Model Answer: Network Case Study
1. Lack of Network Segmentation between Public and Private Systems
**Finding:** The hotel’s Wi-Fi network was used universally by both organizers and
attendees, without any segmentation between public and private access areas. This
introduced a major security risk by exposing internal administrative functions and sensitive
data to untrusted users on the same network.
**ISO/IEC 27001:2022 Annex A Control:** A.8.22 – Segregation of Networks
**Control Requirement:**
Networks shall be segmented to protect sensitive information and ensure that unauthorized
users do not have access to critical systems.
**Explanation:**
Proper network segmentation is essential to protect confidential or internal systems. In this
case, the failure to separate public and organizer networks allowed potential unauthorized
access to sensitive backend services. A dedicated, secured network should have been
provided for internal use, isolated from public Wi-Fi.
2. Insecure Application Design Allowing Unauthorized Access
**Finding:** The conference app allowed access to sensitive schedules and meeting
information through unsecured links. Anyone with the link could view confidential data,
indicating missing or inadequate access control mechanisms.
**ISO/IEC 27001:2022 Annex A Control:** A.5.15 – Access Control
**Control Requirement:**
Access to information and information systems shall be controlled based on business and
security requirements.
**Explanation:**
Applications must enforce strong access control mechanisms. In this scenario, sensitive
information should have been protected behind authentication layers. The use of tokenized,
time-limited, or role-based access would have helped prevent unauthorized access to
privileged areas.
3. Improper Use of Public Infrastructure for Critical Functions
**Finding:** All critical conference app services ran over the hotel's public infrastructure
without appropriate safeguards such as encrypted communication or isolated backend
systems.
**ISO/IEC 27001:2022 Annex A Control:** A.8.20 – Network Security
**Control Requirement:**
Network security controls shall be implemented to protect information systems from
unauthorized access and other security threats.
**Explanation:**
Using public networks for confidential or operational functions poses a major threat.
Controls like VPNs, traffic encryption (TLS), and firewalls are essential when using shared
infrastructure. In this case, the lack of any security boundary made critical services
vulnerable to interception or misuse.
4. Misconfiguration of Application Permissions and Controls
**Finding:** Certain app features were accessible without proper checks or credentials, and
sensitive meeting rooms in the digital environment were not locked, indicating
misconfiguration of permissions during setup.
**ISO/IEC 27001:2022 Annex A Control:** A.8.28 – Secure Authentication
**Control Requirement:**
Secure authentication methods shall be implemented for users and systems accessing
sensitive information or systems.
**Explanation:**
Systems must be designed with secure authentication and role-based access from the start.
Misconfigured permissions are a frequent cause of data leaks. At minimum, organizers
should have implemented secure login protocols with session management and granular
permissions for sensitive areas.
5. Absence of Secure Default Configurations and Setup Validation
**Finding:** Default configurations were left unchanged in the app setup, such as open
access to private sessions and lack of authentication. No validation or pre-launch security
review was conducted.
**ISO/IEC 27001:2022 Annex A Control:** A.5.9 – Secure Configuration Management
**Control Requirement:**
Information systems shall be configured securely to reduce vulnerabilities and provide only
the services necessary for their intended function.
**Explanation:**
Security configurations should be defined, applied, and reviewed before system launch. The
failure to lock access to meeting rooms and the open configuration of the app suggest there
was no validation or security assurance process. Secure-by-default principles should be
applied during system deployment.
6. Lack of Testing Prior to Deployment of the Conference App
**Finding:** The issues only became apparent after the app was already in use, implying
that no proper pre-deployment testing or validation of security controls was performed.
**ISO/IEC 27001:2022 Annex A Control:** A.8.32 – Change Management
**Control Requirement:**
Changes to information systems shall be controlled and managed to ensure that
unauthorized changes are prevented and that changes are tested, approved, and
documented.
**Explanation:**
Testing environments and controlled deployment are essential before launching any
application. This includes user acceptance testing (UAT), security review, and validation of
access rules. The absence of these measures resulted in insecure deployment and user
impact during live use.
7. Exposure of Sensitive Data Without Encryption or Masking
**Finding:** Sensitive conference data such as private meeting schedules became visible to
unauthorized individuals without any encryption, anonymization, or data protection
controls in place.
**ISO/IEC 27001:2022 Annex A Control:** A.8.10 – Information Deletion and A.8.11 – Data
Masking
**Control Requirement:**
Information no longer required shall be securely deleted and Data masking shall be used to
protect sensitive information where appropriate.
**Explanation:**
While the core failure here relates to unauthorized access, lack of masking or encryption of
sensitive data worsened the impact. Even when access controls fail, data obfuscation or
partial redaction can mitigate the extent of exposure.