When cyber criminals compromise computing networks, services, or devices, they do not limit themselves to the compromised assets.
They leverage the initial intrusion to infiltrate an organisation’s entire network, gain access to sensitive information assets, or to carry out ransomware attacks.
For example, cyber criminals may steal the login credentials of human resources(HR) employees at a hospital following a successful phishing attack and gain access to human resources systems.
They can then use this access point to move laterally across the entire network and discover networks that host sensitive patient information. This intrusion may result in the compromise of information assets, trigger downtime, or expose the hospital to a ransomware attack.
If the hospital had network segregation techniques such as firewalls, virtual networks, or server isolation, it would likely prevent intruders from gaining access to sensitive information assets and minimise the impact of the breach.
Control 8.22 addresses how organisations can implement and maintain appropriate network segregation techniques to eliminate risks to the availability, integrity, and confidentiality of information assets.
Control 8.22 enables organisations to segregate their computing networks into sub-networks based on the level of sensitivity and criticality and restrict the flow of traffic between these different sub-networks.
This helps organisations prevent the spread of malware or viruses from compromised networks to other networks storing sensitive information assets.
This ensures that organisations maintain the confidentiality, integrity, and availability of information assets hosted on critical sub-networks.
Control 8.22 is preventive in nature as it requires organisations to take a proactive approach and establish and implement rules, procedures, and appropriate techniques to segregate the larger computing network into smaller network domains so that compromise of sensitive networks can be prevented.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality #Integrity #Availability | #Protect | #System and Network Security | #Protection |
Considering that Control 8.22 entails segmentation of networks, devices, and systems based on the level of risks involved and also the implementation of network segregation techniques and procedures, an Information Security officer should be held responsible for compliance.
When implementing network segregation measures, organisations should try to strike a balance between operational needs and security concerns.
Control 8.22 lists three recommendations that should be considered when implementing network segregation.
When segregating the network into smaller network sub-domains, organisations should consider the level of sensitivity and criticality of each network domain. Depending on this analysis, network sub-domains may be assigned to ‘public domains’, ‘desktop domains’, ‘server domains’, or ‘high-risk systems’.
Furthermore, organisations can also consider the business departments such as HR, marketing, and finance when segregating the network.
It is also noted that organisations can combine these two criteria and assign network sub-domains into categories such as ‘server domain connecting to sales department’.
Organisations should define the perimeter of each network sub-domain clearly. If there will be access between two different network domains, this access should be restricted at the perimeter level via the gateway such as firewalls or filtering routers.
Organisations should assess the security requirements for each specific domain when implementing network segregation and when authorising access via the gateways.
This assessment should be carried out in compliance with the access control policy as required under Control 5.15 and should also consider the following:
Considering that defining network security parameters for wireless networks is challenging, Control 8.22 recommends organisations adhere to the following practices:
Control 8.22 notes that organisations often enter into various business partnerships with other businesses and share their network, IT devices, and other information facilities.
Therefore, sensitive networks may be exposed to a heightened risk of unauthorised access by other users and organisations should take appropriate measures to prevent this risk.
27002:2022/8.22 replaces 27002:2013/(13.1.3)
While the 2022 and the 2013 Versions are similar to a great extent, there is one key difference.
In contrast to the 2013 Version, the 2022 version includes the following requirements for wireless networks:
ISMS.Online enables you to:
ISMS.Online offers a full range of features to help organisations and businesses achieve compliance with the industry standard ISO 27001 and/or ISO 27002 ISMS.
Please contact us today to schedule a demo.
We’ll give you an 81% headstart
from the moment you log in
Book your demo
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
