ISO 27002:2022 – Control 8.9 – Configuration Management

Purpose of Control 8.9

Configurations – whether acting as a single config file, or a group of configurations linked together – are the underlying parameters that govern how hardware, software and even entire networks are managed.

As an example, a firewall’s configuration file will hold the baseline attributes that the device uses to manage traffic to and from an organisation’s network, including block lists, port forwarding, virtual LANs and VPN information.

Configuration management is an integral part of an organisation’s broader asset management operation. Configurations are key in ensuring that a network is not only operating as it should be, but also in securing devices against unauthorised changes or incorrect amendments on the part of maintenance staff and/or vendors.

Attributes Table of Control 8.9

Control 8.9 is a preventative control that maintains risk by establishing a series of policies that govern how an organisation documents, implements, monitors and reviews the use of configurations across its entire network.

Ownership of Control 8.9

Configuration management is solely an administrative task that deals with the maintenance and monitoring of asset-side information and data that is resident on a broad range of devices and applications. As such, ownership should reside with the Head of IT, or organisational equivalent.

General Guidance on Compliance

On the whole, organisation’s need to draft and implement configuration management policies for both new systems and hardware, and any that are already in use. Internal controls should include business critical elements such as security configurations, all hardware that holds a configuration file and any relevant software applications or systems.

Control 8.9 asks organisations to consider all relevant roles and responsibilities when implementing a configuration policy, including the delegated ownership of configurations on a device-by-device, or application-by-application basis.

Guidance – Standard Templates

Where possible, organisations should use standardised templates to secure all hardware, software and systems. Templates should:

1. Attempt to utilise publicly available, vendor-specific and/or open source guidance on how best to configure hardware and software assets.
2. Meet minimum security requirements for the device, application or system that they are applicable to.
3. Work in harmony with the organisation’s broader information security efforts, including all relevant ISO controls.
4. Keep in mind the organisation’s unique business requirements – especially where security configurations are concerned – including how feasible it is to apply or manage a template at any given time.
5. Be reviewed at appropriate intervals in order to cater for system and/or hardware updates, or any prevailing security threats.

Guidance – Security Controls

Security is paramount when applying configuration templates, or amending existing templates in line with the above guidance.

When considering standard templates for use across the organisation, in order to minimise any information security risks organisations should:

1. Keep the number of users with administrator privileges to a minimum.
2. Disable any unused or unnecessary identities.
3. Closely monitor access to maintenance programs, utility applications and internal settings.
4. Ensure that clocks are synchronised in order to log configuration correctly, and assist in any future investigations.
5. Immediately change any default passwords or default security settings that are supplied with any device, service or application.
6. Implement a default logoff period for any devices, systems or applications that have been left dormant for a specified period of time.
7. Ensure that all licensing requirements have been met (see Control 5.32).

Guidance – Managing and Monitoring Configurations

An organisation has a responsibility to maintain and store configurations, including keeping an audit trail of any amendments or new installations, in line with a published change management process (see Control 8.32).

Logs should contain information that outlines:

1. Who owns the asset.
2. A timestamp for the latest configuration change.
3. The current version of the configuration template.
4. Any relevant information that explains the assets relationship with configurations held on other devices or systems.

Organisations should deploy a wide range of techniques to monitor the operation of configuration files across their network, including:

1. Automation.
2. Specialised configuration maintenance programs.
3. Remote support tools that auto-populate configuration information on a device-by-device basis.
4. Enterprise device and software management utilities that are designed to monitor large amounts of configuration data at once.
5. BUDR software that automatically backs up configurations to a secure location, and restores templates either remotely or onsite to compromised and/or malfunctioning devices.

Organisations should configure specialised software to track any changes in a device’s configuration, and take appropriate action to address the amendment as soon as possible, either by validating the change or reverting the configuration back to its original state.

Supporting Guidelines

• 5.32
• 8.32

Changes and Differences from ISO 27002:2013

None. Control 8.9 has no precedent in ISO 27002:2013 as it is new.

New ISO 27002 Controls

How ISMS.online Helps

ISMS.Online is a complete solution for ISO 27002 implementation.

It is a web-based system that allows you to show that your information security management system (ISMS) is compliant with the approved standards using well thought out processes and procedures and checklists.

Get in touch today to book a demo.