the business.
Whenever a patch is identified that either totally eliminates a vulnerability (or series of vulnerabilities), or helps in any way to improve the organisation’s information security operation, such changes should almost always be applied (though there is still the need to assess such changes on a case-by-case basis).
Where the need arises to use open source software, this should always be of the latest publicly available version that is actively maintained. Accordingly, organisations should consider the inherent risks of using unmaintained software within all business functions.
Supporting Controls
- 5.22
- 8.5
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
ISO 27002:2022-8.19 replaces ISO 27002:2003-12.5.1 (Installation of software on operations systems) and 12.6.2 (Restrictions on software installation).
27002:2022-8.19 is an amalgamation of most of the advice contained within 27002:2003-12.5.1 and 12.6.2, with several key concepts briefly expanded upon and with the addition of some new governing principles:
- Maintaining a library system.
- Rules governing the use of open source software.
- Closer logical controls on the installation and maintenance of vendor software.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
ISMS.Online is a complete solution for ISO 27002 implementation. It is a web-based system that allows you to show that your information security management system (ISMS) is compliant with the approved standards using well-thought-out processes, procedures, and checklists.
It is not just an easy-to-use platform for managing your ISO 27002 implementation, but also an excellent tool for training your staff on information security best practices and processes, as well as documenting all of your efforts.
The Advantages of Using ISMS.Online:
- Easy-to-use online platform that can be accessed from any device.
- It is completely customisable to meet your needs.
- Customisable workflows and processes to fit your business needs.
- Training tools to help new hires get up to speed faster.
- A library of templates for documents such as policies, procedures, plans, and checklists.
Get in touch today to book a demo.
