Episode 65 — A.8.23–8.24 — Web filtering; Use of cryptography

https://is1-ssl.mzstatic.com/image/thumb/Podcasts221/v4/43/3c/f0/433cf08f-87a6-3add-146c-ce810b487626/mza_5063864341569826942.jpg/600x600bb.jpg

Framework - ISO 27001 (Cyber)

Jason Edwards

71 episodes

1 day ago

The ISO/IEC 27001 Framework is the internationally recognized standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a systematic approach to managing sensitive information through risk management, governance, and control implementation. At its core, ISO 27001 helps organizations protect the confidentiality, integrity, and availability of data—whether stored, processed, or transmitted—by aligning security practices with business objectives and regulatory requirements. The framework is built around a risk-based process, requiring organizations to identify potential threats, assess their likelihood and impact, and implement appropriate controls from the companion standard ISO/IEC 27002. These controls cover a wide range of areas including asset management, access control, cryptography, operations security, and supplier relationships. By tailoring these controls to organizational needs, ISO 27001 supports both flexibility and accountability—ensuring that security measures are not just technical but also strategic and operational. Beyond compliance, ISO 27001 fosters a culture of continuous improvement through regular audits, performance monitoring, and leadership involvement. Certification to the standard demonstrates to customers, partners, and regulators that an organization follows internationally accepted best practices for managing information security risk. More than a checklist, ISO 27001 functions as an ongoing management framework that integrates security into every level of organizational decision-making, helping build trust, resilience, and long-term operational stability.

All content for Framework - ISO 27001 (Cyber) is the property of Jason Edwards and is served directly from their servers with no modification, redirects, or rehosting. The podcast is not affiliated with or endorsed by Podjoint in any way.

Courses

Education,

Technology

Episode 65 — A.8.23–8.24 — Web filtering; Use of cryptography

Framework - ISO 27001 (Cyber)

15 minutes

1 month ago

Episode 65 — A.8.23–8.24 — Web filtering; Use of cryptography

A.8.23 establishes web filtering to manage risk from browsing and outbound HTTP/S traffic, acknowledging that the browser is a primary threat vector. For the exam, emphasize policy-aligned controls that block known malicious domains, enforce safe browsing categories, and apply content inspection where lawful and appropriate to detect malware and data exfiltration. Modern approaches pair DNS-layer protection with secure web gateways or cloud access brokers, integrating identity to apply differentiated policies for roles and devices. Evidence includes block/allow lists governance, certificate management for inspection, exception processes, and metrics such as blocked threat counts, false positive rates, and user impact indicators. Pitfalls involve overbroad blocking that breaks business workflows, privacy concerns around inspection, and blind spots for unmanaged devices. Effective implementations coordinate with awareness programs so users understand why blocks occur and how to request legitimate access, turning filtering into a guardrail rather than a roadblock.

A.8.24 governs the use of cryptography to protect confidentiality, integrity, and authenticity of information at rest and in transit. Candidates should demonstrate understanding of policy-driven key management, algorithm and parameter standards, certificate lifecycle (issuance, rotation, revocation), hardware-backed key protection where feasible, and separation of duties so no single actor can compromise a root of trust. Design choices must consider performance, interoperability, and regulatory constraints (e.g., export controls, data residency) while avoiding deprecated algorithms and weak modes. Pitfalls include unmanaged private keys embedded in code, inconsistent TLS configurations, and shadow PKI that spawns operational failures and security gaps. Strong programs centralize secrets, enforce automated rotation, inventory cryptographic assets, and validate configurations continuously with scanners and chaos-style tests. Candidates should be ready to explain how web filtering reduces exposure to hostile content and command-and-control channels, while sound cryptography ensures that even when data moves across untrusted networks or shared platforms, it remains protected and provably controlled—both vital stories to tell auditors and customers about modern, risk-based protection. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.