News for hackers. Stuff that matters.

A comment on Hackers breached Colonial Pipeline using compromised password. Parent comment

Re:Hackers breached Colonial Pipeline using compromised pass... by beermonster on Saturday June 05, 2021 @02:44AM (#27402790)
Can you explain this? I thought ISO 27002 was implementation guidance for ISO 27001. No mandatory requirements even the Annex A controls themselves aren’t mandatory.
[ Parent | on HN ]
Re:Hackers breached Colonial Pipeline using compromised pass... by mac-chaffee on Saturday June 05, 2021 @08:22AM (#27404303)
Good point. At the company where I work, we have an ISO compliance team that converts that guidance into mandatory requirements. So the authority is coming from company policies rather than ISO itself.
[ Parent | on HN ]
Re:Hackers breached Colonial Pipeline using compromised pass... by gabereiser on Saturday June 05, 2021 @03:26PM (#27407845)
Correct. Most companies won’t interpret and just mandate the guidance recommendations.
[ Parent | on HN ]