There are 2,200 cyberattacks per day, with a cyber-attack occurring approximately every 39 seconds. In the United States, a data breach costs an average of $9.44M, and cybercrime is predicted to cost $8 trillion by 2023. Therefore, implementing an effective cybersecurity program is instrumental in protecting a company’s Internet-related services. ISO/IEC 27032:2023—Cybersecurity – Guidelines For Internet Security details guidelines for Internet security.
Internet Security
Internet security, according to ISO/IEC 27032:2023, is concerned with protecting Internet-related services and related ICT systems and networks as an extension of network security. Simply put, it describes security for activities and transactions made over the Internet. Internet security is a central component of cybersecurity and computer security, involving topics including browser security, online behavior, and network security. It manages cyber threats and risks associated with the Internet, web browsers, web apps, websites, and networks. It aims to reduce Internet related security risks for organizations, customers and other relevant stakeholders
What Is ISO/IEC 27032?
ISO/IEC 27032:2023 addresses Internet security issues and provides guidance for addressing common Internet security threats, such as: social engineering attacks; zero-day attacks; privacy attacks; hacking; and the proliferation of malicious software (malware), spyware, and other potentially unwanted software. The standard also provides an explanation of the relationship between Internet security, web security, network security, and cybersecurity. ISO/IEC 27032:2023 details high-level guidance (technical and non-technical controls) for addressing common Internet security issues to help prepare for attacks, prevent attacks, detect/monitor attacks, and respond to attacks.
The History of Cybercrime
The world’s first cyber-attack happened in France in 1834 long before the Internet was even invented. Attackers (the Blanc brothers, who traded government bonds in the city of Bordeaux) infiltrated the French telegraph system. Information about market movements took several days to arrive from Paris by mail coach, and, accordingly, traders who could get the information faster could make more money. Some traders tried using messengers and carrier pigeons, but the Blanc brothers found a way to use the telegraph line instead. They bribed the telegraph operator in the city of Tours to introduce deliberate errors into routine government messages being sent over the network. These “hackers” gained access to financial markets and stole data.
The telegraph’s encoding system included a “backspace” symbol that instructed the transcriber to ignore the previous character. The addition of a spurious character that indicated the direction of the prior day’s market movement, followed by a backspace, meant the text of the message being sent was not impacted when it was written out for delivery at the end of the line. This extra character, however, could be seen by another accomplice—a former telegraph operator who observed the telegraph tower outside Bordeaux with a telescope and then passed on the news to the Blancs. In 1836, the scam was uncovered only when the crooked operator in Tours fell ill and revealed all to a friend, who he hoped would take his place. Although Blanc brothers were put on trial, they could not be convicted because there was no law against misuse of data networks.
From that moment on, cybercrime has grown exponentially—particularly at the mid-point of the 20th Century. Spurred by the digital revolution, cyber tactics, techniques, and procedures evolved and got more sophisticated.
Controls for Internet Security
Most organizations use the Internet for various purposes, including web surfing, blogging, social networking, accessing public cloud services, information sharing, and doing e-commerce business. This involves sharing of classified business information including personal information while executing online transactions. The Internet being a public network is prone to certain unique threats. If not addressed, these threats result in attacks that can be difficult to manage. Moreover, ISO/IEC 27032:2023 maintains that organizations should develop policies, procedures and response capability to:
- Define the rules for acceptable use of the Internet by personnel
- Define what services may be exposed over the Internet
- Define what services may be exposed over the Internet
- Identify the threats, vulnerabilities, attack vectors, and their associated risks
- Define the roles and responsibilities of various users of the Internet
- Conduct user awareness on the safe practices for Internet usage
- Specify the responsible departments for handling Internet security issues
- Establish a response mechanism for cybersecurity incidents;
- Conduct security drills to test the response mechanism towards attacks originating from the Internet
ISO/IEC 27032:2023—Cybersecurity – Guidelines For Internet Security is available on the ANSI Webstore.
