ISO 27001 Annex A 8.5 Secure Authentication

Home / ISO 27001 Annex A Controls / ISO 27001 Annex A 8.5 Secure Authentication

ISO 27001 Secure Authentication

I am going to show you what ISO 27001 Annex A 8.5 Secure Authentication is, what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it.

I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.

What is ISO 27001 Annex A 8.5?

ISO 27001 Annex A 8.5 Secure Authentication is an ISO 27001 control that looks to make sure you have controls in place to ensure people who are access information are who they say they are.

Purpose

The purpose of ISO 27001 Annex A 8.5 Secure Authentication is to ensure a user or an entity is securely authenticated, when access to systems, applications and services is granted.

Definition

The ISO 27001 standard defines ISO 27001 Annex A 8.3 as:

Secure authentication technologies and procedures should be implemented based on information access restrictions and the topic-specific policy on access control.

ISO 27001:2022 Annex A 8.5 Secure Authentication

Implementation Guide

Authentication is about someone proving who they say they are. Our ability to be sure that the person requesting access is the actual person.

the act or process of establishing identity and verifying permission to access an electronic device or computer network (often used attributively):
password authentication;
biometric authentication;
authentication credentials.

Dictionary.Com

So we are going to work out who needs access to what, put in place our access restrictions and then provide them with a means to let us know they are who they say they are so we can grant them the access.

The way we prove it is based on there concepts. You prove who you are by either

  • Something you know
  • Something you have
  • Something you are

Something you know

This is the most common type of authentication and the easiest to implement. The main example of this is the use of the password or passphrase. People need to know the password to be able to gain access. The downside to this is that passwords are easy to get or guess and easy for people to lose, share or write down.

Something you have

You will have seen this in the way that banks issue you with key pad devices. They may be physical or virtual but you need to device to be able to access the random fast changing code. This is a strong form of authentication and often used with something you know, ie a password.

Something you are

Something you are relies on a specific characteristic that is unique to you. This could be your finger print or a scan of your eye ball. This type of authentication is called bio metric and is the most secure yet the most costly and complicated to implement. Think about the Apple touch authentication that uses you finger print or your iPhone that can unlock by scanning your face.

Multi-factor authentication

Multi-factor authentication is the most secure method where a combination of two or more authentication methods are used.

Authentication Based on Risk

You are going to implement your information classification scheme, do your risk assessment and work out the level of authentication that is appropriate to you based on that. Usually the most stringent form of authentication is applied to the highest level classification of data.

Authentication Process

There is general guidance that applies to the authentication processes. Things that are worth considering.

A no brainer is we don’t allow access to information until authentication completes.

We put in place measures to prevent brute force attacks and to report on unsuccesful logon attempts. We set thresholds that would trigger alerts and notifications and raise information security events that we manage when those thresholds are breached.

If we rely on passwords we do not show them as clear text when being entered and we do not transmit them or store them in clear text.

We also consider auto logging out after a set time of inactivity.

Policy

Your starting point for this control is to implement a topic specific policy on access control and include in that policy your approach to access. The ISO 27001 Access Control Policy Template is already written for you and ready to go and includes a great free Access Control Policy Example PDF. There is a lot more information on the Access Control Policy including how to write your own is covered in ISO 27001 Access Control Policy Ultimate Guide.

Relevant Annex A controls here include:

ISO 27001 Access Rights – Annex A 5.18

ISO 27001 Access Control – Annex A 5.15

ISO 27001 Annex A Control 8.1 User Endpoint Devices

ISO 27001 Privilege Access – Annex A 8.2

ISO 27001 Annex A 8.3 Information Access Restriction

The control is not particularly hard. It is mainly common sense.

ISO 27001 Templates

ISO 27001 templates have the advantage of being a massive boost that can save time and money so before we get into the implementation guide we consider these pre written templates that will sky rocket your implementation. This ISO 27001 Toolkit has been specifically designed so you can DIY your ISO 27001 certification, build your ISMS in a week and be ISO 27001 certification ready in 30 days.

ISO 27001 Toolkit

How to pass an audit

Time needed: 1 day, 2 hours and 15 minutes

How to comply with ISO 27001 Annex A 8.5

  1. Have policies and procedures in place

    Write, approve, implement and communicate the documentation required for secure authentication.

  2. Assess your access requirements and perform a risk assessment

    Have an asset management process that includes an asset register. For each asset type perform a risk assessment.

  3. Implement controls proportionate to the risk posed

    Based on the risk assessment implement the appropriate access controls to mitigate the risk

  4. Keep records

    For audit purposes you will keep records. Examples of the records to keep include changes, updates, monitoring, review and audits.

  5. Test the controls that you have to make sure they are working

    Perform internal audits that include the testing of the controls to ensure that they are working.

Top 3 Mistakes People Make

The top 3 mistakes people make for ISO 27001 Annex A 8.5 are

1. Password management is flaky

This usual things here that go wrong are when people always use the same default passwords for users. They set it and then the user doesn’t change it. Ideally set a new ‘starting’ password for each users. We see these then being shared over email or text in clear text. If you simply must do this then consider sending user names and passwords over different channels. If email gets compromised having the user name and passwords in emails means people have an easy hop then to breach your other systems.

2. Authentication is weak

Having weak authentication, like little to no requirements on the type of password people use, means life is easy for everyone but these are also easy to compromise, breach, hack, guess. There has to be a balance. Having no passwords or easy default passwords that never expire is one approach but try to find a middle ground. If you are not NASA then bio metrics maybe overkill, I get it. Be sure to have something.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27001 Controls and Attribute Values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
PreventiveConfidentialityProtectIdentity and access managementProtection
Integrity
Availability
ISO 27001 Toolkit Business Edition
Do it Yourself ISO 27001 with LIVE EXPERT SUPPORT

ISO 27001:2022 requirements

ISO 27001:2022 Annex A 5 - Organisational Controls

ISO 27001 Annex A 5.1 Policies for information security

ISO 27001 Annex A 5.2 Information Security Roles and Responsibilities

ISO 27001 Annex A 5.3 Segregation of duties

ISO 27001 Annex A 5.4 Management responsibilities

ISO 27001 Annex A 5.5 Contact with authorities

ISO 27001 Annex A 5.6 Contact with special interest groups

ISO 27001 Annex A 5.7 Threat intelligence – new

ISO 27001 Annex A 5.8 Information security in project management

ISO 27001 Annex A 5.9 Inventory of information and other associated assets – change

ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets – change

ISO 27001 Annex A 5.11 Return of assets

ISO 27001 Annex A 5.11 Return of assets

ISO 27001 Annex A 5.13 Labelling of information

ISO 27001 Annex A 5.14 Information transfer

ISO 27001 Annex A 5.15 Access control

ISO 27001 Annex A 5.16 Identity management

ISO 27001 Annex A 5.17 Authentication information – new

ISO 27001 Annex A 5.18 Access rights – change

ISO 27001 Annex A 5.19 Information security in supplier relationships

ISO 27001 Annex A 5.20 Addressing information security within supplier agreements

ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain – new

ISO 27001 Annex A 5.22 Monitoring, review and change management of supplier services – change

ISO 27001 Annex A 5.23 Information security for use of cloud services – new

ISO 27001 Annex A 5.24 Information security incident management planning and preparation – change

ISO 27001 Annex A 5.25 Assessment and decision on information security events 

ISO 27001 Annex A 5.26 Response to information security incidents

ISO 27001 Annex A 5.27 Learning from information security incidents

ISO 27001 Annex A 5.28 Collection of evidence

ISO 27001 Annex A 5.29 Information security during disruption – change

ISO 27001 Annex A 5.31 Identification of legal, statutory, regulatory and contractual requirements

ISO 27001 Annex A 5.32 Intellectual property rights

ISO 27001 Annex A 5.33 Protection of records

ISO 27001 Annex A 5.34 Privacy and protection of PII

ISO 27001 Annex A 5.35 Independent review of information security

ISO 27001 Annex A 5.36 Compliance with policies and standards for information security

ISO 27001 Annex A 5.37 Documented operating procedures 

ISO 27001:2022 Annex A 8 - Technology Controls

ISO 27001 Annex A 8.1 User Endpoint Devices

ISO 27001 Annex A 8.2 Privileged Access Rights

ISO 27001 Annex A 8.3 Information Access Restriction

ISO 27001 Annex A 8.4 Access To Source Code

ISO 27001 Annex A 8.5 Secure Authentication

ISO 27001 Annex A 8.6 Capacity Management

ISO 27001 Annex A 8.7 Protection Against Malware

ISO 27001 Annex A 8.8 Management of Technical Vulnerabilities

ISO 27001 Annex A 8.9 Configuration Management 

ISO 27001 Annex A 8.10 Information Deletion

ISO 27001 Annex A 8.11 Data Masking

ISO 27001 Annex A 8.12 Data Leakage Prevention

ISO 27001 Annex A 8.13 Information Backup

ISO 27001 Annex A 8.14 Redundancy of Information Processing Facilities

ISO 27001 Annex A 8.15 Logging

ISO 27001 Annex A 8.16 Monitoring Activities

ISO 27001 Annex A 8.17 Clock Synchronisation

ISO 27001 Annex A 8.18 Use of Privileged Utility Programs

ISO 27001 Annex A 8.19 Installation of Software on Operational Systems

ISO 27001 Annex A 8.20 Network Security

ISO 27001 Annex A 8.21 Security of Network Services

ISO 27001 Annex A 8.22 Segregation of Networks

ISO 27001 Annex A 8.23 Web Filtering

ISO 27001 Annex A 8.24 Use of CryptographyISO27001 Annex A 8.25 Secure Development Life Cycle

ISO 27001 Annex A 8.26 Application Security Requirements

ISO 27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles

ISO 27001 Annex A 8.28 Secure Coding

ISO 27001 Annex A 8.29 Security Testing in Development and Acceptance

ISO 27001 Annex A 8.30 Outsourced Development

ISO 27001 Annex A 8.31 Separation of Development, Test and Production Environments

ISO 27001 Annex A 8.32 Change Management

ISO 27001 Annex A 8.33 Test Information

ISO 27001 Annex A 8.34 Protection of information systems during audit testing