ISO 27033 Lead Manager cheat sheet

Confidentiality, integrity and availability (CIA) are the core properties; network security adds authenticity, accountability, non-repudiation and reliability as supporting properties.

Defence in depth layers controls (perimeter, segmentation, host, application, data) so that failure of one layer does not expose the asset; no single control is assumed sufficient.

Least privilege and need-to-know restrict traffic and access to the minimum required; default-deny is the operational expression of both principles.

Security domains and trust boundaries mark where the level of required protection changes; every crossing between domains needs an identified control (filter, gateway, authentication point).

Threat, vulnerability, risk and impact are distinct: threat = potential cause, vulnerability = weakness, risk = combination of likelihood and consequence, impact = harm to assets.

Separation of duties and segregation of networks prevent a single compromise or single administrator from controlling both sides of a critical transaction.

Security is a lifecycle property: plan, design, implement, operate, monitor, review, maintain and decommission; controls degrade without maintenance.

Security depends on people, process and technology; ISO/IEC 27033 treats organisational, procedural and technical controls as complementary, not substitutable.

Residual risk after controls must be explicitly accepted by accountable management; technical teams identify it, business owners accept it.

ISO/IEC 27033 is a multi-part international standard on network security; Part 1 (27033-1) gives overview and concepts, and defines the vocabulary used by the later parts.

Part 2 addresses network security architecture and design, including the security architecture design process and identification of controls; Part 3 covers reference networking scenarios and risks, threats and control issues for each.

Part 4 covers securing communication between networks using security gateways; Part 5 covers virtual private networks; Part 6 covers wireless and IP-based mobile network access; later parts address other specific technologies.

ISO/IEC 27033 sits in the ISO/IEC 27000 family as guidance supporting ISO/IEC 27001 requirements: 27001 states what an ISMS must do, 27033 explains how to do network security within it.

ISO/IEC 27002 provides the control catalogue (organisational, people, physical, technological); network-relevant clauses such as network security, segregation of networks and cryptography are elaborated in depth by 27033.

ISO/IEC 27033-1 describes the network security architecture design process: define scope and assets, identify threats and risks, derive requirements, select controls, document the architecture, verify and maintain.

27033 guidance is informative, not certifiable on its own; conformity claims are made against 27001 requirements, with 27033 used as supporting implementation guidance.

The series distinguishes the 'network security architecture' (logical, high-level, long-lived) from 'network security design' (concrete technical realisation) and from operational monitoring and management.

Mapping for exams: 27001 = requirements and audit criteria; 27002 = control objectives and practice guidance; 27033 = network-specific architecture, design and scenario guidance.

Architecture work starts with asset and data-flow identification: what data crosses which links, between which zones, with what sensitivity and required protection level.

Zoning rules: group assets with identical protection requirements into a zone; place a filtering or mediating control at every inter-zone boundary; never allow uncontrolled transitive paths between zones.

DMZ pattern: externally reachable services sit in a separate zone with no direct path to internal zones; inbound and outbound flows are filtered and logged independently.

Risk assessment builds on threat identification, vulnerability identification, likelihood, impact and existing control effectiveness; output drives control selection and residual risk acceptance.

Control selection considers technical (firewalls, IDS/IPS, VPN, segmentation, authentication), procedural and physical controls, and must consider cost versus risk reduction and operational impact.

Design must address availability and resilience (redundancy, failover, capacity) as security objectives, not only confidentiality; DoS and single points of failure are design risks.

Remote access and interconnect designs (VPN, wireless, third-party links) require explicit authentication, encryption and endpoint trust decisions, plus rules for what the remote device may reach.

Documented architecture deliverables include zone diagrams, data flows, control placement, addressing/routing rules, trust boundaries and the rationale for each selected control.

Verification: design review, threat modelling, configuration review and testing confirm that the implemented network matches the approved architecture; deviations are risk-assessed and recorded.

Operational management covers change control, configuration management, patch management, capacity management, backup and periodic review of firewall and routing rules.

Rule hygiene: every firewall rule has an owner, purpose and review date; default-deny at the end of each rule set; unused or overly broad rules are removed on a defined cycle.

Monitoring layers: log collection and correlation (SIEM), network flow analysis, IDS/IPS alerts, availability and performance monitoring, and integrity checks on configurations.

Logging requirements: time synchronisation, protected storage, retention period aligned to legal and forensic needs, and defined review frequency with escalation thresholds.

Incident handling follows a lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned feeding back into architecture and controls.

Detection depends on baselines: normal traffic patterns, expected rule hits and known topology must be documented so anomalies are meaningful.

Incident response for networks includes isolation of affected segments, preservation of evidence (logs, flows, memory), coordinated communication and controlled return to service.

Management review closes the loop: metrics (incidents, mean time to detect/respond, patch latency, rule review completion) are reported to management for decisions on risk and resources.

Third-party and remote-access management requires defined responsibilities, monitoring of connections and periodic review of access rights; outsourced operation does not outsource accountability.

Confidentiality, integrity and availability (CIA) are the core properties; network security adds authenticity, accountability, non-repudiation and reliability as supporting properties.

Defence in depth layers controls (perimeter, segmentation, host, application, data) so that failure of one layer does not expose the asset; no single control is assumed sufficient.

Least privilege and need-to-know restrict traffic and access to the minimum required; default-deny is the operational expression of both principles.

Security domains and trust boundaries mark where the level of required protection changes; every crossing between domains needs an identified control (filter, gateway, authentication point).

Threat, vulnerability, risk and impact are distinct: threat = potential cause, vulnerability = weakness, risk = combination of likelihood and consequence, impact = harm to assets.

Separation of duties and segregation of networks prevent a single compromise or single administrator from controlling both sides of a critical transaction.

Security is a lifecycle property: plan, design, implement, operate, monitor, review, maintain and decommission; controls degrade without maintenance.

Security depends on people, process and technology; ISO/IEC 27033 treats organisational, procedural and technical controls as complementary, not substitutable.

Residual risk after controls must be explicitly accepted by accountable management; technical teams identify it, business owners accept it.

ISO/IEC 27033 is a multi-part international standard on network security; Part 1 (27033-1) gives overview and concepts, and defines the vocabulary used by the later parts.

Part 2 addresses network security architecture and design, including the security architecture design process and identification of controls; Part 3 covers reference networking scenarios and risks, threats and control issues for each.

Part 4 covers securing communication between networks using security gateways; Part 5 covers virtual private networks; Part 6 covers wireless and IP-based mobile network access; later parts address other specific technologies.

ISO/IEC 27033 sits in the ISO/IEC 27000 family as guidance supporting ISO/IEC 27001 requirements: 27001 states what an ISMS must do, 27033 explains how to do network security within it.

ISO/IEC 27002 provides the control catalogue (organisational, people, physical, technological); network-relevant clauses such as network security, segregation of networks and cryptography are elaborated in depth by 27033.

ISO/IEC 27033-1 describes the network security architecture design process: define scope and assets, identify threats and risks, derive requirements, select controls, document the architecture, verify and maintain.

27033 guidance is informative, not certifiable on its own; conformity claims are made against 27001 requirements, with 27033 used as supporting implementation guidance.

The series distinguishes the 'network security architecture' (logical, high-level, long-lived) from 'network security design' (concrete technical realisation) and from operational monitoring and management.

Mapping for exams: 27001 = requirements and audit criteria; 27002 = control objectives and practice guidance; 27033 = network-specific architecture, design and scenario guidance.

Architecture work starts with asset and data-flow identification: what data crosses which links, between which zones, with what sensitivity and required protection level.

Zoning rules: group assets with identical protection requirements into a zone; place a filtering or mediating control at every inter-zone boundary; never allow uncontrolled transitive paths between zones.

DMZ pattern: externally reachable services sit in a separate zone with no direct path to internal zones; inbound and outbound flows are filtered and logged independently.

Risk assessment builds on threat identification, vulnerability identification, likelihood, impact and existing control effectiveness; output drives control selection and residual risk acceptance.

Control selection considers technical (firewalls, IDS/IPS, VPN, segmentation, authentication), procedural and physical controls, and must consider cost versus risk reduction and operational impact.

Design must address availability and resilience (redundancy, failover, capacity) as security objectives, not only confidentiality; DoS and single points of failure are design risks.

Remote access and interconnect designs (VPN, wireless, third-party links) require explicit authentication, encryption and endpoint trust decisions, plus rules for what the remote device may reach.

Documented architecture deliverables include zone diagrams, data flows, control placement, addressing/routing rules, trust boundaries and the rationale for each selected control.

Verification: design review, threat modelling, configuration review and testing confirm that the implemented network matches the approved architecture; deviations are risk-assessed and recorded.

Operational management covers change control, configuration management, patch management, capacity management, backup and periodic review of firewall and routing rules.

Rule hygiene: every firewall rule has an owner, purpose and review date; default-deny at the end of each rule set; unused or overly broad rules are removed on a defined cycle.

Monitoring layers: log collection and correlation (SIEM), network flow analysis, IDS/IPS alerts, availability and performance monitoring, and integrity checks on configurations.

Logging requirements: time synchronisation, protected storage, retention period aligned to legal and forensic needs, and defined review frequency with escalation thresholds.

Incident handling follows a lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned feeding back into architecture and controls.

Detection depends on baselines: normal traffic patterns, expected rule hits and known topology must be documented so anomalies are meaningful.

Incident response for networks includes isolation of affected segments, preservation of evidence (logs, flows, memory), coordinated communication and controlled return to service.

Management review closes the loop: metrics (incidents, mean time to detect/respond, patch latency, rule review completion) are reported to management for decisions on risk and resources.

Third-party and remote-access management requires defined responsibilities, monitoring of connections and periodic review of access rights; outsourced operation does not outsource accountability.