[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-20":3},{"item":4,"lessons":16,"controls":54,"related":83},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-20","Annex A 8.20","ISO\u002FIEC 27001:2022 Annex A 8.20: Networks security",9,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects networks and network devices to be secured, managed and controlled to protect information in systems and applications. The aim is to protect information that passes through networks and the facilities that process it.\n\n**In practice.** Good practice includes defined responsibilities for network management, hardened and patched network devices, secure management access, protection of data in transit where needed and logging and monitoring of network activity. Network documentation and diagrams are kept up to date. Auditors expect configuration standards, change records for network devices, access controls on management interfaces and evidence of monitoring.\n\n**Common gaps.** Common gaps are outdated network diagrams, default or shared credentials on network devices and management interfaces exposed to user networks or the internet. Remote access paths set up for projects or suppliers are also often left open after they are no longer needed.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50],{"slug":19,"title":20,"published_at":21},"check-point-zero-day-exploited-unauthenticated-rce-via-path-traversal","Check Point Zero-Day Exploited: Unauthenticated RCE via Path Traversal","2026-09-22T18:21:56.351+00:00",{"slug":23,"title":24,"published_at":25},"critical-unauthenticated-rce-flaw-in-check-point-management-servers-demands-immediate-patching","Critical Unauthenticated RCE Flaw in Check Point Management Servers Demands Immediate Patching","2026-09-18T04:20:24.8+00:00",{"slug":27,"title":28,"published_at":29},"default-credentials-expose-220-million-traveler-records-in-apis-database-leak","Default Credentials Expose 220 Million Traveler Records in APIS Database Leak","2026-09-08T08:20:36.011+00:00",{"slug":31,"title":32,"published_at":33},"tp-link-omada-ztp-flaws-enable-full-network-takeover-via-chained-vulnerabilities","TP-Link Omada ZTP Flaws Enable Full Network Takeover via Chained Vulnerabilities","2026-08-04T14:21:34.32+00:00",{"slug":35,"title":36,"published_at":37},"apt29-hijacks-public-wi-fi-gateways-to-steal-m365-credentials-from-traveling-employees","APT29 Hijacks Public Wi-Fi Gateways to Steal M365 Credentials from Traveling Employees","2026-08-03T10:20:42.204+00:00",{"slug":39,"title":40,"published_at":41},"ai-powered-autonomous-attacks-exploit-internet-facing-systems-via-agentic-frameworks","AI-Powered Autonomous Attacks Exploit Internet-Facing Systems via Agentic Frameworks","2026-07-31T12:20:45.485+00:00",{"slug":43,"title":44,"published_at":45},"24000-bmcs-exposed-by-11-year-old-ipmi-flaw-and-default-credentials","24,000+ BMCs Exposed by 11-Year-Old IPMI Flaw and Default Credentials","2026-07-28T14:21:26.324+00:00",{"slug":47,"title":48,"published_at":49},"public-wi-fi-gateway-compromise-used-to-steal-m365-credentials-via-dns-hijacking","Public Wi-Fi Gateway Compromise Used to Steal M365 Credentials via DNS Hijacking","2026-07-27T12:21:33.206+00:00",{"slug":51,"title":52,"published_at":53},"fortibleed-exposed-fortigate-devices-fall-to-credential-abuse-not-zero-days","FortiBleed: Exposed FortiGate Devices Fall to Credential Abuse, Not Zero-Days","2026-07-08T18:20:28.043+00:00",[55,60,65,69,74,79],{"slug":56,"name":57,"problem":58,"stories":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",7,{"slug":61,"name":62,"problem":63,"stories":64},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":66,"name":67,"problem":68,"stories":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":70,"name":71,"problem":72,"stories":73},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",3,{"slug":75,"name":76,"problem":77,"stories":78},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",2,{"slug":80,"name":81,"problem":82,"stories":78},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[84,90,95,99,103,109,113,117],{"family":85,"item":86,"code":87,"title":88,"together":89},"cis","12","Control 12","Network Infrastructure Management",8,{"family":85,"item":91,"code":92,"title":93,"together":94},"13","Control 13","Network Monitoring and Defense",6,{"family":85,"item":96,"code":97,"title":98,"together":94},"7","Control 7","Continuous Vulnerability Management",{"family":5,"item":100,"code":101,"title":102,"together":94},"a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",{"family":104,"item":105,"code":106,"title":107,"together":108},"nist-800-53","ac-17","AC-17","Remote Access",5,{"family":85,"item":110,"code":111,"title":112,"together":108},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":114,"item":115,"code":116,"title":116,"together":108},"itil","overview","ITIL",{"family":104,"item":118,"code":119,"title":120,"together":108},"sc-7","SC-7","Boundary Protection"]