ISO 27001:2022 Annex A Control 8.20

Abstract of Control 8.20: Networks security

ISO 27001 Control 8.20—Network Security—emphasizes securing networks, devices, and communication paths from unauthorized access, disruption, or threats. Through implementing strong network security measures, you help ensure the confidentiality, integrity, and availability of your organization’s data and infrastructure.

Control Type

Information Security Properties

Cybersecurity Concepts

Operational Capabilities

Security Domains

Objective

The primary objective of ISO 27001 Control 8.20 is to ensure your organization’s networks and the devices that facilitate communication are robustly managed, securely configured, and carefully monitored. Implementing this control, you minimize the risk of security breaches, maintain compliance, and deliver consistent services to your customers and stakeholders.

Purpose

The purpose of Network Security under Control 8.20 is to prevent unauthorized access, disclosure, or compromise of sensitive data moving through your organization’s networks. This control also helps protect the applications and systems that depend on these networks, ensuring business continuity and safeguarding your organization’s reputation.

Scope

Control 8.20 applies to all types of networks within your organization, including internal corporate LANs, public-facing networks, wireless networks, and virtualized networks (such as SDN or SD-WAN). It covers both the physical infrastructure—like routers, firewalls, and switches—and the logical layers, including network protocols, administration channels, and security configurations.

Requirements and Implementation Guidance

Network Classification and Segmentation

Information Classification: Identify and classify data flowing through each segment (e.g., confidential, internal, public). A clear classification helps you apply the right protective measures to each network zone. Use our Data Classification Template if you like to start with a solid foundation.
Network Segmentation: Divide your network into sub-networks (or VLANs) based on data sensitivity or business function. This approach prevents attackers from moving freely across your environment, reducing the potential impact of a breach.
Drawbridges and Isolation: In the event of a network-based attack, isolate critical subnetworks—sometimes referred to as “drawbridges”—to contain threats while maintaining essential operations elsewhere.

Network Device Management

Up-to-Date Documentation: Keep current network diagrams, asset inventories, and configuration files for all devices (routers, switches, wireless access points, etc.). This documentation is essential for troubleshooting, compliance, and audits.
Assign Clear Responsibilities: Define who manages routers, who updates firewalls, and who oversees wireless controllers. Separation of duties ensures better accountability and reduces the likelihood of configuration mistakes.
Device Hardening: Disable unnecessary services, change default passwords, and regularly patch or update firmware to reduce vulnerabilities. Hardening network devices is crucial for preventing common exploits.

Network Access Control (NAC)

Authentication: Require devices and users to authenticate before gaining network access. This might involve 802.1X for wired and wireless networks, certificate-based authentication, or multi-factor verification.
Restricting & Filtering: Employ firewalls, intrusion prevention systems (IPS), and intrusion detection systems (IDS) to inspect traffic at key points, preventing unauthorized ingress and egress.
Device Connectivity: Use NAC solutions to detect and block unknown or unmanaged devices on the network. By validating a device’s security posture (e.g., antivirus status, patch level), you reduce infection risk.

Network Administration and Responsibilities

Separation of Duties: Where possible, separate network operations from ICT system operations to prevent conflicts of interest (see ISO 27001 Control 5.3 for more).
Administrators’ Access: Secure remote administration channels (e.g., using SSH instead of Telnet) to protect login credentials and minimize eavesdropping.
Coordinated Management: Ensure that your network administrators, security teams, and IT management communicate and collaborate. Consistent coordination leads to standardized configurations and minimized misconfigurations.

Data Protection over Networks

Encryption: Always encrypt sensitive data in transit—especially over public or third-party networks. Use robust protocols such as TLS, HTTPS, or IPsec VPNs to protect data confidentiality and integrity.
Maintaining Data Integrity: Keep an eye on data traveling across the network with checksums and secure protocol validations. This helps detect and prevent tampering or data corruption.
Availability Safeguards: Implement redundancy strategies like link failover, load balancing, and automatic re-routing to keep network services running smoothly in the event of disruptions.

Logging and Monitoring

Comprehensive Logging: Log network activities such as firewall changes, VPN connections, and switch port modifications. These logs serve as an audit trail for both operational and forensic purposes.
Real-Time Monitoring: Deploy network monitoring and intrusion detection solutions to spot anomalies—like unusual traffic spikes or repeated log-in failures—and trigger alerts.
Automated Alerting: Set up automatic notifications to promptly inform your security team about critical events, allowing immediate response to potential threats.

Virtualized Networks and Software-Defined Environments

SDN and SD-WAN Security: Introduce security controls (like policy enforcement, encryption, and route validation) at the software-defined networking layer to guard against misconfiguration or malicious changes.
Configuration Management: Document and maintain the configurations of virtual routers, switches, and controllers within a centralized repository. This ensures streamlined management and quick recovery if issues occur.
Isolated Network Segments: Even in a virtualized environment, logical separation can be as critical as physical isolation in preventing cross-segment threats.

Disabling Vulnerable Protocols

Protocol Review: Regularly audit your network to identify outdated or insecure protocols such as Telnet, FTP, or SSLv2.
Transition to Secure Protocols: Migrate to more secure alternatives like SSH, SFTP, TLS (1.2 or higher), and SNMPv3. This step significantly reduces opportunities for attackers to compromise your network.

Roles & Responsibilities

Network Administrators: Oversee day-to-day network operations, maintain device configurations, and ensure uptime.
Security Team: Sets security policies, conducts risk assessments, and monitors logs for suspicious activities.
IT Management: Aligns network security strategies with overall business goals, allocates resources, and supports compliance efforts.
End Users: Follow best practices, such as reporting anomalies and not connecting unapproved devices to the network.

Other Relevant Controls

Control 5.3: Outlines Segregation of Duties
Control 5.14: Focuses on Information Transfer
Control 5.22: Monitoring, review and change management of supplier services
Control 6.6: Addresses Confidentiality or non-disclosure agreements.
Control 8.15 & Control 8.16: Provide detailed guidance on logging and monitoring, reinforcing the importance of real-time threat detection.
Control 8.24: Governs the use of cryptographic controls to protect data

For deeper insights, consider exploring additional guidelines in ISO/IEC 27033 (for general network security) and ISO/IEC TS 23167 (for Cloud computing).

Summary & Recommendations

Implementing ISO 27001 Control 8.20—Network Security— classifying networks, hardening devices, controlling access, and continuously monitoring traffic, you significantly reduce the likelihood of data breaches and service interruptions. A few final recommendations to keep in mind:

Conduct Regular Risk Assessments: Evaluate network threats, vulnerabilities, and potential impacts on a routine basis to prioritize security investments effectively.
Stay Current with Patches and Updates: Continuously update network devices, security appliances, and software to fix known vulnerabilities.
Automate Where Possible: Use network management and security automation tools to configuration checks, updates, and monitoring.
Train Your Team: Provide ongoing education and awareness training for administrators and end users to maintain a security-first mindset.
Test Your Defenses: Perform penetration tests and simulations (e.g., tabletop exercises, Red Team/Blue Team drills) to confirm your network defenses work under real-world scenarios.