BS ISO IEC 27033 — Information Technology — Security Techniques — Network Security Series

🌐 BS ISO/IEC 27033 is the British Standard family published by BSI adopting the ISO/IEC 27033 series on information technology security techniques — network security. The series comprises six documents and was developed with participation from BSI Technical Committee IST/33 (IT security techniques). It provides systematic security guidance for the planning, design, implementation and operation of an organization’s network: from overview and concepts, network design and implementation guidelines, and reference networking scenarios (threats, design techniques and control issues), to securing communications between networks using security gateways, securing communications across networks using VPNs, and securing wireless IP network access. The series complements the ISO/IEC 27001/27002 management-system standards and is the core reference standard family for network security architecture engineering.

1. Series Overview and Positioning 📌

The network is the transport and access channel for an organization’s information assets, and the network attack surface (attack chain) spans terminals, wireless, access, core, data centre and interconnection boundaries. The value of the ISO/IEC 27033 series is that, on top of the ISO/IEC 27002 control framework, it provides dedicated security guidance for the “network” layer: how to identify network risks, how to partition security domains (zones) and trust boundaries, how to deploy security gateways and tunnels, and how to choose appropriate security controls in different network scenarios. The series stresses “security by design”: network topology, segmentation and access control should be considered at the early stage of network construction rather than as an afterthought. BS ISO/IEC 27033 is the official UK implementation of the series.

2. Series Structure and Technical Content 📚

The six documents of the BS ISO/IEC 27033 series (of varying edition years) form a complete network security methodology:

The internal logic of the series: Part 1 sets the principles and risk method; Part 2 gives the network architecture design and security-domain partitioning; Part 3 explains threats and controls through reference scenarios (internet access, DMZ, data centre, remote work); Parts 4 to 6 provide specific control recommendations for gateways, VPNs and wireless access respectively. In engineering, rollout proceeds layer by layer: concepts, design, scenarios, controls.

3. Key Technical Requirements 🔬

3.1 Overview and concepts (Part 1)

Part 1 specifies the general principles and concepts of network security: it clarifies the objectives (confidentiality, integrity, availability), network asset classification, threat sources and the attack chain, and provides a risk-based network security management framework. It defines the scope of network security (from LAN and WAN to cloud and IoT) and organizational responsibilities, serving as the methodological basis of the remaining parts.

3.2 Network design and implementation guidelines (Part 2)

Part 2 specifies the steps of network security design and implementation: identifying business requirements and security domains (security-domain partitioning: internal, DMZ, external, management plane, etc.), determining trust boundaries, planning network segmentation and access control (ACL/firewall/switch policies), and selecting network devices and redundant topologies. The part emphasizes the “security-domain — trust-boundary” model and the principles of least privilege and least exposure, and gives a project-style process from current-state assessment to implementation validation.

3.3 Reference networking scenarios (Part 3)

Part 3 presents, in the form of reference network scenarios, the security issues to consider under different network topologies: internet access, remote access, enterprise-partner interconnection, data centres, wireless and wide-area networks. Each scenario analyses typical threats (probing, scanning, injection, man-in-the-middle, DoS, etc.) and proposes corresponding design techniques and controls, making it a practical tool for engineers to quickly build threat models.

3.4 Security gateways (Part 4)

Part 4 specifies the deployment and design of security gateways between networks (firewalls, IDS/IPS, anti-virus gateways, etc.): gateway classification (packet filtering, stateful inspection, application proxy, next-generation firewall), deployment locations (boundary, between subnets, data-centre ingress), high availability and load balancing, and log/alert integration. The gateway is the enforcement point of access control between security domains, and the granularity and auditability of its policy are the design focus.

4. Engineering Practice 🛠️

• 🔍 Network architecture security design: partition security domains and trust boundaries per Part 2, planning segmentation, access control and redundant topologies.
• 🔧 Threat modelling and scenario analysis: build threat models per Part 3 for internet access, DMZ, data centre and other scenarios and select controls.
• 📊 Boundary security and gateway deployment: deploy firewalls/IPS per Part 4 with default-deny and defence in depth; plan IPsec/SSL VPNs per Part 5.
• 📋 Wireless and access security: control wireless access per Part 6 (802.1X, WPA2/3, guest-network isolation) and security policy.

5. Frequently Asked Questions ❓