EDUCATION, TECHNOLOGY

⚙️ Technological security

Technological (technical) controls are security mechanisms built into technology that automatically implement security policies - authentication, encryption, segmentation, logging. Basically ISO/IEC 27002 Chapter 8 (34 controls), NIST SP 800-53 and CIS Controls v8.1. Examples are fictional, designed for training.

Legend: codes in brackets (e.g. 8.24) refers to the (technological) controls of Chapter 8 of ISO/IEC 27002:2022.

What are technical controls

Classification of controls - type and function

Classification of security controls Matrix: three types of controls (technical, administrative, physical) against three functions (preventive, detective, corrective), with a technical line highlighted. Classification of security controls Type (technical/administrative/physical) × function + dissuasive and compensatory Preventive Deceptive Corrective Technical (logical) MFA, encryption firewall, RBC segmentation IDS/IPS, SIEM magazines, FIM monitoring backups, patch insulation, rollback quarantine Administrative policies, training audit, accounts incident plan Physical locks, badge CCTV, alarm repair, renovation

Technical = logical controls: they are technology-based mechanisms that implement policies automatically and consistently (as opposed to administrative ones that rely on human action). This guide covers the technical controls of Chapter 8 of ISO/IEC 27002.

Functions

Preventive (prevented), detective (discovered), corrective (rejuvenating). In addition: dissuasive (abstains from attempted) and compensatory (alternative when basic control is not possible).

Defense in purity

Technical controls shall be placed in several layers - network, host, use, data, identity - so that the violation of the same layer does not reveal everything. See 'Multilayer protection' tab.

Relationship to the NIS2

The risk management measures of Article 21 of the NIS2 (EU 2022/2555) are largely technical controls: cryptography, access control, MFA, incident detection and business continuity.

Defense

Layers of technical controls - from network to data

Levels of technical controls Five layers of technical protection from network to data, with identity and monitoring as cross layers. Multi-layer protection (technical layers) Net/perimeter firewall, VPN, DDoS, IPS, 8.20/8.21 Segmentation VLAN, microsegmentation, NAC, 8.22 Host / terminal EDR, hardening, patch, 8.1/8.7/8.8 Application WAF, secure coding, SAST/DAST, 8.26/8.28 Data encryption, DLP, masking, backups, 8.24/8.12 Identity and access SAM, MFA PAM, RBC Zero Trust covers all layers 8.2, 8.3, 8.5

Journaling and monitoring (8.15/8.16) cover all layers - they shall ensure that the infringement is noted. Identity is a cross-layer: each layer must be checked who accesss (Zero Trust - never trust by location).

Why Layers

No single control is infallible. Independent layers mean that the attacker must overcome several layers (network, host, use, data) before he reaches the target.

The smallest privileges

Each layer is allocated only as necessary (lat pribilige, need-to-know). This limits how far an attacker can spread after a single layer of violation.

Accepts the infringement

The modern approach (size break) assumes that the perimeter will be violated. Therefore, important segmentation, monitoring and data encryption - so that the infringement is not detected all at once.

International practice

ISO/IEC 27002:2022 Chapter 8 - 34 technological controls

ISO 27002:2022 control topics Four ISO 27002:2022 control topics. Technological controls (Chapter 8, 34 controls) are highlighted. ISO/IEC 27002:2022 - 4 control topics Organisational chapter 5, 37 controls Staff chapter 6, 8 controls Physical chapter 7, 14 controls Technological chapter 8, 34 controls ← this section ISO 27001 Annex A.8 reflects these 34 controls, NIST SP 800-53 (AC/IA/SC/SI/AU/CM/CP), CIS Controls v8.1
8.1Endpoint
8.2Reserved access rights
8.3Limitation of access to information
8.4Access to source
8.5Safe authentication
8.6Capacity management
8.7Protection against malware
8.8Management of technical vulnerabilities
8.9Configuration management
8.10Deletion
8.11Data masking
8.12Data leakage prevention (DLP)
8.13Duplication of information
8.14Processor redundancy
8.15Journaling
8.16Monitoring of operations
8.17Clock Synchronization
8.18Use of preferential utility
8.19Software installation in systems
8.20Network security
8.21Network service security
8.22Network separation (segmentation)
8.23Web filtering
8.24Use of crypto
8.25Life cycle of safe development
8.26Application safety requirements
8.27Safe architecture and engineering
8.28Safe coding
8.29Safety testing in development
8.30Outsourcing
8.31Distinction of the senses (dev/test/prod)
8.32Management of changes
8.33Test information
8.34Protection during audit

NIST SP 800-53 flocks

Technical controls are mainly: AC (access control), IA (identity and authentication), SC (protection of systems and communications), SI (system and information integrity), AU (audit), CM (configuration), CP (continuousity).

CIS Controls v8.1

Practical implementation list: CIS 3 (data protection), 4 (secure configuration), 5.

NIS2 and national legislation

Article 21 of the NIS2 and national legislation require technical measures - cryptography, MFA, access control, vulnerability management, logging and backup - proportionate to the risk.

Compliance in Latvia - the main requirement is national laws and regulations: National laws and regulations are mandatory regulations in Latvia that determine what is mandatory (in the national cyber security framework, implementing NIS2). Implementing Regulation (EU) 2024/2690 and GDPR complement the requirements. International standards (ISO 27001/27002, COBIT, SABSA, TOGAF, NIST) provide a recognised auditable method for their implementation.

Levels of compliance - from EU law to implementation Three layers: EU legal basis (NIS2, Implementing Regulation 2024/2690, GDPR), national legislation and international enforcement standards (ISO, COBIT, SABSA, TOGAF, NIST). From requirement to implementation: law defines KO, standards - VU EU LEGAL BASIS NIS2 Directive (EU) 2022/2555 Implementing Regulation (EU) 2024/2690 DGPR (EU) 2016/679 transposed nationally National Cybersecurity Law and its subordinates WHAT to do is mandatory, national cybersecurity legal framework introduced by recognised standards INTERNATIONAL IMPLEMENTATION STANDARDS - HOW ISO 27001 / 27002 COBIT SABSA TOGAF NIST CSF / 800-53

Regulatory acts shall determine the result to be achieved. The international standard is a verifiable way to achieve it - without it compliance remains declarative.

Regulatory acts - mandatory requirement

The binding regulation in Latvia establishes mandatory technical measures. The implementation is based on Chapter 8 of ISO 27002, NIST SP 800-53 and CIS Controls v8.1 giving a specific, measurable configuration which regulatory acts require as a result.

Implementing Regulation (EU) 2024/2690

The Annex details the technological requirements: cryptography, access control, secure system purchase/development/maintenance and asset management - direct ISO 27002 Chapter 8 controls.

Article 32 COD

GDPR requires 'appropriate technical measures' for the security of personal data - encryption, pseudonymisation, confidentiality, integrity and robustness. Technological controls (8.24, 8.11) are direct implementation.

SAM - ISO 8.2 / 8.3 / 8.5

Identity and access - authentication, authorisation, record keeping

AAA - Authentication, Authorisation, Accounting User undergoes authentication, then authorization, until the resource. Recording jurnalls the entire flow. AAA - Authentication, Authorisation, Accounting User/ Device identity Authentication - Who are you FIDO2, Passkey, 8.5 Authorization - RBC/ABAC least privatege, 8.3 Resource data, API Accounting which, by, when - logging (8.15), irrevocability

Zero Trust: never trust for network location - each request is authenticated and rewritten (NIST SP 800-207). MFA against stolen passwords. The least privilege to the excess of rights.

Safe authentication (8.5)

Multifactor authentication (MFA), preferably phishing-resistant (FIDO2/WebAuthn, passkey). Passwords - long, checked against leaks, stored as Argon2/bcrypt mixing amounts.

Priority access (8.2 / CVT)

Administrative rights separately: just-in-time allocation, session recording, separate admin accounts, vault secrets. Excessive privileges are the main route of spreading.

Access limitation (8.3)

Need-to-know and let privatege: the user sees only what he needs. Roles (RBAC) or attributes (ABAC), regular access review, and access withdrawn immediately when changing the role.

ISO 8.24 / 8.11 / 8.12

Cryptography and data protection - three data states

Three states of data and cryptography Data at rest, transmission and use, each with appropriate cryptographic control. Key management below all. Three states of data and their protection Steady state (at rest) disk / DB encryption AES-266, PDE key KMS / HSM Transmission (in transit) TLS 1.3, mTLS VPN, IPsec certificates, HSTS In use (in use) confidential computing enclaves, masking tokenisation Key Management generation, rotation, recall, secure storage (HSM) - without it encryption is only apparent

Cryptography (8.24) protects confidentiality and integrity, but is as strong as key management. Used tested algorithms and protocols (AES, TLS 1.3), not invented.

Data leakage prevention (8.12 / DLP)

DLP detects and blocks the output of sensitive data (email, USB, cloud). Combined with classification and labelling to know what to protect.

Masquerade and deletion (8.11 / 8.10)

Data masking and tokenisation reduces exposure in non-production environments. The Safe Deletion Policy shall ensure that data are permanently removed when no longer required.

Duplication and durability (8.13 / 8.14)

Duplicates on the 3--2-1 principle (3 copies, 2 carriers, 1 off-site), encrypted and tested with renewal tests. Redundance critical systems shall be made available.

ISO 8.7 / 8.8 / 8.9 / 8.16

Hardening, vulnerability management and monitoring

Management cycle of injury Continuous cycle - discover, prioritise, prevent, check - with return to the beginning. Management cycle of injury (8.8) 1. Discover scanning, equipment 2. Prioritise CVSS, KEV, risk 3. Prevent patch, configuration 4. Check re-scaning continuous cycle - new vulnerabilities appear constantly Hardening - Foundations secure base configuration (CIS Benchmark), read functionality, malware protection (8.7) web filtering (8.23), change management (8.32), default password change

Monitoring (8.15 / 8.16): centralized logging → SIEM → correlation → warning → response. Without monitoring, other controls work blindly. Synchronize time (NTP, 8.17), otherwise events cannot be correctly correlated.

Configuration management (8.9)

Safe base configuration (hardening by CIS Benchmark), version control, deviation detection and change management. Default settings are rarely safe.

Protection against malware (8.7)

EDR/AV, application authorisation lists, email and web filtering, macro restrictions. In combination with user training and backups against ejectors.

Journaling and SIEM (8.15 / 8.16)

Windows are collected centrally and outside the host to be checked, kept append-only and long enough to investigate the incident (in practice at least 12 months - the NIS2 does not specify a specific deadline). For more details, see the guide'Jurnalfail (windows) analysis'.

Abbreviations

Abbreviations used in the Roadmap: the original name and what it means.

IAM / PAM
Identity and Access Management / Privileged Access Management - identity and access management/preferential account management.
AAA
Authentication, Authorization, Accounting - authentication, authorisation, inventory.
RBAC / ABAC
Role- / Attribute-Based Access Control - access by role / by attributes.
MFA / FIDO2 / WebAuthn
Multifactor authentication/Phishing-resistant key standards.
NAC
Network Access Control - to connect to the network only tested devices.
VLAN
Virtual LAN - logically separated network segment.
IDS / IPS
Intrusion Detection / Prevention System - intrusion detection/blocking.
WAF
Web Application Firewall - a firewall for web applications.
DDoS
Distributed Denial of Service - failure of the service from many sources at the same time.
EDR
Endpoint Detection and Response - computer monitoring and response.
FIM
File Integrity Monitoring - warns about changes in important files.
DLP
Data Loss Prevention - stop the leakage of sensitive data.
FDE
Full Disk Encryption - full disc encryption.
HSM / KMS
Hardware Security Module / Key Management Service - hardware for keys / key management service.
HSTS
HTTP Strict Transport Security - forces the browser to open the site only via HTTPS.
SIEM
Security Information and Event Management - central analysis of magazines.
SAST / DAST
Static / Dynamic Application Security Testing - code check without launch/operational application check.
CVSS / KEV
The severity scale of the injury / CISA already used vulnerability catalogue.
NTP
Network Time Protocol - timing.
AC / IA / SC / SI / AU / CM / CP
NIST SP 800-53 control families: access, identity, system protection, integrity, audit, configuration, continuity.