ISO 27002:2022 – Control 8.22 – Segregation of Networks

Enhancing Security with ISO 27002 Control 8.22: Network Segregation Strategies

When cyber criminals compromise computing networks, services, or devices, they do not limit themselves to the compromised assets.

They leverage the initial intrusion to infiltrate an organisation’s entire network, gain access to sensitive information assets, or to carry out ransomware attacks.

For example, cyber criminals may steal the login credentials of human resources(HR) employees at a hospital following a successful phishing attack and gain access to human resources systems.

They can then use this access point to move laterally across the entire network and discover networks that host sensitive patient information. This intrusion may result in the compromise of information assets, trigger downtime, or expose the hospital to a ransomware attack.

If the hospital had network segregation techniques such as firewalls, virtual networks, or server isolation, it would likely prevent intruders from gaining access to sensitive information assets and minimise the impact of the breach.

Control 8.22 addresses how organisations can implement and maintain appropriate network segregation techniques to eliminate risks to the availability, integrity, and confidentiality of information assets.

Purpose of Control 8.22

Control 8.22 enables organisations to segregate their computing networks into sub-networks based on the level of sensitivity and criticality and restrict the flow of traffic between these different sub-networks.

This helps organisations prevent the spread of malware or viruses from compromised networks to other networks storing sensitive information assets.

This ensures that organisations maintain the confidentiality, integrity, and availability of information assets hosted on critical sub-networks.

Attributes Table of Control 8.22

Control 8.22 is preventive in nature as it requires organisations to take a proactive approach and establish and implement rules, procedures, and appropriate techniques to segregate the larger computing network into smaller network domains so that compromise of sensitive networks can be prevented.

Ownership of Control 8.22

Considering that Control 8.22 entails segmentation of networks, devices, and systems based on the level of risks involved and also the implementation of network segregation techniques and procedures, an Information Security officer should be held responsible for compliance.

General Guidance on Compliance

When implementing network segregation measures, organisations should try to strike a balance between operational needs and security concerns.

Control 8.22 lists three recommendations that should be considered when implementing network segregation.

How to Separate the Network Into Smaller Sub-Networks

When segregating the network into smaller network sub-domains, organisations should consider the level of sensitivity and criticality of each network domain. Depending on this analysis, network sub-domains may be assigned to ‘public domains’, ‘desktop domains’, ‘server domains’, or ‘high-risk systems’.

Furthermore, organisations can also consider the business departments such as HR, marketing, and finance when segregating the network.

It is also noted that organisations can combine these two criteria and assign network sub-domains into categories such as ‘server domain connecting to sales department’.

Security Perimeters and Access Control

Organisations should define the perimeter of each network sub-domain clearly. If there will be access between two different network domains, this access should be restricted at the perimeter level via the gateway such as firewalls or filtering routers.

Organisations should assess the security requirements for each specific domain when implementing network segregation and when authorising access via the gateways.

This assessment should be carried out in compliance with the access control policy as required under Control 5.15 and should also consider the following:

• Level of classification assigned to information assets.
• Criticality of information.
• Cost, and practical considerations for use of a particular gateway technology.

Wireless Networks

Considering that defining network security parameters for wireless networks is challenging, Control 8.22 recommends organisations adhere to the following practices:

• The use of radio coverage adjustment techniques to segregate wireless networks should be assessed.
• For sensitive networks, organisations can assume all wireless access attempts as external connections and prevent access to internal networks until the gateway control approves access.
• If personnel only use their own devices in accordance with the organisation’s policy, the wireless network access provided for personnel and for guests should be segregated.
• Use of Wi-fi by guests should be subject to the same restrictions and controls imposed on the personnel.

Supplementary Guidance on Control 8.22

Control 8.22 notes that organisations often enter into various business partnerships with other businesses and share their network, IT devices, and other information facilities.

Therefore, sensitive networks may be exposed to a heightened risk of unauthorised access by other users and organisations should take appropriate measures to prevent this risk.

Changes and Differences from ISO 27002:2013

27002:2022/8.22 replaces 27002:2013/(13.1.3)

While the 2022 and the 2013 Versions are similar to a great extent, there is one key difference.

In contrast to the 2013 Version, the 2022 version includes the following requirements for wireless networks:

• If personnel only use their own devices in accordance with the organisation’s policy, the wireless network access provided for personnel and for guests should be segregated.
• The use of Wi-fi by guests should be subject to the same restrictions and controls imposed on the personnel.

New ISO 27002 Controls

How ISMS.online Helps

ISMS.Online enables you to:

• Document your processes. This intuitive interface allows you to document your processes without installing any software on your computer or network.
• Automate your risk assessment process.
• Demonstrate compliance easily with online reports and checklists.
• Keep a record of progress while working toward certification.

ISMS.Online offers a full range of features to help organisations and businesses achieve compliance with the industry standard ISO 27001 and/or ISO 27002 ISMS.

Please contact us today to schedule a demo.