ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology.
One of the new controls added under the Physical category, is something called physical security monitoring. But what does this mean exactly?
Steve Mason joins us again today to delve deeper into physical security monitoring to explain what it is and give examples of different types of security and monitoring you can put in place.
You’ll learn
- What physical security monitoring is
- The purpose of physical security monitoring
- What should be monitored?
- Different types of security and monitoring you can consider
Resources
In this episode, we talk about:
[00:36] A quick recap of our ISO 27002 series and it’s purpose to date – Start from Episode 109
[01:58] ISO 27002 controls reduced from 114 controls to 93 – reduction due to some of them being combined or made redundant in the latest version
[04:02] The purpose of Physical Security Monitoring
[06:22] Example of where security monitoring solved an issue at a bank
[07:29] Another example of a London business who lacked physical security monitoring
[08:45] The importance of reviewing your need for physical security monitoring – what level do you need? Will it include CCTV, Access cards ect
[10:10] An overview of the various access points to consider, including: Main building, secure offices, server rooms, visitor access rights, CCTV, security alarms and personnel
[10:53] Example of where failure to verify a visitor highlighted a companies lack of security.
[11:30] The importance of communication and inductions for key reception and security staff, to ensure they can do the proper checks on visitors / know who should and should not be allowed into certain areas of your workplace.
[13:50] Suggestion of a checklist for checks on visitors for temp reception staff
[14:32] How do you define what needs 24 hour monitoring and what can be monitored for selected hours?
[15:46] The installation of security measures should be appropriate for your needs – don’t go overboard if it’s not needed. i.e. a Data Centre would need a high level of security but a small office may only need access control
[17:48] Take note of any security requirements in customer contracts
[18:10] How do you ensure the integrity of your security measures? i.e. CCTV – guidelines are available for installation, including placement, connection to your systems, keeping the timestamps accurate, logging any camera failures.
[20:00] Example of where a German company mapped out their CCTV so they could highlight blind spots, which were then pointed out to guards who did more checks in those areas
[21:15] Make sure you maintain any security equipment
[22:10] What crossover is there with other ISO 27002 controls? i.e. data masking being used in visitor books
[24:45] How can you apply this control to home workers? This can include training on being aware of potential security risks at home and locking the computer when not nearby ect
Download our ISO 27002 changes Quick Guide here:
We’d love to hear your views and comments about the ISO Show, here’s how:
- Share the ISO Show on Twitter or Linkedin
- Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.
Subscribe to keep up-to-date with our latest episodes:
Stitcher | Spotify | YouTube |iTunes | Soundcloud
ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology.
One of the new controls added under the technological category, is something called web filtering. But what does this mean exactly?
Steve Mason joins us again today to delve deeper into web filtering to explain what it is, break down the different types and gives examples of uses that you could implement to reduce risk.
You’ll learn
- What is web filtering?
- The purpose of web filtering
- The different types of web filtering
- Different measures of web filtering that can be implemented
Resources
In this episode, we talk about:
[01:05] How you can adopt the new controls of ISO 27002 ahead of the latest version of ISO 27001:2022 being published
[02:00] The purpose of web filtering
[02:26] An overview of what web filtering is: It’s a security technology that monitors web activity and prevents users from accessing websites with malicious content or sites that are deemed to be inappropriate for business use
[03:45] Outlook already has web filtering built in
[04:17] The Internet is still the dominant facilitator for cyber crime
[04:40] Types of web filtering, including: Browser based filters, search engine filters, client side filters and network based filters
[06:58] Examples of where web filtering comes into practice – to protect against threats from malicious sites with malware or fishing content, false anti-virus updates, sites with illegal content and sites with out of date SLL certificates.
[08:15] Are you safe relying on Microsoft Windows?
[08:50] What to look out for on websites to ensure it’s secure: A padlock in the bottom right corner, use of reputable third party payment gateways.
[09:27] Examples of what to be wary of when using the web i.e. deals that are too good to be true
[11:40] Consider setting up a small internet café that is separate from the company network – to allow employees access for personal use and to help keep your systems safe.
Download our ISO 27002 changes Quick Guide here:
We’d love to hear your views and comments about the ISO Show, here’s how:
- Share the ISO Show on Twitter or Linkedin
- Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.
Subscribe to keep up-to-date with our latest episodes:
Stitcher | Spotify | YouTube |iTunes | Soundcloud
ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology.
One of the new controls added under the organisational category, is something called threat intelligence. But what does this mean exactly?
Steve Mason joins us again today to delve deeper into threat intelligence to explain what it is, gives examples of the different types and shares some tools and activities that will help you develop threat intelligence
You’ll learn
- What is threat intelligence?
- What does threat intelligence actually do?
- The different types of threat intelligence
- What tools can you implement to help with threat intelligence?
- What activities can you do to help develop threat intelligence?
Resources
In this episode, we talk about:
[01:19] The definition and purpose of threat intelligence
[03:01] Threat intelligence doesn’t have to factor into your scope and context – you can integrate findings in later
[03:50] Threat intelligence is about being aware of not only internal threats, but global threats that could impact your business
[04:50] Threat intelligence is not only about IT (i.e. viruses)
[05:19] That being said – cyber threats are still a big factor. So ensure you have tools, training and measures in place to reduce cyber attacks and breaches.
[06:30] Types of Threat intelligence, including: Cyber, Strategic and Tactical
[07:58] What threat intelligence actually does – Firstly ensure that you are collecting relevant data. That data can be analysed and used to reduce risk, to help you be proactive instead of reactive to threats.
[09:51] Threat intelligence is very appliable to Business Continuity (ISO 22301)
[10:35] The different types of tools you could consider, including: Security information and event management (SIEM) and CSOC – Cyber Security Operation Centres
[12:30] Types of threat intelligence activities you can do. This includes: Establishing objectives, collection of information from selected sources, analysing information to understand how it relates and is meaningful to the business and communicating information to relevant individuals.
[15:10] Ensure your threat intelligence is dynamic – and use it to inform and update your Risk Assessments at regular intervals
[16:30] Threat intelligence works with the Plan-Do-Act-Check cycle that is commonly seen in most ISO’s
[17:10] Threat intelligence can be used by any business regardless of any ISO certification you may or may not have.
[18:05] Keep an eye out for our ISO 27001:2022 migration support offering!
Download our ISO 27002 changes Quick Guide here:
Just a reminder, we’re offering 6 months free access to the isologyhub for anyone who signs up to an ISO Support Plan!
We’d love to hear your views and comments about the ISO Show, here’s how:
- Share the ISO Show on Twitter or Linkedin
- Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.
Subscribe to keep up-to-date with our latest episodes:
Stitcher | Spotify | YouTube |iTunes | Soundcloud
ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely news ones were added to keep up with new and emerging technology.
One of the new controls added under the technological category, is something called Data Masking. But what does this mean exactly?
Steve Mason joins us again today to delve deeper into data masking to explain what it is, why it’s so important and details a few of the different types of data masking
You’ll learn
- What is data masking?
- Why is data masking important?
- How does data masking work?
- What are the different types of data masking?
Resources
In this episode, we talk about:
[01:33] The purpose of data masking according to ISO 27002 – Now more clearly defined when compared to earlier versions
[02:55] A brief overview of PII (Personally Identifiable Information)
[03:52] A summary of the defined attributes of data masking
[05:25] What is data masking? Including definitions for obfuscation, data anonymization and pseudonymisation
[08:50] The benefits of having a more clearly defined control for protecting PII
[09:35] Other standards where data masking is applicable – ISO 27017, ISO 27018 and ISO 27701
[11:27] Why data masking is so important currently
[12:40] How data masking works in practice
[13:10] Static data masking – data is masked in an original database then duplicated into a test environment
[13:34] Dynamic data masking – The original sensitive data remains in the repository. Data is never exposed to unauthorised users, contents are shuffled in real-time on-demand to make the contents masked
[14:50] On the fly data masking – Masking data while it is transferred from production systems to test or development systems before the data is saved to disk.
[15:55] Techniques for data masking include – Substitution – Businesses substitute the original data with random data from supplied or customised lookup file.
[16:15] Shuffling – Businesses substitute original data with another authentic-looking data but they shuffle the entities in the same column randomly.
[17:09] Number and date variances – For financial and date-driven data sets, applying the same variance to create a new dataset doesn’t change the accuracy of the dataset while masking data.
[17:56] Encryption is still the number one method for data masking
[18:40] Character scrambling – This method involves randomly rearranging the order of characters. This process is irreversible so that the original data cannot be obtained from the scrambled data.
[19:50] Other forms of data to take into consideration – Protected health information, Payment card information, Intellectual property and Company specific Information
[23:02] How GDPR promotes data masking
Download our ISO 27002 changes Quick Guide here:
Just a reminder, we’re offering 6 months free access to the isologyhub for anyone who signs up to an ISO Support Plan!
We’d love to hear your views and comments about the ISO Show, here’s how:
- Share the ISO Show on Twitter or Linkedin
- Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.
Subscribe to keep up-to-date with our latest episodes:
Stitcher | Spotify | YouTube |iTunes | Soundcloud
ISO 27002 was recently updated this year – along with a reduction of overall controls, 11 completely new ones were added to keep up with new and emerging technology.
As a reminder, ISO 27002 (Information security, cybersecurity and privacy protection — Information security controls) is a guidance document which provides further best practice advice to strengthen your IT Security.
Today, Steve Mason explains the changes made to the 2022 version of ISO 27002, gives a summary of the 11 new controls and gives examples of some key considerations and actions you can take to implement them.
You’ll learn
- What changes have been made to ISO 27002:2022
- Why ISO 27002 has been updated in 2022
- An overview of the 11 new controls added to ISO 27002
- Examples of actions you can take to implement the new controls
Resources
In this episode, we talk about:
[01:28] A brief summary of the changes to ISO 27002:2022, including new controls, new structure and attribute types
[05:30] Controls in ISO 27002 now have a defined purpose to avoid misinterpretation
[06:29] A summary of the 11 new controls by name and category
[08:10] Threat intelligence – What tools do you have in place to identify threats? How do you monitor your threat intelligence effectiveness?
[11:20] Information Security use of Cloud Services – A reminder that ISO 27017 covers this in more detail! Do you have a cloud policy in place? Does it align with your clients security requirements?
[13:10] ICT readiness for Business Continuity – Focus on recovery of IT services following a disaster. Do you have Business Impact Assessments in place? If you’re certified to ISO 22301 – this area is most likely covered
[14:36] Physical Security monitoring – Are you monitoring physical security? i.e. keycard access, CCTV ect
[16:23] Configuration Management – Are you IT systems working well together? Do you have an established configuration for passwords? (i.e. how many characters, alpha numerical, symbols ect)
[18:13] Information Deletion – If data needs to be deleted, that it’s deleted in a secure manor and can’t be recovered.
[21:48] Data Masking – Make sure that any data that shouldn’t be shared is masked in some way i.e. obfuscated or anonymized.
[23:31] Data Leakage – Put measures in place to stop data being leaked through i.e. USB’s, people sending business information to personal email addresses ect
[26:55] Monitoring Activities – You could monitor network traffic, software access ect. Be selective in your monitoring, only do so if it will be of benefit to the business.
[28:04] Web Filtering – Ensure that employees can’t access any nefarious / high risk websites that could cause a security breach
[30:15] Secure Coding – Make sure that coding is done securely – making sure that any software developed is secure and free of as many vulnerabilities as possible.
Download our ISO 27002 changes Quick Guide here:
Just a reminder, we’re offering 6 months free access to the isologyhub for anyone who signs up to an ISO Support Plan!
We’d love to hear your views and comments about the ISO Show, here’s how:
- Share the ISO Show on Twitter or Linkedin
- Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.
Subscribe to keep up-to-date with our latest episodes:
Stitcher | Spotify | YouTube |iTunes | Soundcloud
Did you know there were 80 identified security incidents, resulting in 34,908,053 compromised records in June 2022 alone!
Standards such as ISO 27001 can help you put measures in place to reduce risk and help set up procedures for data recovery. However, not as many adopt the guidance document ISO 27002 which provides further best practice advice to strengthen your IT Security.
ISO 27002 has recently been updated with 11 new controls that tackle recent emerging technology not covered in ISO 27001:2013.
Today, Mel explains ISO 27002 (Information security, cybersecurity and privacy protection – Information security controls), why it’s been updated and gives a high-level overview of the changes.
You’ll learn
- The purpose of ISO 27002
- How ISO 27002 works with ISO 27001
- Why ISO 27002 has been updated in 2022
- A basic overview of the changes to controls within ISO 27002:2022
Resources
In this episode, we talk about:
[00:30] A reminder to keep an eye out for future episodes on the upcoming updated version of ISO 27001:2022
[00:52] An introduction to the guidance document ISO 27002
[02:02] Controls from the updated version of ISO 27002 can be implemented right now – not a requirement of ISO 27001 but recommended.
[02:25] Why ISO 27002 has been updated – To bring it up-to-date with the latest technologies and simplification of controls
[03:15] What this means for your Information Security Management System
[03:50] We expect to see the new controls in ISO 27002 to be reflected in the updated version of ISO 27001 coming out later this year.
[4:27] Reminder: ISO 27002 is not a certifiable standard but it is best practice.
[05:00] ISO 27002 had its last major update in 2013 – think how much technology has changed since then!
[06:00] A summary of the changes to controls in ISO 27002
[07:25] New controls added to ISO 27002 highlight that the standard is more then just IT Security – A trait shared with ISO 27001
[09:13] A summary of what categories the 11 new controls fall under
Just a reminder, we’re offering 6 months free access to the isologyhub for anyone who signs up to an ISO Support Plan!
We’d love to hear your views and comments about the ISO Show, here’s how:
- Share the ISO Show on Twitter or Linkedin
- Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.
Subscribe to keep up-to-date with our latest episodes:
Stitcher | Spotify | YouTube | iTunes | Soundcloud
Download our ISO 27002 changes Quick Guide here:
Our 7 Steps to Success
The Blackmores ISO Roadmap is a proven path to go from idea to launching your ISO Management System.
Whether you choose to work with one of our ISO Consultants, our isologists, or work your own way through the process on our isology Hub, we’re certain you’ll achieve certification in no time!
What our clients have to say
Trusted by leading organisations across all sectors, we support companies of all sizes in any location.
Listen to our Podcast
Welcome to the ISO Show podcast, dispelling myths and sharing tips for success to improve your business with ISO Standards. Join us to hear interviews with successful business leaders as they share their ISO journey with you.
Get top tips via audio master classes “ISO Steps to Success” on the most popular ISO Standards.