ISO 27002:2022 – Control 8.16 – Monitoring Activities

Purpose of Control 8.16

Network monitoring is the cornerstone of any successful IT support and information security operation.

It is vitally important for organisations to promote a proactive approach to monitoring that seeks to prevent incidents before they happen, and works in tandem with reactive efforts to form an end-to-end information security and incident resolution strategy that ticks every last box.

Attributes Table of Control 8.16

Control 8.16 is a dual-purpose detective and corrective control that modifies risk by optimising monitoring activities to identify anomalous behaviour and assists in the prompt analysis of information security events and incidents.

Ownership of Control 8.16

Control 8.16 deals with ICT operations that are performed using system administrator access, and fall under the umbrella of network management and maintenance.

As such, ownership of Control 8.16 should rest with the Head of IT, or organisational equivalent.

General Guidance on Compliance

Monitoring should be first and foremost carried out in line with any regulatory requirements or prevailing legislation, and any records retained in accordance with company retention policy.

Suspect events should be reported to all relevant personnel in order to maintain network integrity and improve business continuity alongside the following processes (see Control 5.25):

• Auditing
• Security and risk evaluation
• Vulnerability scanning
• Monitoring

Organisations should include the following in their monitoring operation:

1. Both inbound and outbound network traffic, including data to and from applications
2. Access to business critical platforms, including (but not limited to):
• Systems
• Servers
• Networking hardware
• The monitoring system itself
3. Configuration files
4. Event logs from security equipment and software platforms
5. Code checks that ensure any executable programs are both authorised and temper-free
6. Compute, storage and networking resource usage

Guidance – Behavioural Analysis

Organisations should gain a firm understanding of normal user activity and network behaviour, and use this as a baseline to identify anomalous behaviour across the network, including:

1. Sudden closure or termination of processes and applications
2. Network traffic that is recognised as emanating to and/or from problematic IP addresses and/or external domains
3. Well-known intrusion methods (e.g. DDoS)
4. Malicious system behaviour (e.g. key logging)
5. Network bottlenecks and high ping and/or latency times
6. Unauthorised or unexplainable access to and/or scanning of data, domains or applications
7. Any attempts to access business critical ICT resources (e.g. domain controllers, DNS servers, file servers and web portals)

To establish a successful baseline, organisations should monitor network utilisation and access times at normal working levels.

Guidance – Monitoring tools

The organisations should optimise its monitoring efforts using specialised monitoring tools that are suited to the type of network and traffic that they deal with on a daily basis.

Monitoring tools should be able to:

1. Handle large amounts of monitoring data
2. React to suspect data, traffic and user behaviour patterns and one-off activities
3. Amend any monitoring activities to react to different risk level
4. Notify organisations of anomalous activity in real time, through a series of proactive alerts that contain a minimal amount of false positives (see Control 5.26)
5. Rely on an adequate level of application redundancy in order to maintain a continuous monitoring operation

Guidance – Security Monitoring

Security monitoring should be optimised through:

1. Dedicated threat intelligence systems (see Control 5.7) and intrusion protection platforms
2. Machine learning platforms
3. Whitelists, blacklists, block lists and allow lists on IP management platforms and email security software
4. Combining logging and monitoring activities into one end-to-end approach
5. A dedicated approach to well-known intrusion methods and malicious activity, such as the use of botnets, or denial of service attacks

Supporting Controls

• 5.25
• 5.26
• 5.7

Changes and Differences from ISO 27002:2013

ISO 27002:2022-8.16 is a new control that isn’t featured in ISO 27002:2003.

New ISO 27002 Controls

How ISMS.online Helps

ISMS.online makes implementing ISO 27002 easier by providing a set of tools to help you manage information security in your organisation. It will help you identify risks and develop controls to mitigate those risks, and then show you how to implement them within the organisation.

Contact us today to book a demo.