ISO 27001 Secure Systems Architecture Explained with examples and ISO 27001 templates. Everything you need to know.
Table of contents
ISO 27001 Secure Systems Architecture and Engineering Principles
ISO 27001 Secure Systems Architecture and Engineering Principles mandates the implementation of secure system architecture and engineering principles. This involves designing security into all layers of the system throughout the development lifecycle. Furthermore, it emphasises “security by design and default.”
This is a preventive control designed to ensure information systems are designed, implemented, and operated securely throughout their lifecycle.
Who owns it?
The Chief Information Security Officer (CISO) is responsible for establishing, maintaining, and implementing the principles that govern the secure engineering of information systems, in collaboration with the development team.
Compliance Guidance
The following is compliance guidance for Secure Systems Architecture and Engineering Principles.
1. Foundation
Establish, document, and apply robust security engineering principles throughout all stages of information system development.
Integrate security considerations into all architectural layers (business, data, applications, and technology).
Analyse new technologies for security risks and review designs against known attack patterns.
2. Core Principles
Guide user authentication, secure session management, data validation, and sanitisation.
3. Analyse
- The full range of security controls needed to protect information and systems.
- The capabilities of security controls to prevent, detect, and respond to security events.
- Specific security controls required by business processes (e.g., encryption, integrity checks, digital signatures).
- How security controls are integrated within the security architecture and technical infrastructure.
- The interplay of individual security controls (manual and automated).
4. Key Considerations
- Integrate with a defined security architecture.
- Consider relevant security infrastructure (e.g., PKI, IAM, DLP, dynamic access management).
- Evaluate the organisation’s capability to develop and support chosen technologies.
- Assess the cost, time, and complexity of implementing security requirements.
- Adhere to current best practices.
5. Core Engineering Practices
- Apply security architecture principles: “security by design,” “defence in depth,” “security by default,” “default deny,” “fail securely,” “distrust external inputs,” “security in deployment,” “assume breach,” “least privilege,” “usability and manageability,” and “least functionality.”
- Conduct thorough security-oriented design reviews to identify vulnerabilities and ensure security control effectiveness.
- Document and address any exceptions to security requirements.
- Implement system hardening measures.
6. Zero Trust Principles
- Assume that the organisation’s systems are already compromised.
- Employ a “never trust, always verify” approach to all access requests.
- Encrypt all data in transit and at rest.
- Verify all requests as if they originate from an untrusted source, regardless of internal or external origin.
- Implement least privilege and dynamic access control based on context (user identity, device, data classification).
- Enforce strong authentication (e.g., multi-factor authentication).
7. Outsourcing Considerations
- Incorporate security engineering principles into contracts with third-party suppliers.
- Ensure that suppliers’ security practices align with the organisation’s requirements.
8. Continuous Improvement:
- Regularly review and update security engineering principles to address emerging threats and technologies.
Supplementary Guidance
Secure Engineering Principles can be applied to various techniques, including:
- Fault Tolerance and Resilience: Implementing mechanisms to ensure system availability and data integrity in the face of failures or disruptions.
- Segregation: Employing techniques like virtualisation or containerisation to isolate applications and prevent interference between them.
- Tamper Resistance: Implementing measures to detect and prevent unauthorised modifications to data or systems.
1. Virtualisation for Enhanced Security
Virtualisation can enhance security by isolating applications within separate virtual environments. If one application is compromised, the impact on other applications and data is minimised.
2. Tamper Resistance Techniques
Tamper resistance techniques can detect and record attempts to modify data or systems. These techniques can be applied to both physical and logical containers.
ISO 27001 Secure Development Policy Template
The following is a fully ISO 27001 compliant ISO 27001 Secure Development Policy Template.
Further Reading
ISO 27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles specifically addresses the requirements of Secure Systems Architecture and Engineering Principles.
