A.8.20 Technological
Networks security
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (13)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-4mostlyaligns with — Both enforce information flow controls through network segmentation, protocol restrictions, and filtering to prevent unauthorized data movement between systems.
- SC-7mostlycovers — Both controls establish boundary protection mechanisms such as firewalls, connection filtering, and device authentication to safeguard network traffic and connected systems.
- SC-8mostlyaligns with — Both require cryptographic and other controls to protect the confidentiality and integrity of data transmitted over networks, including public and wireless segments.
- AU-2partialaligns with — Both mandate logging and monitoring of network activities to detect actions that could impact information security.
- CM-6partialaligns with — Both require hardening of network devices and consistent application of secure configuration settings across the infrastructure.
- SC-32partialaligns with — Both promote partitioning and logical separation of networks, including virtualized environments, to isolate critical components and limit exposure.
Aligned NIST CSF 2.0 outcomes (12)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- DE.CM-01mostlyaligns with — Mandating logging, monitoring, and detection of actions affecting network security aligns with the CSF outcome of monitoring networks and network services to identify potentially adverse events.
- PR.IR-01mostlycovers — The ISO control's emphasis on network segmentation, connection filtering, device authentication, and protocol hardening directly implements the CSF outcome of protecting networks and environments from unauthorized logical access.
- PR.PS-01mostlyaligns with — Requiring up-to-date network diagrams, configuration files, and hardening of network devices aligns with the CSF outcome of establishing and applying configuration management practices.
- ID.AM-03partialaligns with — Maintaining current network diagrams and configuration files contributes to the CSF outcome of documenting authorized network communication and data flows.
- PR.AA-03partialaligns with — The requirement to authenticate systems on the network and restrict device connections supports the CSF outcome of authenticating users, services, and hardware.
- PR.PS-05partialaligns with — Filtering and restricting systems that can connect to the network aligns with the CSF outcome of preventing installation and execution of unauthorized software.
Related OWASP ASVS 5.0 requirements (13)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V12.3.1mostlyaligns with — The ISO control's requirement to encrypt traffic over public, third-party, and wireless networks directly supports the ASVS mandate that all inbound and outbound connections use an encrypted protocol such as TLS.
- V12.3.3mostlyaligns with — Both the ISO guidance on safeguarding data over networks and the ASVS requirement for TLS between internal HTTP-based services address the need to protect service-to-service communication with encryption.
- V13.2.4partialaligns with — The ISO directive to restrict and filter systems connecting to the network (via firewalls) aligns with the ASVS requirement to use an allowlist for defining permitted external resources and systems.
- V13.2.5partialaligns with — The ISO control's emphasis on restricting network connections and hardening devices corresponds to the ASVS requirement that the web or application server be configured with an allowlist of resources it can reach.
- V13.4.3partialaligns with — The ISO guidance on hardening network devices and disabling vulnerable protocols supports the ASVS requirement to prevent web servers from exposing directory listings unless explicitly intended.
- V4.1.4partialaligns with — The ISO control's call to restrict and filter network connections aligns with the ASVS requirement that only explicitly supported HTTP methods are permitted by the application or its API.
Related weaknesses / CWE (108)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1088←PCWE-1125←P →PCWE-1312←PCWE-1323←P →PCWE-1327←P →PCWE-1334→PCWE-1385←PCWE-200→PCWE-204←P →PCWE-284→PCWE-288→PCWE-290←P →PCWE-291←P →PCWE-294←P →PCWE-297←PCWE-300←P →PCWE-322→PCWE-345→PCWE-346←P →PCWE-348←PCWE-350←P →PCWE-353←P →PCWE-360←P →PCWE-385→PCWE-40←PCWE-400→PCWE-402→PCWE-406←P →PCWE-412→PCWE-419←P →MCWE-420←P →PCWE-421←P →PCWE-424→PCWE-437←PCWE-441←PCWE-444←PCWE-5←P →MCWE-509→PCWE-514←PCWE-515←PCWE-523→PCWE-548←PCWE-553→PCWE-598←PCWE-605←P →PCWE-669←P →PCWE-673←PCWE-693→PCWE-706←PCWE-799→PCWE-830←PCWE-862→PCWE-923←P →PCWE-924←P →MCWE-927←PCWE-940←PCWE-941←PCWE-942←P
Why these map — AI rationale (under review)
- CWE-419mostlyprevents — Network security measures can help isolate or protect the primary channel.
- CWE-5mostlyprevents — Mandates network security controls including encryption of traffic to prevent interception.
- CWE-924mostlyprevents — Mandates network security controls that can enforce message integrity on channels.
- CWE-1125partialmitigates — Network security controls (firewalls, segmentation, hardening) shrink the externally reachable attack surface.
- CWE-1323partialprevents — Network-security measures protect trace data in transit to external agents.
- CWE-1327partialmitigates — Network security controls directly require restricting listening interfaces to specific addresses rather than 0.0.0.0.
- CWE-1334partialprevents — Network segmentation can hinder remote injection paths into hardware redundancy controllers.
- CWE-200partialprevents — Encryption and integrity controls on traffic traversing public or wireless networks reduce the chance that sensitive data is disclosed to eavesdroppers.
- CWE-204partialmitigates — Network security controls can enforce uniform responses and suppress observable discrepancies.
- CWE-284partialmitigates — Network-level connection filtering, device authentication, and administrative-channel segregation directly block unauthorized actors from reaching resources they should not access.
- CWE-288partialmitigates — Network security can limit exposure of alternate channels but does not address authentication logic itself.
- CWE-290partialmitigates — Network security can limit spoofing vectors but does not address application-level authentication.
- CWE-291partialmitigates — Network-security measures can enforce authenticated access rather than IP-based trust.
- CWE-294partialmitigates — Network security controls such as encryption and integrity protection reduce the feasibility of capturing and replaying authentication traffic.
- CWE-300partialmitigates — Network security controls directly address channel integrity and endpoint authentication.
- CWE-322partialmitigates — Network security policies can require authenticated channels, indirectly reducing the risk of unauthenticated key exchange.
- CWE-345partialmitigates — Network controls can enforce authenticated channels, reducing risk of accepting unauthentic data.
- CWE-346partialmitigates — Network security controls enforce origin validation at network boundaries.
- CWE-350partialmitigates — Network security controls can enforce authenticated, non-DNS-based host identification.
- CWE-353partialmitigates — Network security controls can mandate integrity mechanisms on transmission protocols.
- CWE-360partialmitigates — Network security controls can limit spoofing vectors but do not fully address trust in system event data.
- CWE-385partialmitigates — Network segmentation reduces attack surface but does not address intra-process timing channels.
- CWE-400partialprevents — Ability to isolate critical segments and apply traffic filtering limits an attacker’s capacity to consume network resources or cause denial-of-service conditions.
- CWE-402partialmitigates — Network-security controls can limit exposure paths but do not address the root resource-leak logic.
- CWE-406partialmitigates — Network security controls include traffic filtering and rate-limiting that prevent amplification attacks.
- CWE-412partialmitigates — Network security measures can block external access paths to locks but do not address the design flaw itself.
- CWE-420partialmitigates — Network security controls ensure all channels receive equivalent protection, directly addressing unprotected alternate channels.
- CWE-421partialmitigates — Network segmentation and hardening reduce the exposure of alternate channels to unauthorized actors.
- CWE-424partialmitigates — Network security can limit some alternate paths but is not the primary control for application-level path protection.
- CWE-509partialmitigates — Network security controls limit lateral movement and replication of worms.
- CWE-523partialprevents — Requires network security controls that can protect credential transmission.
- CWE-553partialmitigates — Network controls can limit exposure of the directory but do not address the presence of the shell itself.
- CWE-605partialmitigates — Network security controls can enforce exclusive port binding and service registration policies.
- CWE-669partialmitigates — Network-security controls can block improper cross-sphere transfers.
- CWE-693partialmitigates — Hardening devices, disabling vulnerable protocols, and maintaining accurate network diagrams reduce the likelihood that a protection mechanism is misconfigured or left in a weak state.
- CWE-799partialmitigates — Network security controls can enforce rate limiting and throttling at the perimeter.
- CWE-862partialmitigates — Requiring authentication of systems and restricting which devices may join the network prevents missing-authorization flaws from being exploitable across network boundaries.
- CWE-923partialmitigates — Network security controls directly enforce endpoint validation and channel restrictions.
- CWE-1088nonenone — Network security controls can include connection-timeout policies, yet the weakness is a coding-level omission.
- CWE-1189nonenone — Network security controls can limit external access to SoC resources but do not enforce hardware-level isolation.
- CWE-1299nonenone — Network security controls can limit exposure of alternate hardware interfaces but do not address internal hardware-level bypasses.
- CWE-1312nonenone — Network security controls can mandate firewall rules that cover mirrored MMIO regions, but do not guarantee hardware-level mirror protection.
- CWE-1385nonenone — Network security controls can enforce origin validation and restrict WebSocket connections to trusted sources.
- CWE-207nonenone — Network security controls can hide behavioral differences that reveal product identity.
- CWE-296nonemitigates — Network security controls often enforce TLS certificate validation.
- CWE-297nonenone — Network security controls include certificate validation and host-name verification to prevent man-in-the-middle attacks.
- CWE-299nonenone — Network security controls can enforce certificate validation at network boundaries.
- CWE-348nonenone — Network security controls can enforce trusted data paths and source validation, reducing reliance on unverified inputs.
- CWE-354nonenone — Network security policies may require integrity protection on transit data, indirectly addressing the weakness.
- CWE-40nonenone — Network security controls can block or filter UNC paths that traverse outside approved shares.
- CWE-437nonenone — Network security controls can enforce endpoint capability discovery and validation, reducing the risk of acting on an incomplete model.
- CWE-441nonemitigates — Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.
- CWE-444nonenone — Network security controls can enforce consistent HTTP parsing and proxy behavior that mitigates request smuggling.
- CWE-488nonenone — Network segmentation reduces the attack surface but does not address session-state isolation inside an application.
- CWE-514nonenone — Network segmentation and traffic-flow rules can block many covert-channel paths, but do not address storage or timing channels inside a single process.
- CWE-515nonemitigates — Network controls can limit covert storage across networks but not within a single system.
- CWE-548nonenone — Network security measures such as disabling directory indexing on web servers reduce exposure of directory contents.
- CWE-598nonenone — Network security controls can enforce HTTPS and block sensitive data in URLs.
- CWE-610nonenone — Network security controls can block or monitor external references but do not address the root cause in application logic.
- CWE-673noneprevents — Network security controls limit external reach into systems that define control spheres.
- CWE-706nonenone — Network segmentation and routing policies reduce the chance that a mis-resolved name leads to an unintended external resource.
- CWE-757nonenone — Requires secure network protocols and configurations that can enforce stronger algorithm choices.
- CWE-830nonenone — Network security controls can restrict or block untrusted external web content, but do not specifically address inclusion of web widgets.
- CWE-927nonenone — Network security rules can restrict inter-app communication channels that implicit intents rely on.
- CWE-940nonemitigates — Network security controls enforce source verification and channel authentication for incoming communications.
- CWE-941nonenone — Network security controls enforce correct endpoint validation and routing, directly preventing mis-specified destinations.
- CWE-942nonenone — Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.
Mitigated MITRE ATT&CK techniques (10)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1021partialprevents — Network segmentation, connection filtering, and device authentication limit an adversary's ability to discover and directly interact with remote services for lateral movement.
- T1046partialmitigates — Firewalls, connection filtering, and network segregation constrain the scope of service discovery an adversary can perform from compromised hosts.
- T1078partialmitigates — Requiring authentication of systems on the network and restricting unauthorized device connections reduces the effectiveness of using stolen or default credentials to blend in as legitimate network entities.
- T1090partialmitigates — Hardening network devices, disabling vulnerable protocols, and segregating administrative channels reduce opportunities to establish or abuse proxy channels for command and control.
- T1095partialmitigates — Disabling vulnerable or non-approved network protocols and enforcing traffic controls reduce opportunities for adversaries to tunnel C2 traffic through non-application-layer protocols.
- T1190partialmitigates — Hardening network devices, disabling vulnerable protocols, and applying connection restrictions shrink the attack surface that adversaries can exploit on publicly reachable network services.
- T1210partialprevents — Network segmentation, device hardening, and protocol restrictions limit opportunities to exploit remote services for lateral movement.
- T1570partialmitigates — Network-level filtering, device authentication, and isolation controls impede the transfer of tools between compromised hosts.
- T1571partialmitigates — Network traffic filtering and protocol restrictions make it harder for adversaries to establish command-and-control channels over non-standard ports that deviate from approved configurations.
- T1018nonemitigates — Segregating networks and restricting device connections limit an adversary's capacity to enumerate remote systems and map the environment.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A02mostlyprevents — Network device hardening, disabling vulnerable protocols, and maintaining accurate configuration documentation directly reduce the chance that network components are deployed or left in an insecure state.
- A01partialprevents — Network segmentation, connection filtering, and authentication of systems on the network limit the ability of an attacker who reaches one segment to move laterally or access resources they are not authorized to reach.
- A04partialprevents — Requiring confidentiality and integrity protections for traffic crossing public or wireless networks drives the use of encryption and secure protocols, reducing exposure of sensitive data in transit.
- A09nonemitigates — Explicit requirements for logging and monitoring of network activity provide the visibility needed to detect and respond to security-relevant events that would otherwise go unnoticed.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.