Organizations face multiple cybersecurity challenges, such as ongoing cyberattacks and security breaches that compromise the integrity, confidentiality, and availability of their digital assets. Therefore, it is crucial for organizations to adopt a proactive and vigilant attitude to ensure the continuity and security of their operations in cyberspace. This is where the standard ISO 27032:2023 Cybersecurity – Guidelines for Internet security comes into play, and its update will be addressed in this article.
Cybersecurity Challenges: a Guide for Digital Security
In the current context, where digital security is a fundamental priority, the standard ISO 27032:2023 Cybersecurity – Guidelines for Internet security stands out as a guide to address challenges in this field. This standard focuses on the relationship between Internet security, web security, network security, and cybersecurity in general.
What is the ISO 27032:2023 Standard?
The new version of this standard, successor to the last update made 12 years ago, expands on terms and principles related to cybersecurity and Internet security. From defining roles and responsibilities to risk management and response to cyber incidents. The standard highlights the importance of collaboration between all involved parties. Additionally, it emphasizes the need to align security practices with the latest trends and emerging technologies, such as artificial intelligence (AI) and the Internet of Things (IoT).
The standard promotes the adoption and implementation of advanced technologies, security tools, and effective policies, all supported by a proactive approach to staff training and awareness. Together, these measures and controls help organizations strengthen their defenses and be better prepared to protect their digital assets.
Focus Areas of the ISO 27032:2023 Standard
- Internet Security Issues:
• Addresses social engineering attacks.
• Mitigation of zero-day attacks.
• Protection against privacy violations.
• Combating hacking and malware proliferation. - Controls:
• Preparation for attacks.
• Attack prevention.
• Attack detection and monitoring.
• Response to attacks. - Best Practices:
• Implement Internet security best practices to improve resilience and effectiveness within organizations.
Mapping between Internet Security Controls
The standard has been restructured to improve its comprehension, including a mapping between the controls of ISO 27032:2023 and ISO/IEC 27002:2022 which is presented in the following table:
| ISO/IEC 27032:2023 | ISO/IEC 27002:2022 |
|---|---|
| 9.2.2 Internet security policies | 5.1 Policies for information security 5.4 Management responsibilities |
| 9.2.3 Access control | 5.15 Access control 5.16 Identity management 5.18 Access rights 8.2 Privileged access rights 8.18 Use of privileged utility programs |
| 9.2.4 Education, awareness and training | 6.3 Information security awareness, education and training |
| 9.2.5 Security incident management | 5.7 Threat intelligence 5.24 Information security incident management planning and preparation 5.25 Assessment and decision on information security events 5.26 Response to information security incidents 5.27 Learning from information security incidents 5.28 Collection of evidence 6.8 Information security event reporting |
| 9.2.6 Asset management | 5.9 Inventory of information and other associated assets 5.10 Acceptable use of information and other associated assets 5.11 Return of assets 5.12 Classification of information |
| 9.2.7 Supplier management | 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.21 Managing information security in the ICT supply chain 5.22 Monitoring, review and change management of supplier services 5.23 Information security for use of cloud services |
| 9.2.8 Business continuity over the Internet | 5.29 Information security during disruption 5.30 ICT readiness for business continuity 8.13 Information backup 8.14 Redundancy of information processing facilities |
| 9.2.9 Privacy protection over the Internet | 5.34 Privacy and protection of PII 8.11 Data masking |
| 9.2.10 Vulnerability management | 8.8 Management of technical vulnerabilities 8.9 Configuration management 8.19 Installation of software on operational systems |
| 9.2.11 Network management | 8.16 Monitoring activities 8.20 Networks security 8.21 Security of network services 8.22 Segregation of networks |
| 9.2.12 Protection against malware | 8.7 Protection against malware |
| 9.2.13 Change management | 8.32 Change management |
| 9.2.14 Identification of applicable legislation and compliance requirements | 5.28 Collection of evidence 5.31 Legal, statutory, regulatory and contractual requirements 5.33 Protection of records |
| 9.2.15 Use of cryptography | 8.24 Use of cryptography |
| 9.2.16 Security of Internet-facing applications | 8.23 Web filtering 8.24 Use of cryptography 8.25 Secure development life cycle 8.26 Application security requirements 8.27 Secure system architecture and engineering principles 8.28 Secure coding 8.29 Security testing in development and acceptance |
| 9.2.17 Endpoint device management | 8.1 User endpoint devices 8.9 Configuration management |
| 9.2.18 Monitoring | 8.15 Logging 8.16 Monitoring activities |
In conclusion, the ISO 27032:2023 standard plays a fundamental role in strengthening Internet security, providing clear and updated guidelines, thus becoming an invaluable tool for organizations.
