Keeping Your Network From Becoming the Front Door to Everything
ISO 27001 Control 8.20 Network security is about making sure that your networks – and everything connected to them – aren’t an easy route into your systems and data.
In practice, that means:
- Designing your networks deliberately (not “it just grew like that”)
- Controlling which systems can talk to which, and how
- Hardening and monitoring routers, switches, firewalls, VPNs and cloud networks
- Encrypting traffic where it matters
- Detecting and responding when something odd happens
If you ever find yourself thinking “how did that system even talk to that?” – this is the control that should prevent that.
What ISO 27001 Control 8.20 Is Really About
In plain English, ISO 27001 Control 8.20 – Network security expects you to:
- Design and manage your networks so that:
- Only authorised devices, users and services can connect
- Only authorised traffic can flow between network segments
- Sensitive systems are isolated and better protected
- Protect and manage network devices (firewalls, routers, switches, VPN concentrators, gateways, WAFs, etc.)
- Use encryption and secure protocols for traffic over untrusted networks (internet, partner networks, public Wi-Fi, etc.)
- Monitor network activity so you can spot, investigate and respond to suspicious behaviour
It ties directly into other controls such as:
- 5.15 Access control
- 8.15 Logging
- 8.16 Monitoring activities
- 8.23 Web filtering and 8.24 Use of cryptography (depending how you map your content)
Step 1 – Design and Document Your Network Security Model
Start by being explicit about how your networks are supposed to work.
For ISO 27001 Control 8.20, you should:
- Define network zones
Typical examples:- Internal user network(s)
- Server / data centre networks
- DMZs / perimeter zones
- Management networks
- Partner / guest / contractor networks
- Cloud VPCs / VNets and their subnets
- Describe allowed data flows
- Which zones can talk to which?
- On which ports and protocols?
- For what purpose (e.g. web app → database, API → identity provider)?
- Align to access control principles
- Apply least privilege to network flows as well as user access.
- “Default deny, allow by exception” should be your basic stance.
- Document it
- Keep simple diagrams and a short written standard.
- This becomes your reference point for firewall rules, VPNs and security reviews.
If you don’t define the intended design, firewall rules and cloud security groups tend to turn into a pile of “temporary” exceptions that never went away.
Step 2 – Harden and Manage Network Devices Properly
Routers, switches, firewalls and wireless access points are security-sensitive systems and should be treated that way.
For ISO 27001 Control 8.20, make sure you:
- Baseline and harden devices
- Change default passwords and disable default accounts.
- Turn off unneeded services (e.g. legacy management protocols, unused VPN types).
- Restrict management access to specific admin networks / VPNs.
- Keep firmware and software updated
- Track vendor advisories for firewalls, VPNs, wireless controllers, SD-WAN devices etc.
- Build them into your normal patch/change processes.
- Control admin access
- Use named accounts (not shared “admin”) for network management.
- Enforce multi-factor authentication where supported.
- Log all configuration changes (and ideally send them to a central log/SIEM).
- Back up configurations
- Regular, secure backups of device configs.
- Version control where possible, so you can see what changed and when.
- Separate management traffic
- Use dedicated management interfaces / VLANs.
- Don’t expose management consoles directly to the internet.
The idea: network devices should be predictable, auditable and resilient, not “black boxes that only one person understands”.
Step 3 – Segment Your Network and Reduce the Blast Radius
Flat networks are easy to build and hard to secure.
Under ISO 27001 Control 8.20, you should introduce sensible segmentation, for example:
- Use VLANs and security groups to separate:
- User networks from server networks
- Front-end web tiers from application and database tiers
- Production from test/dev
- Internal systems from guest / contractor / IoT / printer networks
- Enforce access with firewalls / ACLs
- Place filtering controls at the boundaries between segments.
- Permit only required ports and protocols in each direction.
- Make “any–any” rules the exception, not the rule – and time-limited if they exist.
- Protect critical systems in tighter zones
- Payment systems, identity providers, domain controllers, security tooling, OT/ICS, and sensitive databases should sit in more restricted network segments.
- Consider micro-segmentation where appropriate
- In virtualised or containerised environments, use security groups, host firewalls or SDN features to limit lateral movement between workloads.
Segmentation doesn’t have to be perfect from day one. Start with the highest-risk and highest-value systems and work outwards.
Step 4 – Secure Access To the Network (On-Site and Remote)
It’s not just about traffic inside the network; it’s also who you let onto it in the first place.
For ISO 27001 Control 8.20:
- Implement secure remote access
- Use VPNs with strong encryption and MFA.
- Restrict which internal systems are reachable via VPN (not “full internal access by default”).
- Use Network Access Control (NAC) where feasible
- Check device posture before granting full access (e.g. AV running, OS supported, disk encryption enabled).
- Enforce different access levels for corporate devices, BYOD and unknown devices.
- Control wireless access
- Use strong Wi-Fi security (e.g. WPA2-Enterprise / WPA3 with per-user credentials).
- Separate guest Wi-Fi from internal networks and route guest traffic directly to the internet where possible.
- Block or contain unauthorised devices
- Consider port security on switches and MAC-based controls where appropriate.
- At the very least, have a way to spot and investigate unexpected devices.
- Apply zero-trust principles gradually
- Don’t assume a device is “trusted” just because it’s on the internal network.
- Combine network controls with identity, device health and application-level checks.
The goal is that connecting to your network is controlled and conditional, not simply “anyone in the building can plug in”.
Step 5 – Monitor Network Activity and Respond to Problems
Network security is not just a design exercise – it’s an ongoing activity.
To support ISO 27001 Control 8.20 (and link to 8.15/8.16):
- Log key network events
- Firewall accept/deny events
- VPN logins and failures
- Admin access to network devices
- IDS/IPS alerts and DNS security events
- Use security monitoring tools
- IDS/IPS and/or next-generation firewall features for detecting exploitation attempts and malware traffic.
- A SIEM or log platform to correlate network events with endpoint, identity and application logs.
- Watch for anomalies
- Unusual outbound connections (e.g. to risky geographies or known bad IPs).
- Sudden spikes in traffic, port scans, or repeated blocked connections.
- New or rogue services appearing on the network.
- Tie into incident response
- Have playbooks for network-related incidents (e.g. suspected ransomware, DDoS, data exfiltration).
- Be ready to block traffic, isolate segments or cut off specific connections quickly.
You don’t have to build a massive SOC on day one, but you do need basic visibility and the ability to act.
Step 6 – Extend Network Security to Cloud and Hybrid Environments
Most organisations now have a mixture of on-premise and cloud networks. ISO 27001 Control 8.20 covers those too.
Good practice:
- Treat cloud virtual networks as part of your overall design
- Define how your VPCs/VNets/subnets map to your existing zones (e.g. “this subnet is effectively our DMZ”).
- Use cloud-native firewalls, security groups and network ACLs to enforce the same principles.
- Secure connectivity between on-prem and cloud
- Use secure site-to-site VPNs or private connections.
- Control which internal systems can talk to which cloud services, and vice versa.
- Apply the same hardening to cloud network components
- Lock down cloud VPN gateways, load balancers and firewalls.
- Protect cloud management planes with strong identity and MFA.
- Monitor cloud network logs
- Enable and collect flow logs and firewall logs from cloud environments.
- Feed them into your central monitoring for correlation.
Cloud doesn’t remove the need for network security – it just changes where you do the configuration.
Step 7 – Governance, Documentation and Auditability
For ISO 27001, you also need to be able to show how network security is controlled.
You’ll want:
- A short, clear network security standard
- How you segment networks
- What you require for firewalls, VPNs, Wi-Fi etc.
- Encryption expectations for traffic over untrusted networks
- Current diagrams and inventories
- High-level network diagrams (including cloud)
- Lists of key network devices and virtual network components
- Evidence of operation
- Firewall and VPN config snippets / screenshots
- Change tickets for network rule changes
- Monitoring dashboards and example alerts
- Periodic review
- Regular checks of firewall rules and network ACLs against your intended design.
- Clean-up of obsolete rules and test connections.
This is what lets you confidently answer an auditor who asks, “How do you meet ISO 27001 Control 8.20 – Network security?”
Quick Implementation Checklist for ISO 27001 Control 8.20
You’re in good shape for ISO 27001 Control 8.20: Network security if:
- You have a documented network security standard with defined zones and permitted flows.
- Network devices (firewalls, routers, switches, Wi-Fi, VPNs) are hardened, patched and controlled.
- Your network is segmented, and critical systems sit in more restricted zones.
- Remote and wireless access use strong authentication and encryption, with limited access to internal systems.
- You log and monitor key network events and can investigate suspicious traffic.
- Cloud and on-premise networks are covered by the same basic principles, and their controls are documented.
- Firewall rules, VPNs and other network controls go through change management and periodic review.
- You can produce clear evidence (configs, diagrams, logs, change records) showing how network security is implemented and maintained.
Explore the ISO 27001 Control Group Purposes