Operational software can broadly be described as any piece of software that the business actively uses to conduct its operation, as distinct from test software or development projects.
It is vitally important to ensure that software is installed and managed on a given network in accordance with a strict set of rules and requirements that minimise risk, improve efficiency and maintain security within internal and external networks and services.
Control 8.19 is a preventive control that maintains risk by establishing a set of rules that govern the installation of software on operational systems.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality #Integrity #Availability | #Protect | #Secure Configuration #Application Security | #Protection |
Control 8.19 deals with technical concepts relating to the maintenance and management of operational computer systems. As such, ownership should rest with the Head of IT, or organisational equivalent.
In order to securely manage change and installations on their network, organisations should:
Where vendor-supplied software is concerned (e.g. any software used in the operation of machinery or for a bespoke business function) such software should always be kept in good working order by referring to the vendor’s guidelines for safe and secure operation.
It’s important to note that even where software or software modules are externally supplied and managed (i.e. the organisation is not responsible for any updates), steps should be taken to ensure that third party updates do not compromise on the integrity of the organisation’s network.
Organisations should avoid using unsupported vendor software unless absolutely necessary, and consider the associated security risks of utilising redundant applications as opposed to an upgrade to newer and more secure systems.
If a vendor requires access to an organisation’s network to perform an installation or update, activity should be monitored and validated in line with all relevant authorisation procedures (see Control 5.22).
Software should be upgraded, installed and/or patched in accordance with the organisation’s published change management procedures, to ensure uniformity with other areas of the business.
Whenever a patch is identified that either totally eliminates a vulnerability (or series of vulnerabilities), or helps in any way to improve the organisation’s information security operation, such changes should almost always be applied (though there is still the need to assess such changes on a case-by-case basis).
Where the need arises to use open source software, this should always be of the latest publicly available version that is actively maintained. Accordingly, organisations should consider the inherent risks of using unmaintained software within all business functions.
ISO 27002:2022-8.19 replaces ISO 27002:2003-12.5.1 (Installation of software on operations systems) and 12.6.2 (Restrictions on software installation).
27002:2022-8.19 is an amalgamation of most of the advice contained within 27002:2003-12.5.1 and 12.6.2, with several key concepts briefly expanded upon and with the addition of some new governing principles:
ISMS.Online is a complete solution for ISO 27002 implementation. It is a web-based system that allows you to show that your information security management system (ISMS) is compliant with the approved standards using well-thought-out processes, procedures, and checklists.
It is not just an easy-to-use platform for managing your ISO 27002 implementation, but also an excellent tool for training your staff on information security best practices and processes, as well as documenting all of your efforts.
The Advantages of Using ISMS.Online:
Get in touch today to book a demo.
We’ll give you an 81% headstart
from the moment you log in
Book your demo
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
