Table of contents
- ISO 27002 Secure Systems Architecture and Engineering Principles
- What is ISO 27002:2022 Control 8.27?
- Definition of ISO 27002 Control 8.27
- Purpose of ISO 27002 Control 8.27
- Ownership of ISO 27002 Control 8.27
- Compliance Guidance
- Supplementary Guidance on ISO 27002 Control 8.27
- Changes and Differences to ISO 27002:2013
- ISO 27002 Control 8.27 FAQ
- ISO 27002 Control 8.27 Attributes Table
ISO 27002 Secure Systems Architecture and Engineering Principles
Secure Systems Architecture and Engineering Principles mandates the implementation of secure system architecture and engineering principles. This involves designing security into all layers of the system throughout the development lifecycle. Furthermore, it emphasises “security by design and default.”
What is ISO 27002:2022 Control 8.27?
ISO 27002 Control 8.27 Secure Systems Architecture and Engineering Principles provides implementation guidance on how to implement ISO 27001 Annex A 8.27.
Definition of ISO 27002 Control 8.27
ISO 27002 defines ISO 27002 Control 8.27 as – Secure system engineering principles must be established, documented, maintained, and consistently applied throughout all information system development activities.
Purpose of ISO 27002 Control 8.27
This is a preventive control designed to ensure information systems are designed, implemented, and operated securely throughout their lifecycle.
Ownership of ISO 27002 Control 8.27
The Chief Information Security Officer (CISO) is responsible for establishing, maintaining, and implementing the principles that govern the secure engineering of information systems, in collaboration with the development team.
Compliance Guidance
Secure System Engineering Principles
Foundation
Establish, document, and apply robust security engineering principles throughout all stages of information system development.
Integrate security considerations into all architectural layers (business, data, applications, and technology).
Analyse new technologies for security risks and review designs against known attack patterns.
Core Principles
Guide user authentication, secure session management, data validation, and sanitisation.
Analyse
- The full range of security controls needed to protect information and systems.
- The capabilities of security controls to prevent, detect, and respond to security events.
- Specific security controls required by business processes (e.g., encryption, integrity checks, digital signatures).
- How security controls are integrated within the security architecture and technical infrastructure.
- The interplay of individual security controls (manual and automated).
Key Considerations
- Integrate with a defined security architecture.
- Consider relevant security infrastructure (e.g., PKI, IAM, DLP, dynamic access management).
- Evaluate the organisation’s capability to develop and support chosen technologies.
- Assess the cost, time, and complexity of implementing security requirements.
- Adhere to current best practices.
Core Engineering Practices
- Apply security architecture principles: “security by design,” “defence in depth,” “security by default,” “default deny,” “fail securely,” “distrust external inputs,” “security in deployment,” “assume breach,” “least privilege,” “usability and manageability,” and “least functionality.”
- Conduct thorough security-oriented design reviews to identify vulnerabilities and ensure security control effectiveness.
- Document and address any exceptions to security requirements.
- Implement system hardening measures.
Zero Trust Principles
- Assume that the organisation’s systems are already compromised.
- Employ a “never trust, always verify” approach to all access requests.
- Encrypt all data in transit and at rest.
- Verify all requests as if they originate from an untrusted source, regardless of internal or external origin.
- Implement least privilege and dynamic access control based on context (user identity, device, data classification).
- Enforce strong authentication (e.g., multi-factor authentication).
Outsourcing Considerations
- Incorporate security engineering principles into contracts with third-party suppliers.
- Ensure that suppliers’ security practices align with the organisation’s requirements.
Continuous Improvement:
- Regularly review and update security engineering principles to address emerging threats and technologies.
Supplementary Guidance on ISO 27002 Control 8.27
Secure Engineering Principles can be applied to various techniques, including:
- Fault Tolerance and Resilience: Implementing mechanisms to ensure system availability and data integrity in the face of failures or disruptions.
- Segregation: Employing techniques like virtualisation or containerisation to isolate applications and prevent interference between them.
- Tamper Resistance: Implementing measures to detect and prevent unauthorised modifications to data or systems.
Virtualisation for Enhanced Security
Virtualisation can enhance security by isolating applications within separate virtual environments. If one application is compromised, the impact on other applications and data is minimised.
Tamper Resistance Techniques
Tamper resistance techniques can detect and record attempts to modify data or systems. These techniques can be applied to both physical and logical containers.
Changes and Differences to ISO 27002:2013
ISO 27002:2022/8.27 represents a significant enhancement over its predecessor, 27002:2013/(14.2.5).
Key differences include:
Expanded Guidance:
2022 provides more comprehensive guidance on the scope and content of secure engineering principles.
It outlines specific criteria to consider when designing these principles.
Introduction of Zero Trust:
The 2022 version incorporates the crucial concept of “zero trust,” which was not addressed in the 2013 version.
Emphasis on Secure Engineering Techniques:
2022 explicitly recommends the application of secure engineering techniques, such as “security by design,” which were not explicitly mentioned in the previous version.
These enhancements in ISO 27002:2022/8.27 reflect the evolving security landscape and emphasise the importance of a proactive and comprehensive approach to secure system development.
ISO 27002 Control 8.27 FAQ
ISO 27001 Annex A 8.27 is the information security control requirement of the ISO 27001 standard for ISO 27001 certification. ISO 27002 Control 8.27 is the implementation guidance for the control.
Yes, Secure Systems Architecture and Engineering Principles s a required information security control for ISO 27001 certification, if you develop systems.
ISO 27002 Control 8.27 Attributes Table
Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
---|---|---|---|---|
Preventive | Confidentiality | Protect | Application Security | Protection |
Integrity | System and Network Security | |||
Availability |