ISO 27002:2022, Control 8.27 – Secure System Architecture and Engineering Principles

Ownership of Control 8.27

Chief Information Security Officer should be held responsible for the establishment, maintenance, and implementation of principles that govern secure engineering of information systems.

General Guidance on Compliance

Control 8.27 highlights that organisations should embed security into all layers of information systems, including business processes, applications, and data architecture.

Furthermore, secure engineering principles should apply to all activities related to information systems and should be subject to regular review and updates taking into account emerging threats and attack patterns.

In addition to information systems developed and operated internally, Control 8.27 also applies to information systems created by external service providers.

Therefore, organisations should ensure that service providers’ practices and standards comply with their own secure engineering principles.

Control 8.27 requires secure system engineering principles to cover the eight following issues:

• Guidance on user authentication methods.
• Guidance on secure session control.
• Guidance on data sanitisation and validation procedures.
• Comprehensive analysis of all security measures needed to protect information assets and systems against known threats.
• Comprehensive analysis on capabilities of security measures to identify, eliminate and respond to security threats.
• Analysing security measures applied to specific business activities such as encryption of information.
• How security measures will be implemented and where. This may include the integration of a specific security control within technical infrastructure.
• How different security measures work together and operate as a combined set of controls.

Guidance on Zero Trust Principle

Organisations should consider the following zero-trust principles:

• Starting with the assumption that the organisation’s systems are already compromised and the defined network perimeter security is no longer effective.
• Adopting a “never trust and always verify” approach for providing access to information systems.
• Providing assurance that requests made to information systems are protected with end-to-end encryption.
• Implementing verification mechanism that assumes access requests to information systems are made from external, open networks.
• Putting in place “least privilege” and dynamic access control techniques in accordance with Control 5.15, 5,18 and 8.2. This covers the authentication and authorisation of access requests for sensitive information and information systems considering contextual information such as user identities as defined in Control 5.16 and information classification as prescribed in Control 5.12.
• Always authenticating the identity of the requester and verifying authorisation requests to access information systems. These authentication and verification procedures should be performed in accordance with authentication information in Control 5.17, User Identities in Control 5.16, and Multi-Factor in Control 8.5.

What Should Secure System Engineering Techniques Cover?

• Adopting and implementing secure architecture principles, including “security by design”, “defence in depth”, “fail securely”, “distrust input from external applications”, “assume breach”, “least privilege”, “usability and manageability” and “least functionality”.
• Adopting and applying a security-focused design review process to detect information security vulnerabilities and guaranteeing that security measures are identified and satisfy security requirements.
• Documenting and acknowledging the security measures that do not fulfil requirements.
• System hardening.

What Criteria to Consider When Designing Secure Engineering Principles?

Organisations should consider the following when establishing secure system engineering principles:

• The need to integrate controls with specific security architecture.
• Existing technical security infrastructure, including public key infrastructure, identity management, and data leakage prevention.
• Whether the organisation is capable of building and maintaining the selected technology.
• Cost and time required to satisfy security requirements and complexity of such requirements.
• Existing best practices.

Practical Guidance on Application of Secure System Engineering Principles

Control 8.27 notes that organisations can put secure engineering principles into practice when configuring the following:

• Fault tolerance and similar resilience methods.
• Segregation techniques such as virtualisation.
• Tamper resistance.

Furthermore, the use of secure virtualisation technology can help eliminate the risk of interception between two applications running on the same device.

Lastly, it is pointed out that the use of tamper resistance systems can help identify both the logical and physical tampering with information systems and prevent unauthorised extraction of information.

Changes and Differences From ISO 27002:2013

27002:2022/8.27 replace 27002:2013/(14.2.5)

2022 version introduces more comprehensive requirements compared to the 2013 version:

1. In contrast to the 2013 version, the 2022 version provides guidance on what secure engineering principles should cover.
2. Unlike the 2013 version, the 2022 version addresses what criteria organisations should consider when they design secure system engineering principles.
3. The 2022 version includes guidance on the zero trust principle. 2013 version, on the other hand, did not cover this.
4. The 2022 version includes recommendations on what secure engineering techniques should be applied such as “security by design”. Unlike the 2022 version, the 2013 version did not refer to such techniques.

How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process. Your complete compliance solution for ISO/IEC 27002:2022.

• Up to 81% progress from when you log in.
• Simple and total compliance solution.

Get in touch today to book a demo.