ISO 27001 Secure Configuration Baseline Template

Introduction

With the growth of the digital age, the need for information security is becoming increasingly important. Organizations around the globe are taking steps to ensure that information security is prioritized and ISO 27001 compliant. One of the key steps towards achieving ISO 27001 compliance is developing and maintaining a secure configuration baseline. In this guide, we will learn about the concept of ISO 27001 secure configuration baseline template, why it is needed, and how we can develop and implement it to ensure the security of our organization and meet ISO 27001 standards.

Why Do We Need Secure Configuration in ISO 27001?

Secure configuration is the process of hardening the information system to ensure that it is protected against external and internal threats. For organizations that are ISO 27001 compliant or considering becoming one, secure configuration is a required practice.

ISO 27001 Controls That Require Secure Configuration

Annex A of ISO 27001 standard specifies controls that are needed to be followed by organizations to ensure information security. Some of these controls require developing a secure configuration baseline. For example, control A.8.28 (previously A.12.5.1) requires that “information systems are configured in a secure manner.” This control specifies that the security aspects of operating systems, applications and network devices are appropriately configured to avoid breaches of confidentiality, integrity, and availability. Apart from this control, secure configuration practices are embedded in other controls relating to access control, cryptography, operation security, and vulnerability management.

Vulnerabilities and Risks

Most systems and applications come with default configurations that prioritize functionality and convenience over security. Default configurations often leave systems open to attacks and compromise the security of the network, data, and other assets. With the help of secure configuration baseline, we can eliminate the vulnerabilities and attack surfaces introduced by default configurations. Apart from protecting the organization against cyber threats, secure configuration helps fulfill other objectives of ISO 27001 such as ensuring the confidentiality, integrity, and availability of the information.

What is ISO 27001 Secure Configuration Baseline?

ISO 27001 secure configuration baseline can be defined as a set of standardized security-related configurations that apply to a particular category of information system, application or device within an organization. The baseline is used as a standard for hardening information systems and serving as a reference point for configuration. Developing a secure configuration baseline enables an organization to demonstrate conformity with the requirements of ISO 27001.

The main reasons for developing a secure configuration baseline are given below:

• It ensures consistent and standardized configuration of information systems

• It integrates and embeds security considerations in the organization’s IT systems

• It reduces the attack surface of the IT systems

• It ensures there is sufficient evidence to demonstrate the conformity with ISO 27001

Secure Configuration Baseline Template

Scope and Assets Covered by the Baseline

The first step in developing a secure configuration baseline is to specify the scope and the assets that the baseline will cover. The baseline can cover a variety of systems, applications, or devices depending on the needs of the organization. The systems and devices covered by the baseline should be specified in the baseline document. It is also recommended to relate the baseline to the organization’s asset inventory.

The following are examples of systems, applications, or devices that can be covered by the baseline:

• Operating systems (Windows, Linux etc.)

• Workstations (desktops, laptops)

• Network devices (routers, switches, firewalls)

• Database systems (SQL, Oracle, MongoDB etc.)

• Web applications and application servers

• Cloud services and infrastructure

Categories of Configuration to be Specified in the Baseline

After defining the scope of the baseline, the next step is to identify the categories of configuration to be covered by the baseline. Different categories of configurations will apply depending on the type of technology or device. The categories of configuration should be specified in the baseline document to help with standardization and conformity.

Examples of categories of configuration are given below:

Operating system hardening

• Patch management (Requirements for applying patches)

• Disabling unnecessary services and features

• Setting strong password policies and account lockout policies

• Permission and directory security (Setting least privilege)

• Audit policies (Events to be audited, retention of audit logs)

• Host-based firewall configuration

• Antivirus and anti-malware software

Network device configuration

• Disabling unnecessary ports and services

• Configuring secure network management (SSH, HTTPS etc.)

• Securing administrative access (Authentication, authorization)

• Access control lists (ACLs)

• Network segmentation

• Logging and monitoring

Application security

• Disabling default credentials

• Disabling unnecessary modules or features

• Securing session management

• Input validation

• Logging and monitoring

• Patching and updates

Other categories of configuration that can be included in the baseline are:

• Database security

• User account and authentication security

• Logging and monitoring system

Particular Requirements and Specifications

A secure configuration baseline document should also include the particular requirements and specifications that need to be followed when configuring the systems. The particular specifications and requirements can either be given as particular settings or ranges of values.

Examples of the particular requirements and specifications are given below:

• Minimum password length: 12

• Password complexity requirements: Uppercase, lowercase, numeric, symbols

• SSH protocol version: 2

• Inactive user session timeout: 15 minutes

• Session lock requirements: After 3 failed login attempts

Approvals, Reviews, and Enforcement

The baseline document should also specify the approval, review, and enforcement process of the baseline. The following are the items that need to be specified in this section:

• Approval: Who approves the baseline? (The Security Officer might approve the baseline)

• Review: How often is the baseline reviewed? (The baseline might be reviewed every year)

• Enforcement mechanism: How will the baseline be enforced? (Using Group Policy objects, scripts or configuration management tools)

Monitoring, Deviance, Documentation, and Version Control

The baseline document should specify monitoring requirements, procedure for managing deviations from the baseline, documentation and version control.

Examples:

• Monitoring procedure: Deviations from the baseline will be monitored using X software.

• Deviation procedure: Any deviation from the baseline should be reported to the security team for investigation.

• Documentation procedure: The baseline will be documented according to the documentation standard X and will be version controlled.

How to Develop an ISO 27001 Secure Configuration Baseline?

Below are the steps that can be taken in developing a secure configuration baseline.

1. Defining the Scope of the Baseline and Asset Inventory

The first step is to define the scope of the baseline and identify the information assets that the baseline will apply to. The scope of the baseline should be aligned with the information security management system (ISMS). The assets should be categorized according to their types (Operating systems, network devices, workstations etc.)

2. Identifying Industry Best Practices and Standards

The second step is to identify industry best practices, standards, and guidelines for secure configuration. The following are some of the resources from which industry practices and standards can be adopted:

• CIS benchmarks (Center for Internet Security)

• NIST special publications

• Vendor-specific hardening guides

• OWASP Top 10

3. Customizing the Baseline According to Organizational Requirements

The third step is to customize the baseline according to the organizational requirements. It is important to understand the unique requirements of the organization and modify the baseline to meet those requirements. The customization step helps address organizational-specific risks that may not be covered in the general industry practices.

4. Finalizing the Document Using the ISO 27001 Secure Configuration Baseline Template

The fourth step is to finalize the document using the baseline template provided above.

5. Implementing the Secure Configurations

The next step is to implement the secure configurations in the systems covered by the baseline.

6. Automating and Formalizing the Configuration Management Process

The sixth step is to automate and formalize the configuration management process. Automation helps ensure that configurations are consistently applied and helps reduce the possibility of human errors. Tools such as Group Policy, SCCM, Ansible, Chef and Puppet can be used to automate the configuration management process.

7. Monitoring the Baseline Performance and Compliance

The seventh step is to monitor the baseline performance and compliance. Monitoring will help ensure that the baseline is working as intended and that the systems covered by the baseline conform to the baseline. Tools such as configuration compliance tools and vulnerability scanners can be used to monitor the performance of the baseline.

8. Reviewing and Updating the Baseline Periodically

The last step is to periodically review and update the baseline. The baseline update schedule should be clearly specified in the baseline document. The baseline should be updated to reflect changes in the IT systems covered by the baseline.

The implementation of secure configuration baseline provides several benefits to the organization. Below are some of the benefits of having a secure configuration baseline.

• Helps demonstrate ISO 27001 compliance

• Improves the organization’s security posture

• Helps the organization meet the requirements of other standards

• Helps the organization prepare for audits

The implementation of secure configuration baseline can pose some challenges to the organization. Some of the challenges of implementing secure configuration baseline are discussed below.

Challenges of Implementing Secure Configuration Baseline

• The complexity of the baseline management process can be overwhelming

• The baseline might conflict with the organization’s operational or business requirements

• There might be resource constraints to implement the baseline

Strategic Recommendations on the Implementation of the Secure Configuration Baseline

• Automate as much as possible

• Formalize the change management process

• Formalize the deployment of the system images

• Prioritize assets based on the level of risk they expose to the organization

• Clarify ownership of baseline development, implementation, and maintenance

• Provide training to the IT staff on secure configuration and baseline implementation

• Continuously review and test the baseline

Final Thoughts

Developing and implementing an ISO 27001 secure configuration baseline plays a significant role in ensuring information security within an organization. Having a secure configuration baseline enables an organization to demonstrate ISO 27001 compliance and reduce the risks and vulnerabilities that may exist due to the presence of default configurations. The guide above can be used as a baseline for developing an ISO 27001 secure configuration baseline template for an organization.