ISO/IEC 27002 controls in practice
You study the 93 controls of ISO/IEC 27002:2022 across four themes, implement and evidence key controls from each theme on target systems and classify them by attribute.
Level 301 · 21 lessons · 18 practice labs
Lessons
Structure
- The 2022 structure: four themes, 93 controls
- Control attributes and tags
- The new controls in 2022
- Quick task: filter controls by attribute
Organisational controls
- Policies, roles and segregation of duties
- The threat intelligence control
- Assets, classification and information transfer
- Identity and access controls
- Supplier relationship controls
- Quick task: an access provisioning and removal procedure
People and physical
- People controls: screening, contracts, training, leaving
- Physical controls: areas, equipment, monitoring
- Quick task: a leaver checklist
Technological controls
- Endpoints and privileged access
- Configuration management
- Logging and monitoring
- Data masking and leakage prevention
- Secure development controls
- Quick task: collect evidence for configuration management
Finish
- Measuring control effectiveness
- Capstone: implementation and evidence pack for ten key controls
Practice labs
- Place the control in its theme: Place twenty controls in the organisational, people, physical or technological theme.
- Filter controls by attribute: Filter the given control table on the command line to list preventive controls that serve confidentiality.
- A gap analysis for the new 2022 controls: Compare a control set built on the old edition with the eleven new controls and write the status and missing work for each.
- Find the segregation of duties conflict: Mark the pairs of duties in a role–permission table that one person should not hold together.
- An access provisioning and removal procedure: Write a procedure with request, approval, provisioning, review and removal steps and the record each one leaves.
- Evidence the threat intelligence control: Select the relevant items from prepared threat bulletins, record the action taken and create an evidence record for the control.
- A leaver checklist: Prepare a checklist of account, device, badge and confidentiality steps for a departing employee.
- A physical security observation report: From an office floor plan and observation notes, report the gaps in secure area, equipment and monitoring controls.
- Spread the people controls over the lifecycle: Write an evidence plan for screening, contract, training and disciplinary controls across pre-employment, employment and leaving.
- List the privileged access: List the users with administrator rights and the privilege elevation rules on the lab server.
- Collect evidence for configuration management: Compare the server's current configuration with the approved baseline file and save the differences as evidence.
- Fix the drift and verify again: Correct five settings that drift from the baseline, write the change record and attach the fresh comparison output.
- Verify the logging: Verify on the lab server that login, privilege elevation and configuration change events are logged.
- Mask data in an export: Mask the name, phone and card fields in a customer table going to the test team while keeping the format.
- Evidence for the secure development controls: From a repository history, extract evidence of code review, branch protection and secret scanning and report the missing controls.
- Write an effectiveness measure for a control: Write one measure for each of eight controls that shows it works, not just that it exists.
- Evaluate the effectiveness data: Compare three months of measurement data for six controls with the targets and write which are ineffective and the likely cause.
- An evidence pack for ten controls: Compile a pack with an implementation description and evidence files for ten key controls from the lab server and prepared documents.
About this course
You study the 93 controls of ISO/IEC 27002:2022 across four themes, implement and evidence key controls from each theme on target systems and classify them by attribute.
What you will learn
- Structure
- Organisational controls
- People and physical
- Technological controls
- Finish
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.