Skip to main content
All measures

Measure · ISO 27001

Operate network connections securely

Define required connections, security boundaries and service requirements, implement them and check the operating network.

Accountable: Network owners with IT operations and relevant service providersReviewed

Reuse existing records

Reuse the network diagram, device configurations and provider agreements. Operations and access rules remain authoritative; a second network handbook is unnecessary.

What to do

  1. 1

    Connect inventory, zones and requirements

    Keep devices, services, ownership, responsibilities and connections current in the existing network diagram. Define protection needs and groups by trust, information and purpose, such as administration, endpoints, servers, guests or production. Include wireless, external and virtual networks. Define necessary interconnections and security, performance and availability requirements for network services.

  2. 2

    Implement secure boundaries and services

    Use appropriate physical or logical separation and restricted transitions. Harden devices, protect administration paths, authenticate and authorise required connections and disable unsuitable protocols. Protect traffic across external, public and wireless networks according to need. Agree security mechanisms, service levels, responsibilities and audit rights with providers and actually implement the parameters.

  3. 3

    Control web access and exceptions

    Apply the authoritative safe web-use rules. Configure suitable filters against malicious or prohibited destinations and unauthorised uploads; examine applicable rights before monitoring. Keep lists current and explain warnings, reporting and justified business exceptions. Existing browser, DNS or security features may be suitable; universal TLS interception is not a prerequisite.

  4. 4

    Check effectiveness and changes

    Test permitted and blocked paths from appropriate zones, including guest and administration access. Check a harmless filtering test and detection of relevant network events. Use service reports and measurements to assess security capability and agreed quality. Address differences and maintain rules, exceptions and diagrams in existing change or supplier records.

Worked example

An operational example

Fictional example: Guests may reach the internet but not internal servers or administration interfaces.

Check the boundary
DecisionOperations tests an allowed internet connection and blocked internal destinations from the guest network. A necessary exception is assessed and approved specifically.
EvidenceCurrent transition rule, test result and any justified exception in the existing network record.

Record the result

  • Current network diagram with boundaries, required connections and agreed service requirements.
  • Implemented safeguards and checked permitted and blocked paths.

Common implementation mistakes

Treating VLAN names as separation

Check routing, gateways and alternative paths. A logical name alone does not prevent access.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.8.20 · NetzwerksicherheitGerman guide

    Inventory, ownership, hardened network components, controlled connections and operational checks protect networks.

  • A.8.21 · Sicherheit von NetzwerkdienstenGerman guide

    Required security mechanisms, service levels and network service responsibilities are agreed, implemented and monitored.

  • A.8.22 · Trennung von NetzwerkenGerman guide

    Reasoned security boundaries and permitted transitions are enforced and checked with positive and negative connection tests.

  • A.8.23 · WebfilterungGerman guide

    Rules, suitable current filters, safe use and justified exceptions control access to external websites.

Templates for your implementation

Sources and further reading