Description

This curriculum spans the design and operational enforcement of network security within an ISO 27001-aligned ISMS, comparable in scope to a multi-phase internal capability build or a technical advisory engagement supporting full audit readiness.

Module 1: Establishing the ISMS Framework Aligned with ISO 27001

Select appropriate organizational boundaries and scope justification based on business units, systems, and data sensitivity to avoid over-scoping or critical exclusions.
Define roles and responsibilities for information security governance, including assigning the ISMS manager and clarifying reporting lines to executive leadership.
Develop a formal information security policy approved by top management, specifying mandatory compliance with ISO 27001 and integration with existing corporate governance.
Establish criteria for risk assessment methodology (qualitative vs. quantitative) and align it with organizational risk appetite and regulatory requirements.
Integrate ISMS objectives with business continuity and enterprise risk management frameworks to ensure strategic alignment.
Document decision rationale for scoping exclusions in Statement of Applicability (SoA), ensuring audit defensibility.
Implement version control and change management for ISMS documentation to maintain integrity across updates.
Design a governance committee structure with defined meeting cadence, agenda templates, and escalation paths for unresolved risks.

Module 2: Risk Assessment and Treatment Planning

Select asset valuation criteria (confidentiality, integrity, availability) based on business impact analysis rather than technical criticality alone.
Conduct threat modeling for key network components (e.g., firewalls, routers, cloud gateways) using STRIDE or similar frameworks.
Document vulnerabilities identified through scanning tools and penetration tests in the risk register with evidence-based ratings.
Apply risk treatment options (mitigate, accept, transfer, avoid) with documented justification, including cost-benefit analysis for controls.
Define risk acceptance thresholds requiring CISO and legal sign-off, particularly for third-party hosted services.
Map identified risks to relevant controls in Annex A of ISO 27001, ensuring traceability in the SoA.
Establish a process for re-assessing risks following significant changes (e.g., network redesign, M&A activity).
Integrate risk treatment plans into project management workflows with assigned owners and deadlines.

Module 3: Network Architecture and Segmentation Strategy

Design network zones (e.g., DMZ, internal, management, guest) with explicit data flow rules and firewall rule sets.
Implement VLAN segmentation for sensitive departments (e.g., finance, HR) with access control lists (ACLs) at layer 3.
Enforce default-deny policies on routers and switches, permitting only explicitly required traffic.
Justify flat network exceptions with compensating controls and time-bound remediation plans.
Deploy micro-segmentation in virtualized environments using host-based firewalls or SDN policies.
Document network diagrams with IP ranges, device roles, and security controls for audit and incident response.
Evaluate use of air-gapped networks for critical systems against operational feasibility and maintenance overhead.
Define segmentation review process during onboarding of new applications or cloud services.

Module 4: Access Control and Privileged Management

Implement role-based access control (RBAC) for network devices, mapping roles to job functions and least privilege.
Enforce multi-factor authentication (MFA) for administrative access to firewalls, switches, and routers.
Deploy a privileged access management (PAM) solution to control, monitor, and rotate credentials for network administrators.
Define session timeout and lockout policies for console and remote access to network infrastructure.
Conduct quarterly access reviews for administrative accounts with documented attestation by data owners.
Restrict remote administrative access via IP whitelisting and require use of secure jump hosts.
Implement command logging and change tracking for CLI-based network device configurations.
Establish break-glass account procedures with audit trail requirements and post-use review.

Module 5: Secure Configuration and Hardening Standards

Develop and enforce device-specific hardening baselines (e.g., CIS benchmarks) for firewalls, routers, and switches.
Disable unused services (e.g., Telnet, SNMPv1, HTTP) on all network devices and verify through configuration scans.
Implement centralized configuration management using tools like Ansible or Puppet to enforce consistency.
Define change control process for configuration updates, including peer review and pre-change backups.
Automate configuration drift detection and alerting using network monitoring tools.
Enforce encrypted management protocols (SSHv2, HTTPS, SNMPv3) with strong cryptographic settings.
Standardize logging formats and ensure time synchronization (NTP) across all network devices.
Integrate configuration templates into procurement and onboarding processes for new devices.

Module 6: Cryptographic Controls and Secure Communications

Select encryption protocols (e.g., IPsec, TLS 1.2+) for site-to-site and remote access based on threat model and performance requirements.
Implement certificate lifecycle management for internal PKI or third-party certificates used in VPNs and web gateways.
Enforce key management policies, including key rotation intervals and secure storage for encryption keys.
Disable weak cipher suites and protocols (e.g., SSLv3, RC4) across load balancers, firewalls, and proxies.
Deploy DNSSEC for internal DNS zones to prevent spoofing and cache poisoning attacks.
Configure secure email gateways with TLS enforcement for outbound and inbound message transfer.
Document cryptographic inventory listing all systems using encryption and their compliance status.
Conduct periodic audits of certificate deployments to identify expired or misconfigured instances.

Module 7: Monitoring, Logging, and Incident Detection

Define centralized logging requirements for network devices, including log types, retention periods, and storage locations.
Configure SIEM ingestion of firewall, IDS/IPS, and proxy logs with normalized event formats.
Develop correlation rules to detect suspicious patterns (e.g., multiple failed logins, port scanning, data exfiltration).
Implement NetFlow or IPFIX collection for traffic analysis and anomaly detection.
Establish thresholds for network baselining and alerting on deviations (e.g., bandwidth spikes, new protocols).
Deploy network-based intrusion detection systems (NIDS) with signature and behavioral analysis.
Ensure log integrity through write-once storage or cryptographic hashing to support forensic investigations.
Define escalation procedures for security alerts, including initial triage and handoff to incident response team.

Module 8: Third-Party and Supply Chain Risk Management

Conduct security assessments of managed service providers (MSPs) managing firewall or routing infrastructure.
Negotiate SLAs with ISPs and cloud providers specifying security responsibilities and incident notification timelines.
Enforce contractual requirements for third-party access, including audit rights and use of PAM solutions.
Review network architecture diagrams provided by vendors to identify insecure default configurations.
Validate security controls in SaaS and IaaS environments through independent testing or audit reports (e.g., SOC 2).
Implement network-level controls (e.g., egress filtering) to limit data transfer to unauthorized third-party endpoints.
Require certificate transparency and domain validation for externally facing services managed by partners.
Conduct periodic reassessment of third-party risk based on service changes or breach disclosures.

Module 9: Audit Readiness and Continuous Improvement

Maintain an updated Statement of Applicability (SoA) with justifications for inclusion or exclusion of Annex A controls.
Prepare evidence packs for network-related controls, including configuration reports, access logs, and change records.
Conduct internal audits using checklists aligned with ISO 27001:2022 control objectives and audit criteria.
Perform gap assessments against previous audit findings and track remediation to closure.
Implement corrective action requests (CARs) for non-conformities with root cause analysis and timelines.
Integrate management review inputs from network incidents, audit results, and performance metrics.
Update risk treatment plans based on audit findings and emerging threats to network infrastructure.
Establish a continuous improvement cycle using PDCA model with documented outcomes and follow-up actions.