ISO 27033 Lead Manager key terms

A structured description of how security controls, trust boundaries, and network segments are arranged to protect information flows across an organisation's networks. It links business requirements to technical design decisions.

A grouping of network assets and users that share the same protection requirements and trust level, separated from other zones by defined controls. Zones simplify policy enforcement and access decisions.

A point where the level of trust changes between communicating parties or network areas, such as between an internal network and the internet. Controls are placed at these points to mediate traffic.

Dividing a network into smaller logical or physical parts so that compromise or excessive traffic in one part does not automatically affect others. Segmentation limits lateral movement and supports least privilege.

A fine-grained segmentation approach where controls are applied to individual workloads or small groups rather than large network segments. It reduces east-west attack paths inside data centres and virtual environments.

Network traffic that flows between systems within the same data centre or internal environment, as opposed to north-south traffic crossing external boundaries. It is a common path for lateral movement after compromise.

The techniques an attacker uses to move from one compromised system to other systems within a network. Segmentation, authentication controls, and monitoring are primary countermeasures.

A device or service placed at a boundary between network zones that enforces traffic policy, such as a firewall, proxy, or remote access concentrator. It mediates and filters communication between differing trust levels.

A network control that permits or denies traffic between networks according to a defined rule set. Modern forms include stateful inspection, application awareness, and policy tied to identity.

A network area placed between an internal network and an untrusted network that hosts externally accessible services. It limits the exposure of internal systems if a public-facing service is compromised.

Applying multiple independent layers of security controls so that failure of one layer does not leave assets unprotected. Layers may include physical, network, host, application, and personnel controls.

Granting users, systems, and processes only the access needed to perform their tasks, and no more. Applied to networks, it means permitting only required flows between defined endpoints.

A multi-part international standard providing guidance on network security, covering concepts, architecture, reference models, securing communications, and technical controls. It supports the network controls described in ISO/IEC 27002.

The international standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system. Network security controls are implemented within this management system.

The international standard providing guidance and recommended controls for information security management, including network security controls. ISO/IEC 27033 gives deeper technical guidance on implementing its network-related controls.

The set of policies, processes, roles, and resources an organisation uses to manage information security systematically. It provides the governance context in which network security controls are selected and operated.

A conceptual structure in the ISO/IEC 27033 series that describes layers, entities, and relationships for designing and assessing network security. It helps practitioners organise controls consistently across architectures.

A documented set of management intentions and rules governing how information and network resources are protected. It provides the authority and direction for technical controls and operational procedures.

Rules defining which subjects may access which network resources, under what conditions, and for what purpose. It translates business requirements and least privilege into enforceable technical configurations.

A process that identifies threats and vulnerabilities, estimates likelihood and impact, and determines the level of risk to information assets. Its results justify and prioritise network security controls.

Selecting and applying options to modify risk, such as mitigating with controls, transferring, avoiding, or accepting it. Choices are recorded and monitored as part of the management system.

The risk that remains after controls have been applied. It must be understood and formally accepted by accountable management before systems are approved for operation.

A potential cause of an unwanted incident that could harm assets or operations, such as an attacker, malware, or natural event. Threats are assessed together with vulnerabilities and impact.

A weakness in a system, control, or process that a threat could exploit. Network vulnerabilities include unpatched services, weak configurations, and unnecessary open ports.

The continuous collection and analysis of network and system events to detect policy violations, anomalies, and attacks. It supports early response and provides evidence for improvement.

A platform that centralises logs and events from many sources, correlates them, and raises alerts. It gives network security teams visibility across zones and supports investigation.

The process of generating, collecting, storing, protecting, and reviewing records of system and network activity. Good practice includes time synchronisation, retention rules, and protection against tampering.

An event or series of events that indicates a possible breach of security policy or failure of controls. Incidents are handled through defined detection, response, and recovery processes.

A documented set of roles, steps, and communication paths for detecting, containing, eradicating, and recovering from security incidents. It is tested and updated so responses are effective under pressure.

Preparing systems and processes so that digital evidence can be collected and preserved reliably when needed. It includes logging, time synchronisation, chain of custody, and defined procedures.

Connectivity that lets users or systems reach organisational networks from outside a controlled physical location. It requires strong authentication, encryption, and restricted authorisation to limit exposure.

A technology that creates encrypted tunnels over untrusted networks so remote users or sites can communicate securely. Design choices determine which traffic is protected and how access is restricted.

A cryptographic protocol that provides confidentiality and integrity for data in transit between clients and servers. Its configuration, certificate management, and version choices are important network security decisions.

The lifecycle process for issuing, distributing, renewing, and revoking digital certificates used to authenticate parties and protect communications. Poor management causes outages and trust failures.

The policies, roles, and systems that issue and manage public key certificates within a trust framework. It underpins authentication for many network services and encrypted connections.

Authentication that requires two or more independent evidence types, such as a password plus a hardware token. It reduces the risk of credential compromise enabling unauthorised network access.

The set of processes and technologies that manage identities, credentials, and authorisations across systems. It connects business roles to network access rights and supports auditability.

A control that decides whether a device may join a network based on identity, health, or policy checks. It helps prevent unmanaged or non-compliant devices from connecting.

A structured process for identifying, testing, deploying, and verifying updates to systems and network devices. Timely patching removes known vulnerabilities that attackers routinely exploit.

The disciplined control of system and network device settings, including baselines, change tracking, and verification. It prevents insecure drift and supports consistent, auditable security posture.

The periodic examination of firewall, router, and gateway rules to remove obsolete or overly permissive entries. Regular review keeps enforcement aligned with current architecture and policy.

Rules describing how users may use organisational network and information resources, including prohibited behaviour. It sets expectations that support technical controls and disciplinary processes.