4.4 Technological Controls: Operations, Logging, Web Filtering & Monitoring (A.8.15-A.8.24)
Key Takeaways
- Centralized logging (A.8.15) and monitoring activities (A.8.16 — new in 2022) demand SIEM aggregation, UEBA anomaly detection, write-once log integrity protection, and synchronized NTP clocks (A.8.17).
- Privileged utility programs (A.8.18) and software installation controls (A.8.19) restrict unauthorized execution using application allowlisting, code signing, and strict administrative authorization workflows.
- Network security management (A.8.20-A.8.22) enforces perimeter Next-Gen Firewalls, Network Access Control (NAC), DMZ micro-segmentation, and Zero-Trust Network Access (ZTNA).
- Web filtering (A.8.23 — new in 2022) blocks access to malicious, phishing, and unapproved web domains using DNS security filtering and automated URL classification.
4.4 Technological Controls: Operations, Logging, Web Filtering & Monitoring (A.8.15–A.8.24)
Controls A.8.15 through A.8.24 cover operational security telemetry, network architecture safeguards, web usage restrictions, and cryptography within Theme 8 of ISO/IEC 27001:2022. This section contains two critical new 2022 controls: A.8.16 (Monitoring activities) and A.8.23 (Web filtering).
In-Depth Analysis of Operational Controls A.8.15–A.8.24
1. Logging, Monitoring & Time Synchronization (A.8.15, A.8.16, A.8.17)
- A.8.15 Logging: System logs recording user activities, administrative events, authentication attempts, security exceptions, and operational errors must be produced, kept, and protected. Logs must be forwarded in real time to a centralized log management system (e.g., SIEM, Elasticsearch). Log integrity must be protected using append-only storage, cryptographic hashing, and access controls preventing even administrators from altering log history.
- A.8.16 Monitoring activities (NEW 2022 Control): Systems must be continuously monitored for anomalous behavior, unauthorized access attempts, and performance bottlenecks. Requires deployment of Security Information and Event Management (SIEM), User and Entity Behavior Analytics (UEBA), and automated alert correlation rules to trigger incident response Playbooks.
- A.8.17 Clock synchronization: The clocks of all relevant information processing systems within an organization must be synchronized to an accurate reference time source. Requires implementation of Network Time Protocol (NTP / PTP) connected to Stratum 1/2 atomic or GPS time sources. Precise time synchronization is essential for cross-system log correlation during forensic investigations.
2. Privileged Utilities & Software Installation (A.8.18, A.8.19)
- A.8.18 Use of privileged utility programs: Utility programs capable of overriding system and application controls (e.g., password reset utilities, raw disk editors, low-level registry modifiers, network sniffers) must be strictly restricted, segregated, and audited. Usage requires formal authorization and session logging.
- A.8.19 Installation of software on operational systems: Unapproved software installation on production systems is prohibited. Implementation requires Application Allowlisting (AppLocker, WDAC), software digital signature validation, and package deployment exclusively via automated CI/CD or centralized patch management tools.
3. Network Security, Services & Segregation (A.8.20, A.8.21, A.8.22)
- A.8.20 Networks security: Networks must be secured, managed, and controlled to protect information in systems and applications. Mandates Next-Generation Firewalls (NGFW), Intrusion Detection and Prevention Systems (IDS/IPS), and Network Access Control (NAC) enforcing 802.1X device authentication.
- A.8.21 Security of network services: Security mechanisms, service levels, and management requirements of all network services (VPNs, leased lines, cloud connectivity) must be identified and included in network service agreements.
- A.8.22 Segregation of networks: Groups of information services, users, and information systems must be segregated on networks. Implementation requires micro-segmentation using Virtual Local Area Networks (VLANs), Software-Defined Networking (SDN), zero-trust network zones, and DMZs isolating public web servers from internal databases.
4. Web Filtering (A.8.23 — NEW 2022 Control)
Access to external websites must be managed to reduce organizational exposure to malicious web content:
- DNS & URL Domain Filtering: Blocking access to dangerous, malicious, command-and-control (C2) botnets, phishing domains, and inappropriate website categories (e.g., adult content, illegal file-sharing).
- SSL/TLS Inspection: Decrypting and inspecting outbound web traffic at proxy gateways to detect hidden malware downloads.
- Custom Category Rules: Enforcing corporate acceptable use policies by restricting access to unapproved cloud storage or personal webmail during work hours.
5. Use of Cryptography (A.8.24)
Control A.8.24 governs the use of cryptography, key management, and data protection:
- Cryptographic Policy: Formal policy defining approved algorithms (AES-256 for symmetric encryption, RSA-3084/4096 or ECC P-384 for asymmetric), TLS 1.3 for data in transit, and minimum key lengths.
- Key Management Lifecycle: Secure generation, distribution, storage, rotation, and destruction of cryptographic keys using Hardware Security Modules (HSMs) or cloud Key Management Services (KMS). Master keys must never be hardcoded in application source code.
Operational & Network Control Matrix
| Control ID & Title | Operational Safeguard | Core Tool / Protocol | Lead Implementer Audit Artifact |
|---|---|---|---|
| A.8.15 Logging | Central log collection, WORM storage | Splunk, Elastic SIEM, Syslog-ng | Log protection policy, SIEM ingest logs |
| A.8.16 Monitoring Activities | Real-time security event correlation | SIEM / UEBA / SOC Playbooks | Alert triage logs, SOC incident reports |
| A.8.17 Clock Synchronization | NTP clock sync across all nodes | NTP (Port 123 UDP) / PTP | Server NTP configuration, time drift logs |
| A.8.22 Segregation of Networks | Network zoning, Zero-Trust microsegmentation | VLANs, Firewalls, SDN | Network topology diagrams, firewall rules |
| A.8.23 Web Filtering | Category-based web blocking, DNS filtering | Secure Web Gateway (SWG), DNS Sinkhole | Web proxy block logs, category rule configs |
| A.8.24 Use of Cryptography | Key lifecycle management, HSM storage | Cloud KMS, HashiCorp Vault, HSM | Cryptographic policy, KMS key rotation logs |
Real-World Lead Implementer Scenario
Scenario: During a malware incident investigation at an insurance company, security analysts attempt to trace the lateral movement of an attacker who compromised a desktop workstation. The investigation stalls because domain controllers and web servers show clock skew differences of up to 12 minutes, making event correlation impossible. Furthermore, logs on several local servers were deleted by the attacker.
Lead Implementer Remediation Strategy:
- Remediate A.8.17 (Clock Sync): Deploy internal Stratum 2 NTP servers synchronized to authoritative atomic time sources; enforce domain Group Policies forcing all servers and workstations to sync within < 100 milliseconds.
- Remediate A.8.15 & A.8.16 (Logging & Monitoring): Reconfigure all servers to stream event logs instantaneously to an off-site, append-only SIEM buffer using TLS-encrypted Syslog. Revoke local server administrator permissions to modify SIEM ingest streams.
- Remediate A.8.23 (Web Filtering): Deploy Secure Web Gateway (SWG) agents on all endpoints to intercept malicious DNS requests and block outbound connections to known C2 server infrastructure.
An enterprise deploys a SIEM platform that ingests security telemetry from firewalls, endpoints, and identity providers. Automated behavioral rules detect when a standard user account performs an anomalous bulk export of customer files outside business hours, triggering an alert to the SOC. Which ISO/IEC 27001:2022 control is directly exemplified?
To prevent employees from navigating to phishing domains, malware distribution portals, and unapproved web services, an organization configures DNS-level filtering and Secure Web Gateway proxy inspection. Which ISO/IEC 27001:2022 control addresses this capability?
A financial platform uses AWS Key Management Service (KMS) backed by FIPS 140-2 Level 3 Hardware Security Modules (HSMs) to manage master keys, enforcing automatic 365-day key rotation and prohibiting plain-text key extraction. Which control governs these practices?