Network monitoring is the cornerstone of any successful IT support and information security operation.
It is vitally important for organisations to promote a proactive approach to monitoring that seeks to prevent incidents before they happen, and works in tandem with reactive efforts to form an end-to-end information security and incident resolution strategy that ticks every last box.
Control 8.16 is a dual-purpose detective and corrective control that modifies risk by optimising monitoring activities to identify anomalous behaviour and assists in the prompt analysis of information security events and incidents.
Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
---|---|---|---|---|
#Detective #Corrective | #Confidentiality #Integrity #Availability | #Detect #Respond | #Information Security Event Management | #Defence |
Control 8.16 deals with ICT operations that are performed using system administrator access, and fall under the umbrella of network management and maintenance.
As such, ownership of Control 8.16 should rest with the Head of IT, or organisational equivalent.
Monitoring should be first and foremost carried out in line with any regulatory requirements or prevailing legislation, and any records retained in accordance with company retention policy.
Suspect events should be reported to all relevant personnel in order to maintain network integrity and improve business continuity alongside the following processes (see Control 5.25):
Organisations should include the following in their monitoring operation:
Organisations should gain a firm understanding of normal user activity and network behaviour, and use this as a baseline to identify anomalous behaviour across the network, including:
To establish a successful baseline, organisations should monitor network utilisation and access times at normal working levels.
We’ll give you an 81% headstart
from the moment you log in
Book your demo
The organisations should optimise its monitoring efforts using specialised monitoring tools that are suited to the type of network and traffic that they deal with on a daily basis.
Monitoring tools should be able to:
Security monitoring should be optimised through:
ISO 27002:2022-8.16 is a new control that isn’t featured in ISO 27002:2003.
ISMS.online makes implementing ISO 27002 easier by providing a set of tools to help you manage information security in your organisation. It will help you identify risks and develop controls to mitigate those risks, and then show you how to implement them within the organisation.
Contact us today to book a demo.
ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
---|---|---|
5.7 | New | Threat intelligence |
5.23 | New | Information security for use of cloud services |
5.30 | New | ICT readiness for business continuity |
7.4 | New | Physical security monitoring |
8.9 | New | Configuration management |
8.10 | New | Information deletion |
8.11 | New | Data masking |
8.12 | New | Data leakage prevention |
8.16 | New | Monitoring activities |
8.23 | New | Web filtering |
8.28 | New | Secure coding |
ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
---|---|---|
6.1 | 07.1.1 | Screening |
6.2 | 07.1.2 | Terms and conditions of employment |
6.3 | 07.2.2 | Information security awareness, education and training |
6.4 | 07.2.3 | Disciplinary process |
6.5 | 07.3.1 | Responsibilities after termination or change of employment |
6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
6.7 | 06.2.2 | Remote working |
6.8 | 16.1.2, 16.1.3 | Information security event reporting |
ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
---|---|---|
7.1 | 11.1.1 | Physical security perimeters |
7.2 | 11.1.2, 11.1.6 | Physical entry |
7.3 | 11.1.3 | Securing offices, rooms and facilities |
7.4 | New | Physical security monitoring |
7.5 | 11.1.4 | Protecting against physical and environmental threats |
7.6 | 11.1.5 | Working in secure areas |
7.7 | 11.2.9 | Clear desk and clear screen |
7.8 | 11.2.1 | Equipment siting and protection |
7.9 | 11.2.6 | Security of assets off-premises |
7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
7.11 | 11.2.2 | Supporting utilities |
7.12 | 11.2.3 | Cabling security |
7.13 | 11.2.4 | Equipment maintenance |
7.14 | 11.2.7 | Secure disposal or re-use of equipment |