How would a DMZ zone recertification process look like? Say we create a separate security zone for each application hosted in DMZ. Now we would like to get in touch with the person in charge for the given zone to ask if it's still needed. How could this be handled? Are there any ISO 27001 directives related to this?

  • Re-certify is maybe wrong term. Currently there's no process at all. After a zone is provisioned there's no life cycle management so it's possible that some of them are not even needed. We want to create a process to get in touch with the zone owners to check if the zone is still in use. – cyzczy Jun 26 '17 at 9:21
  • I'm not asking about how to get in touch with zone managers. I look rather how to address it in first place (how would such a process look like, maybe someone did something similar before) . There's no standard we need to stick with, so I guess it might complicate it. – cyzczy Jun 26 '17 at 9:35

What you are asking for is basic lifecycle management:

  • Design
  • Deploy
  • Maintain
  • Review
  • Decommission

You need a policy and a procedure to review all the firewall configs (including the zones) to ensure that the current 'design' is meeting the needs and goals of its intent. The frequency of this review is up to the needs of your organisation, yearly might be fine.

Each 'zone' requires an 'owner' who designs and drives the controls in this zone. Any changes to the zone require the owner's input. Ownership is set up as early as possible to prevent the owner being surprised that they are responsible for critical infrastructure.

During the review phase, each relevant element of the zone is verified by the owner as being current, and the verification is challenged by an outside party (GRC, Information Security Steering Committee, etc.) as being accurate.

Once verified or modified, the zone returns to a 'maintenance' state. If the zone is deemed redundant, a decommissioning phase is initiated which defines and tests the removal of the zone in order to ensure a complete and secure decommissioning with minimal impact to the organisation.

As for ISO 27k, the terms you are looking for a 'controls review', and there is a whole document about this: ISO 27008

  • Thank you, I appreciate your comment! Our focus is on the "review" part. I have to mention that for now for whatever reason we won't make it on firewall rules level for now, it's more about to verify if the zone is need. Could you please give me some hints how to handle this, any reference to any type of paper I could read ? One year as you mention should be fine. But should this be as simple as do you need the zone yes or no or should they also justify why ? What when they say , no we don't need it. – cyzczy Jun 26 '17 at 10:02
  • 1
    DMZ zones are firewall configs - it's the same concept – schroeder Jun 26 '17 at 10:03
  • 1
    As I said, verification has to be done against the design of the zone. What is its purpose? Why was it designed that way? Is the design and its implementation still relevant? That's what you review and that's how you review it. The paper you need to read is the design docs. And, as I say, if it is not needed, you go through a decommission process. – schroeder Jun 26 '17 at 10:07
  • Should the zone managers be notified prior the upcoming review say one month before ? What would you recommend ? – cyzczy Jun 26 '17 at 10:58
  • 1
    The level of surprise you introduce is directly proportional to the level of resistance you will encounter. they should know there is an annual review and a notice ahead of time is just simply professional courtesy. How much time would you like before a friendly audit? – schroeder Jun 26 '17 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.