Sensitive corporate information is a sought-after target for organized cybercriminals, as well as state-driven industrial espionage. The processing of this information should therefore follow particularly restrictive security guidelines. To this end, the internationally valid information security standard ISO/IEC 27001 defines a comprehensive catalog of measures to holistically protect the information assets of companies and organizations based on risk. In the following, we highlight three new controls from the updated version ISO/IEC 27001:2022 that play a key role in information processing and information assurance.
Content
- Corporate information as a coveted target of attack
- Three new measures for more information security
- Deletion of information
- Data masking
- Prevention of data leaks
- Technical measures in information security - a conclusion
- What does the update mean for your certification?
- DQS: Your competent partner for certified information security
Corporate information is a coveted target of attack
The study"Wirtschaftsschutz 2022"(Business Protection 2022) by the German industry association Bitkom confirms that hackers are very much aware of the economic value of information and data in today's business world: 36 percent of the companies surveyed have already been affected by the theft of sensitive data and digital information. Particularly popular targets are communications data at 68 percent and customer data at 45 percent.
The damage caused by blackmail, patent infringements and lost sales directly attributable to data theft is in the range of several billion euros annually.
Companies and organizations need to further strengthen protection when processing their critical data. Additional guidelines help to further improve the overall security concept and reduce the attack surface.
Three new technical measures for more information security
The 93 measures in Annex A of the new ISO/IEC 27001:2022 have been reorganized into four topics:
- Organizational measures
- Personal measures
- Physical measures
- Technical measures
The three new measures for information protection that we will look at in more detail below are from the "Technical Measures" topic area:
- 8.10 Deletion of information
- 8.11 Data masking
- 8.12 Prevention of data leaks
The General Data Protection Regulation (GDPR) also prescribes measures for the protection of personal data in Article 32. These are referred to as technical and organizational measures (TOMs) in the context of processing such data. ISO 27001 thus contributes to ensuring data protection via the controls in Annex A of the standard by providing an appropriate level of protection.
Deletion of information
Control 8.10 in ISO 27001 addresses the risks posed by information that is no longer needed but is still on information systems, devices, or other storage media. Deleting this already unnecessary data prevents its disclosure - ensuring compliance with legal, statutory, regulatory and contractual requirements for data deletion.
In doing so, companies and organizations should consider the following points:
- Choosing an erasure method that is appropriate in light of the business and legal environment, such as electronic overwriting or cryptographic erasure
- Documentation of the results
- Providing evidence when using service providers to delete information
If third parties take over data storage on behalf of your company, requirements for deletion should be written into the contract agreement to enforce this during and even after termination of these services.
To ensure the reliable removal of sensitive information - while ensuring compliance with relevant data retention policies and applicable laws and regulations - the new standard provides for the following procedures, services and technologies:
- Establishment of dedicated systems that enable secure destruction of information, for example, according to retention policies or at the request of affected individuals
- Deletion of obsolete versions, copies, or temporary files on all storage media
- Use of only approved and secure erasure software to permanently and permanently remove information
- Deletion via approved and certified secure disposal service providers
- Using disposal methods appropriate for the particular storage medium being disposed of, such as demagnetization of hard drives
When using cloud services, it is important to check the permissibility of the erasure procedures offered. If this is given, the organization should use the deletion procedure or request the cloud provider to delete the information. If possible, these deletion processes should be automated as part of the subject-specific guidelines.
To prevent the inadvertent disclosure of sensitive information, all device storage returned to vendors should be removed prior to return. On some devices, such as smartphones, data removal is only possible through destruction or internal functions (for example, restoring factory settings). Depending on the classification of the information, it is important to choose an appropriate procedure.
Deletion processes should be documented, depending on the sensitivity, in order to be able to prove the removal of data in case of doubt.
Data masking
For a range of sensitive information such as personal data processing, company and industry-specific or regulatory requirements stipulate masking, pseudonymization or anonymization of the information. A guideline for these measures is provided in Control 8.11.
Pseudonymization or anonymization techniques make it possible to hide personal data, obscure the true data, and obscure cross-links of information. To implement this effectively, it is important to adequately address all relevant elements of sensitive information.
While anonymization changes the data irrevocably, in the case of pseudonymization it is quite possible to derive conclusions about a true identity via additional cross-information. Therefore, additional cross information should be kept separate and protected during the pseudonymization process.
Other techniques for data masking include:
- Encryption
- Zeros or deletion of characters
- Different numbers and dates
- Substitution - replacing one value with another to hide sensitive data
- Replacing values with their hash
![whitepaper-ISO 27001-faq-dqs-cover picture](https://www.dqsglobal.com/var/site/storage/images/_aliases/cw_large_1x/3/8/7/8/3578783-13-eng-GB/0493962620c2-whitepaper-iso-27001-faq-dqs-pdf.jpg.jpg)
Questions and answers to the new ISO 27001:2022
What you need to know about the "new kid on the block" for information security: 38 answers from our experts to 38 user questions.
- What are the new controls all about?
- When should we transition to the new standard?
- Where can I find a list of correspondences old vs. new?
- ... as well as 35 more!
When implementing these Technical Measures for Information Security, it is important to consider a number of aspects:
- Users should not have access to all data, but should only be able to view the data they really need.
- In some cases, not all data in a data set should be visible to users. In this case, data obfuscation procedures should be designed and implemented. Example: patient data in a medical record that should not be visible to all staff, but only to employees with specific roles relevant to treatment.
- In some cases, the obfuscation of data should not be apparent to those accessing the data (obfuscation of obfuscation) if, for example, conclusions can be drawn about the actual date via the data category (pregnancy, blood test, etc.).
- Legal or regulatory requirements, for example the requirement to mask payment card data during processing or storage.
In general, data masking, pseudonymization or anonymization require some general points:
- The strength of data masking, pseudonymization, or anonymization depends largely on the use of the processed data.
- Access to the processed data should be secured by appropriate protection mechanisms.
- Consideration of agreements or restrictions regarding the use of processed data.
- Prohibiting processed data from being matched with other information to identify the data subject.
- Securely track and control the provision and receipt of processed data.
Prevention of data leakage
Control 8.12 is designed to prevent data leakage and formulates specific measures to be applied to all systems, networks, and other devices that process, store, or transmit sensitive information. To minimize the leakage of sensitive data, organizations should consider the following:
- Identifying and classifying information, for example, personal data, pricing models, and product designs
- Monitoring the channels through which data can leak out, such as email, file transfers, mobile devices and mobile storage devices
- Measures that prevent data leakage, for example, quarantining emails containing sensitive information
In order to prevent data leaks in modern, complex IT structures with their multitude of different data, organizations also need appropriate tools to
- Identify and monitor sensitive information at risk of unauthorized disclosure, for example, in unstructured data on a user's system
- Detect disclosures of sensitive data, such as when data is uploaded to untrusted third-party cloud services or sent via email
- Block user actions or network transfers that expose critical information, such as preventing database entries from being copied to a spreadsheet
Organizations should critically question the need to restrict users' permissions to copy, paste, or upload data to services, devices, and storage media outside the organization. If necessary, it may also be necessary to implement appropriate tools to prevent data leakage or to configure existing technologies appropriately.
For example, users may be given permission to view and edit data remotely - but not permission to copy and paste it outside of your organization's control. If a data export is still required, the data owner can approve it as a case-by-case basis and hold users accountable for unwanted activity if necessary.
![informationssicherheitsvorfaelle-dqs-usb stick liegt auf tastatur](/var/site/storage/images/1/0/8/9/419801-1-ger-DE/informationssicherheitsvorfälle-dqs-shutterstock-1612117966.jpg)
Information security with a system
For more valuable knowledge about ISO/IEC 27001:2022, visit our product page.
The prevention of data leaks explicitly also applies to the protection of confidential information or trade secrets that may be misused for espionage purposes or may be of vital importance to the community. In this case, measures should also be designed to confuse attackers - for example, by substituting with false information, reverse social engineering, or using honey pots to lure attackers.
Data leaks can be supported by standard security controls, for example, via topic-specific policies for access control and secure document management (see also Measures/Controls 5.12 and 5.15).
Important when using monitoring tools
To protect their own information, many tools also inevitably monitor employee communications and online activities and third-party messages. This monitoring raises different legal issues that must be considered before using the appropriate monitoring tools. There is a need to balance the level of monitoring with a variety of privacy, data protection, employment, data interception and telecommunications legislation.
Technical measures in information security - a conclusion.
In the overall context of the information security protection goals of confidentiality integrity and availability, the data processing procedures described here play a key role in the enhanced protection of sensitive data.
With continuous monitoring of the flow of data and information, masking of sensitive information and strict data deletion policies, companies can sustainably improve their protection against data leakage and data loss - and counteract the unintentional publication of critical information. In addition, the procedures make a decisive contribution to company-wide cybersecurity and minimize the attack surface for hackers and industrial espionage.
For companies and organizations, it is now a matter of establishing the procedures and the required tools appropriately and integrating them into their business processes in order to demonstrate the standard-compliant implementation of the requirements in future certification audits.
With the professional view of our experienced auditors and our certification expertise of more than 35 years, we recommend ourselves as your contact for the topics of information security and certification according to ISO 27001.
What does the update mean for your certification?
ISO/IEC 27001:2022 was published on October 25, 2022. This results in the following deadlines and periods for transition for users:
Last date for initial and recertification audits according to the "old" ISO 27001:2013.
- After April 30, 2024, DQS will conduct initial and recertification audits only according to the new standard ISO/IEC 27001:2022
Conversion of all existing certificates according to the "old" ISO/IEC 27001:2013 to the new ISO/IEC 27001:2022
- There is a three-year transition period starting October 31, 2022
- Certificates issued according to ISO/IEC 27001:2013 or EN ISO/IEC 27001:2017 are valid until October 31, 2025 at the latest or have to be withdrawn on this date.
![fragen-antwort-dqs-fragezeichen auf wuerfeln aus holz auf tisch](https://www.dqsglobal.com/var/site/storage/images/_aliases/cw_large_1x/4/8/4/9/1209484-1-ger-DE/134d0a45daf3-dqs-fragen-antwort-shutterstock-1543162895-1-.jpg)
We'll be glad to answer your questions
Find out more. Without obligation and free of charge.
DQS: Your competent partner in questions of certified information security
Thanks to the transition periods, companies have enough time to adapt their information security management to the new requirements and have it certified. However, the duration and effort of the entire change process should not be underestimated - especially if you do not have sufficient specialized personnel at your disposal. If you want to be on the safe side, you should deal with the issue sooner rather than later and call on experienced specialists if necessary.
As audit and certification experts with over 35 years of expertise, we will be happy to support you during a delta audit. Find out from our numerous experienced auditors about the most important changes and their relevance for your organization. We look forward to hearing from you.
Trust and expertise
Our texts are written exclusively by our in-house management systems experts and long-time auditors. If you have any questions for the author, please feel free to contact us.
DQS Newsletter
Markus Jegelka
DQS expert for information security management systems (ISMS) and long-time auditor for the standards ISO 9001, ISO/IEC 27001 and IT security catalog according to para 11.1a of the German Energy Industry Act (EnWG)
![](https://www.dqsglobal.com/var/site/storage/images/_aliases/cw_large_1x/4/5/0/8/2478054-1-ger-DE/1bdc34087325-jegelka-markus-dqs-experte-informationssicherheit.jpg)