In this ultimate how to implement guide to ISO 27001 Annex A 8.21 Security of Network Services, you will learn directly from an ISO 27001 Lead Auditor:
Table of contents
- 1. Define Security Requirements in Service Agreements
- 2. Enforce Strong Encryption for Transit Data
- 3. Implement 802.1x Network Access Control (NAC)
- 4. Segregate Network Service Functions
- 5. Configure Secure DNS Services
- 6. Mandate NTP Stratum Synchronisation
- 7. Establish Perimeter Intrusion Prevention (IPS)
- 8. Monitor Network Traffic Metadata (NetFlow/IPFIX)
- 9. Secure Remote Management Channels
- 10. Verify Third-Party MPLS/SD-WAN Security
1. Define Security Requirements in Service Agreements
Control Requirement: Security mechanisms, service levels, and management requirements of all network services must be identified and included in network services agreements.
Required Implementation Step: Audit your current ISP and WAN contracts. Negotiate specific security schedules that mandate DDoS mitigation thresholds (e.g., “Mitigation triggers at 1Gbps attack volume”) and guaranteed response times for security incidents, not just connectivity outages.
Minimum Requirement: Signed contracts explicitly listing security responsibilities (e.g., who patches the edge router?).
2. Enforce Strong Encryption for Transit Data
Control Requirement: Mechanisms must be in place to protect data traversing public or untrusted networks.
Required Implementation Step: Configure your VPN concentrators and web servers to reject obsolete cipher suites. Specifically, disable TLS 1.0/1.1 and SSL 3.0 on your load balancers. Enforce TLS 1.3 for all web-facing services and use IPsec with AES-256 for site-to-site tunnels.
Minimum Requirement: A “Grade A” rating on SSLLabs or similar verification for all external endpoints.
3. Implement 802.1x Network Access Control (NAC)
Control Requirement: Access to network services must be authenticated.
Required Implementation Step: Deploy a RADIUS server (e.g., Microsoft NPS or FreeRADIUS) and configure your switches and wireless access points to enforce 802.1x authentication. Ensure that no device can obtain an IP address or talk to the network simply by plugging into a wall socket without a valid machine certificate.
Minimum Requirement: Physical ports in reception or meeting rooms immediately reject unauthenticated devices.
4. Segregate Network Service Functions
Control Requirement: Different network services should be separated to prevent cascading failures or breaches.
Required Implementation Step: Configure VLANs (Virtual Local Area Networks) and VRFs (Virtual Routing and Forwarding) to isolate Voice (VoIP), Storage (iSCSI), and User Data traffic. Ensure that a DDoS attack on the public website IP range cannot flood the internal management network bandwidth.
Minimum Requirement: VoIP phones and Surveillance Cameras must reside on isolated, non-routable VLANs.
5. Configure Secure DNS Services
Control Requirement: Network naming services must be secure and resilient.
Required Implementation Step: Configure your internal DNS servers to use DNSSEC validation to prevent cache poisoning attacks. On endpoints, enforce the use of secure, filtered DNS resolvers (like Quad9 or Cisco Umbrella) via DHCP options to block resolution of known command-and-control domains.
Minimum Requirement: Prevention of users resolving known malicious domains at the network layer.
6. Mandate NTP Stratum Synchronisation
Control Requirement: Accurate time is essential for correlating network security events.
Required Implementation Step: Configure your core switch or firewall as the internal Stratum 1 NTP source, syncing from at least three distinct external geographic sources (e.g., `time.google.com`, `pool.ntp.org`). Force all internal servers and appliances to sync only from this internal source to ensure log timestamps align perfectly during forensics.
Minimum Requirement: All network device logs match to the millisecond to allow for incident reconstruction.
7. Establish Perimeter Intrusion Prevention (IPS)
Control Requirement: The network service must inspect traffic for malicious content.
Required Implementation Step: Enable the IPS (Intrusion Prevention System) module on your perimeter firewalls. Configure it to “Drop” mode for critical severity signatures (e.g., Exploit Kits, SQL Injection patterns) rather than just “Alert”. Regular tuning is required to minimise false positives.
Minimum Requirement: Automated blocking of known exploit traffic at the network edge.
8. Monitor Network Traffic Metadata (NetFlow/IPFIX)
Control Requirement: Network usage must be monitored to detect anomalies.
Required Implementation Step: Enable NetFlow or IPFIX export on all core routing equipment. Send these flows to a collector (e.g., ELK Stack, PRTG, or Darktrace). Set alerts for “Top Talkers” and unusual protocol usage (e.g., a printer sending 5GB of data to an external IP on port 443).
Minimum Requirement: Ability to identify exactly which internal IP consumed bandwidth at any specific past time.
9. Secure Remote Management Channels
Control Requirement: Management of network equipment must be performed securely.
Required Implementation Step: Disable Telnet and HTTP on all routers and switches. Enable SSHv2 and HTTPS only. Create a standard Access Control List (ACL) applied to the “VTY” lines that restricts management connections solely to the IP addresses of the IT Admin subnet or Jump Box.
Minimum Requirement: Management interfaces are invisible to standard users and the public internet.
10. Verify Third-Party MPLS/SD-WAN Security
Control Requirement: Managed network services must maintain the organisation’s security posture.
Required Implementation Step: Request the “SOC 2 Type II” or ISO 27001 certificate from your WAN provider. Specifically, verify that their routing equipment (CPE) located in your server room is physically tamper-sealed and that they have a process for immediate patching of vulnerabilities in their router firmware.
Minimum Requirement: Evidence that the provider manages the physical and logical security of the equipment they install on your site.
About the author
