In the current digital era, strong cybersecurity measures are essential. Organizations increasingly struggle to protect their data and assets from Internet-based hazards as the threat landscape changes.
The first edition of the standard was released in 2012, and the most recent one on June 28, 2023. Recent upgrades are centered on Internet security, assisting businesses in risk reduction and defence augmentation. The ISO/IEC 27032:2023 standard empowers organizations to face digital challenges while protecting information systems, from a new title to improved risk assessment.
Internet Security: Why Is It Important?
Our digital lives are significantly impacted by Internet security since it includes safeguards for online transactions, activities, and data. As cybercrime increases and sensitive information is shared, it offers the protections needed to ward against risks like malware, unauthorized access, and identity theft.
It’s important to remember that the Internet wasn’t built with safety in mind, therefore it’s always been susceptible to attacks. The complexity of protecting the Internet has only increased as a result of the expansion of Internet-connected devices and the advent of the Internet of Things (IoT). Organizations New types of attacks, such as phishing and spyware, are being adopted by cybercriminals as technology develops.
The scope of the Internet and the parties engaged in online activities generate intricate security risks that call for cooperation between the technological and legal communities. Internet problems can be resolved through worldwide cooperation and the adoption of comprehensive measures, promoting a safer online environment for all users.
Cybersecurity vs. Internet Security
Cybersecurity and Internet security go hand in hand when it comes to protecting our digital environment. They are interconnected fields that work to defend systems and digital surroundings against a range of dangers and weaknesses. With dangers associated with online services and ICT systems as its primary focus, internet security focuses on protecting Internet access and usage.
On the other hand, cybersecurity encompasses a wider range. Internet security is a significant component of its reach. With this all-encompassing strategy, systems that are connected to the Internet are protected from potential attacks on their hardware, software, programs, and data. Cybersecurity effectively addresses a number of disciplines, including Internet security, network security, and data protection.
ISO/IEC 27032:2012
A global standard known as ISO/IEC 27032:2012, commonly known as “Information Technology — Security Techniques — Guidelines for Cybersecurity,” focuses exclusively on cybersecurity and offers enterprises extensive information on managing and minimizing cyber risks. This standard provides a systematic method for managing cybersecurity and acknowledges the crucial role that cybersecurity plays in today’s digital environment.
This version of the standard covers third-party management, incident management, reaction training, risk assessment, awareness, cybersecurity strategy and policy, organizational structure and governance, and third-party management.
It highlights the significance of carrying out exhaustive risk assessments to find potential vulnerabilities and creating a distinct cybersecurity strategy in line with organizational goals. It also emphasizes the importance of creating efficient incident management procedures, delivering consistent cybersecurity training to staff members, and ensuring that third-party suppliers follow strong cybersecurity practices.
The ISO/IEC 27032:2012 guidelines can assist organizations in preventing cyberattacks and reducing incident damage. This standard is an invaluable tool for businesses of all sizes, assisting them in navigating the complicated world of cybersecurity and setting up solid procedures to protect their digital assets and data from changing threats.
ISO/IEC 27032:2023 Updates
“Cybersecurity — Guidelines for Internet security,” the new edition of ISO/IEC 27032 standard, focuses on solving Internet security concerns and offering advice to minimize prevalent threats. The standard addresses a number of security challenges, such as hacking, the spread of malicious software, social engineering assaults, zero-day attacks, privacy attacks, and zero-day exploits. By providing both technical and non-technical controls, the guidance in the standard gives organizations the tools they need to get ready for, avoid, detect, watch for, and react to different forms of Internet-based assaults.
Multiple facets of Internet security are addressed by the recommendations presented in ISO/IEC 27032: 2023. Preventing, detecting, and responding to assaults are all part of the system controls included.
In order to encourage active participation in tackling Internet security concerns, the standard emphasizes the application of industry best practices and supports customer and employee education. It also emphasizes how important it is to maintain information’s validity, accountability, non-repudiation, and trustworthiness, as well as its confidentiality, integrity, and availability.
It should be noted that ISO/IEC 27032:2023 does not give particular attention to controls for systems that are essential to national security or critical infrastructure.
However, the majority of the controls stated in the document are applicable to such systems, allowing organizations to properly protect their vital assets. Using concepts from the ISO/IEC TS 27100, ISO/IEC 27002, ISO/IEC 27033 series, and ISO/IEC 27701 standards, the standard creates a strong link between Internet security, network security, online security, and cybersecurity.
Also Read: Understand Cyber Security better with ISO/IEC 27032
Differences between ISO/IEC 27032:2012 and 27032:2023
ISO/IEC 27032:2023 vs. 27032:2012 Differences This new name, “Cybersecurity — Guidelines for Internet security,” reflects the standard’s expanded scope to include issues specific to the Internet. Second, the text has been reorganized to make it simpler for organizations to understand:
| ISO/IEC 27032:2012 Structure | ISO/IEC 27032:2023 Structure |
| 1 Scope | 1 Scope |
| 2 Applicability | |
| 2 Normative references | |
| 2.1 Audience | 3 Terms and definitions |
| 2.2 Limitations | 4 Abbreviated terms |
| 3 Normative references | 5 Relationship between Internet security, web security, network security and cybersecurity |
| 4 Terms and definitions | 6 Overview of Internet security |
| 5 Abbreviated terms | 7 Interested parties |
| 6 Overview | 7.1 General |
| 6.1 Introduction | 7.2 Users |
| 6.2 The nature of the Cyberspace | 7.3 Coordinator and standardization organizations |
| 6.3 The nature of Cybersecurity | 7.4 Government authorities |
| 6.4 General model | 7.5 Law enforcement agencies |
| 6.5 Approach | 7.6 Internet service providers |
| 7 Stakeholders in the Cyberspace | 8 Internet security risk assessment and treatment |
| 7.1 Overview | 8.1 General |
| 7.2 Consumers | 8.2 Threats |
| 7.3 Providers | 8.3 Vulnerabilities |
| 8 Assets in the Cyberspace | 8.4 Attack vectors |
| 8.1 Overview | 9 Security guidelines for the Internet |
| 8.2 Personal assets | 9.1 General |
| 8.3 Organizational assets | 9.2 Controls for Internet security |
| 9 Threats against the security of the Cyberspace | 9.2.1 General |
| 9.1 Threats | 9.2.2 Policies for Internet security |
| 9.2 Threat agents | 9.2.3 Access control |
| 9.3 Vulnerabilities | 9.2.4 Education, awareness and training |
| 9.4 Attack mechanisms | 9.2.5 Security incident management |
| 10 Roles of stakeholders in Cybersecurity | 9.2.6 Asset management |
| 10.1 Overview | 9.2.7 Supplier management |
| 10.2 Roles of consumers | 9.2.8 Business continuity over the Internet |
| 10.3 Roles of providers | 9.2.9 Privacy protection over the Internet |
| 11 Guidelines for stakeholders | 9.2.10 Vulnerability management |
| 11.1 Overview | 9.2.11 Network management |
| 11.2 Risk assessment and treatment | 9.2.12 Protection against malware |
| 11.3 Guidelines for consumers | 9.2.13 Change management |
| 11.4 Guidelines for organizations and service providers | 9.2.14 Identification of applicable legislation and compliance requirements |
| 12 Cybersecurity controls | 9.2.15 Use of cryptography |
| 12.1 Overview | 9.2.16 Application security for Internet-facing application |
| 12.2 Application level controls | 9.2.17 Endpoint device management |
| 12.3 Server protection | 9.2.18 Monitoring |
| 12.4 End-user controls | Annex A (informative) Cross-references between this document and ISO/IEC 27002 |
| 12.5 Controls against social engineering attacks | Bibliography |
| 12.6 Cybersecurity readiness | |
| 12.7 Other controls | |
| 13 Framework of information sharing and coordination | |
| 13.1 General | |
| 13.2 Policies | |
| 13.3 Methods and processes | |
| 13.4 People and organizations | |
| 13.5 Technical | |
| 13.6 Implementation guidance | |
| Annex A (informative) Cybersecurity readiness | |
| Annex B (informative) Additional resources | |
| Annex C (informative) Examples of related documents | |
| Bibliography |
One important change is the addition of a more thorough framework for risk assessment and risk management in relation to Internet security. Organizations will have a better awareness of the risks involved with Internet security because of the new standard’s inclusion of extra content on threats, vulnerabilities, and attack vectors. This will also enable better risk management procedures.
Additionally, Annex A establishes a mapping between the controls described in ISO/IEC 27002 and ISO/IEC 27032:2023 for Internet security. Employing this mapping, organizations carefully evaluate and align the controls provided in ISO/IEC 27002 with the security measures specified in the standard. This promotes better integration of security frameworks and practices that are accepted globally.
Overall, ISO/IEC 27032:2023 places an emphasis on Internet security provides guidance for a wider spectrum of Internet-based risks, and provides a better framework for risk assessment and treatment. The new standard better prepares organizations to handle the changing demands of cybersecurity in the digital era and protect their data and assets from Internet-related hazards by taking into account these significant changes.
PECB’s ISO/IEC 27032 Training Courses
The PECB ISO/IEC 27032 training programs offer an in-depth and focused education in the field of cyber security and personal data protection. The courses are centered on the best practices for managing cybersecurity risks, and they give participants the information and abilities they need to successfully negotiate the vast array of cybersecurity risks and difficulties.
Source: PECB