130n@calvinlai.com
  • About Calvin Lai (fkclai)
  • My Work
  • Cyber Security
    • Cyber Security Centre (CSC)
      • Why we need a CSC
      • CSC Team Structure: Roles, Functions, and Tools
        • Key Function & Role
        • Tools & Platforms
        • People
        • Outsource Strategy
      • HRMC Executive Paper
  • Detection and Response
    • Playbook: Threat Prioritization & Automated Response Strategies
      • Scenario: Detecting and Mitigating a Ransomware Attack
      • Scenario: DC Sync Attack Detected and Mitigated
      • Scenario: Pass-the-Hash (PtH) Attack Detected and Contained
      • Scenario: Phishing Campaign with Malware / Credential Theft Detected and Mitigated
  • Application Architecture
    • Comparison of MVC , N-tier and Microservice Architecture
  • Application Security
    • OAuth, SAML, and OpenID Connect: Key Differences and Use Cases
    • Secure Coding Principles
    • HTTP Header Security Principles
    • Mitigating Broken Object Level Authorization (BOLA)
    • Spring Boot Validation
    • Output Encoding in JavaServer Faces (JSF)
    • Session Management Security Issues
    • Common API Security Problems
      • Broken Authentication
      • Excessive Data Exposure
      • Lack of Resources & Rate Limiting
      • Broken Function Level Authorization
      • Unsafe Consumption of APIs
    • JAVA Exception Handling
    • File Upload Validation
    • OAuth 2.0 Security
      • Insecure Storage of Access Tokens
    • Microservice Security
      • Sample Coding Demo
        • Service Implementation
        • Client Interaction
      • Security Solution for Microservices Architecture
    • Modifying and Protecting Java Class Files
      • Modify a Class File Inside a WAR File
      • Direct Bytecode Editing
        • Steps to Directly Edit a Java Class File
          • Update: Java Bytecode Editing Tools
      • Techniques to Protect Java Class Files
        • Runtime Decryption in WebLogic
    • JAVA Program
      • Secure, Concurrent Web Access Using Java and Tor
      • Creating a Maven Java project in Visual Studio Code
  • Exploit/CVE PoC
    • ZeroLogon Exploit
    • Remote Retrieved Chrome saved Encrypted Password
    • Twitter Control an RCE attack
  • Hacking Report (HTB)
    • Hits & Summary
      • Tools & Cheat Sheet
    • Windows Machine
      • Love 10.10.10.239
      • Blackfield 10.10.10.192
      • Remote 10.10.10.180
      • Sauna 10.10.10.175
      • Forest 10.10.10.161
      • Sniper
      • Json
      • Heist
      • Blue
      • Legacy
      • Resolute
      • Cascade
    • Linux Machine
      • Photobomb 10.10.11.182
      • Pandora 10.10.11.136
      • BountyHunter 10.10.11.100
      • CAP 10.10.10.245
      • Spectra 10.10.10.229
      • Ready 10.10.10.220
      • Doctor 10.10.10.209
      • Bucket 10.10.10.212
      • Blunder 10.10.10.191
      • Registry 10.10.10.159
      • Magic
      • Tabby
  • Penetration Testing
    • Web Application PenTest
    • Network/System PenTest
    • Mobile Penetration Test
      • Certificate Pinning
        • Certificate Pinning Bypass (Android)
          • Root a Android Device
          • Setup Proxy Tool - Burp Suite
      • Checklist
  • Threat Intelligence
    • Advanced Persistent Threat (APT) groups
      • North Korean APT Groups
      • Chinese APT Groups
      • Russian APT Groups
      • Other APT
  • Red Team (Windows)
    • 01 Reconnaissance
    • 02 Privileges Escalation
    • 03 Lateral Movement
    • 04 AD Attacks
      • DCSync
    • 05 Bypass-Evasion
    • 06 Kerberos Attack
    • 99 Basic Command
  • Exploitation Guide
    • 01 Reconnaissance
    • 02 Port Enumeration
    • 03 Web Enumeration
    • 04 Windows Enum & Exploit
      • Windows Credential Dumping
        • Credential Dumping: SAM
        • Credential Dumping: DCSync
      • Kerberos Attack
      • RDP
    • 05 File Enumeration
    • 06 Reverse Shell Cheat Sheet
      • Windows Reverse Shell
      • Linux Reverse Shell
    • 07 SQL Injection
    • 08 BruteForce
    • 09 XSS Bypass Checklist
    • 10 Spring Boot
    • 11 WPA
    • 12 Payload list
  • Vuln Hub (Writeup)
    • MrRobot
    • CYBERRY
    • MATRIX 1
    • Node-1
    • DPwwn-1
    • DC7
    • AiWeb-2
    • AiWeb-1
    • BrainPan
  • CTF (Writeup & Tips)
    • CTF Tools & Tips
    • Hacker One
    • CTF Learn
    • P.W.N. University - CTF 2018
    • HITCON
    • Pwnable
      • 01 Start
  • Useful Command/Tools
    • Kali
    • Windows
    • Linux
  • Offensive Security Lab & Exam
    • Lab
    • Tools for an Offensive Certification
      • Strategy for an Offensive Exam Certification
        • CVEs
        • Privilege Escalation
        • Commands
        • Impacket
  • ISO 27001
    • Disclaimer
    • What is ISO 27001
      • Implementation
    • Documentation
    • Common Mistake
    • Q&A
      • Can internal audit to replace the risk assessment
      • Is it sufficient for only the IT department head to support the ISO 27001 program
      • Does the Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) are the same?
    • ISO 27001 Controls and Domains
      • 1. Information Security Policies
      • 2. Organization of Information Security
      • 3. Human Resource Security
      • 4. Asset Management
      • 5. Access Control
      • 6. Cryptographic Controls
      • 7. Physical and Environmental Security
      • 8: Operational Security
      • 9. Communications Security
      • 10. System Acquisition, Development, and Maintenance
      • 11. Supplier Relationships
      • 12: Information Security Incident Management
      • 13. Information Security Aspects of Business Continuity Management
      • 14. Compliance
Powered by GitBook
On this page
  • Controls (A.13):
  • Control A.13.1.1: Network Controls
  • Control A.13.1.2: Security of Network Services
  • Control A.13.1.3: Segregation in Networks
  • Control A.13.2.1: Information Transfer Policies and Procedures
  • Control A.13.2.2: Agreements on Information Transfer
  • Control A.13.2.3: Electronic Messaging
  • Control A.13.2.4: Confidentiality or Non-Disclosure Agreements

Was this helpful?

  1. ISO 27001
  2. ISO 27001 Controls and Domains

9. Communications Security

This category focuses on ensuring the security of information in networks and its supporting information processing facilities. It involves securing both internal and external communications to prevent unauthorized access, data breaches, and interruptions in communication services.

Controls (A.13):

  • A.13.1.1: Network Controls

  • A.13.1.2: Security of Network Services

  • A.13.1.3: Segregation in Networks

  • A.13.2.1: Information Transfer Policies and Procedures

  • A.13.2.2: Agreements on Information Transfer

  • A.13.2.3: Electronic Messaging

  • A.13.2.4: Confidentiality or Non-Disclosure Agreements

Control A.13.1.1: Network Controls

Audit Questions:

  • What controls are in place to secure internal and external networks?

  • How is network traffic monitored and protected against threats?

Common Non-Conformities (NC):

  • Lack of network security controls.

  • Insufficient monitoring of network traffic.

  • Network vulnerabilities not addressed.

Control A.13.1.2: Security of Network Services

Audit Questions:

  • How is the security of network services ensured?

  • Are there agreements in place with network service providers regarding security requirements?

Common Non-Conformities (NC):

  • Inadequate security measures for network services.

  • No security agreements with service providers.

Control A.13.1.3: Segregation in Networks

Audit Questions:

  • How is network segregation implemented to protect sensitive information?

  • What measures are in place to ensure secure segregation?

Common Non-Conformities (NC):

  • Lack of network segregation.

  • Poor implementation of segregation measures.

Control A.13.2.1: Information Transfer Policies and Procedures

Audit Questions:

  • Are there documented policies and procedures for the secure transfer of information?

  • How are these policies communicated and enforced?

Common Non-Conformities (NC):

  • No documented policies for information transfer.

  • Policies not communicated effectively.

  • Inadequate enforcement of transfer procedures.

Control A.13.2.2: Agreements on Information Transfer

Audit Questions:

  • Are there agreements in place for the secure transfer of information with external parties?

  • How are these agreements reviewed and maintained?

Common Non-Conformities (NC):

  • No agreements for information transfer with external parties.

  • Outdated or insufficiently maintained agreements.

Control A.13.2.3: Electronic Messaging

Audit Questions:

  • What controls are in place to secure electronic messaging systems?

  • How are messaging communications monitored and protected?

Common Non-Conformities (NC):

  • Inadequate security controls for electronic messaging.

  • Lack of monitoring and protection for messaging communications.

Control A.13.2.4: Confidentiality or Non-Disclosure Agreements

Audit Questions:

  • Are confidentiality or non-disclosure agreements (NDAs) in place with employees and third parties?

  • How are NDAs enforced and maintained?

Common Non-Conformities (NC):

  • Lack of confidentiality or non-disclosure agreements.

  • NDAs not enforced or maintained properly.

These detailed questions and common non-conformities provide a better understanding of what auditors typically look for in the Communications Security category and potential areas where organizations might fall short.

Previous8: Operational SecurityNext10. System Acquisition, Development, and Maintenance

Last updated 4 months ago

Was this helpful?