A company switches its email server but fails to update the firewall rules. The old rules reference IP addresses that now belong to a different application. For three months, internal mail traffic is reachable over the internet unencrypted — and nobody notices, because responsibility for firewall changes is not documented anywhere.
Poor planning and lack of adaptation are among the most insidious threats because they require no direct attack. The BSI lists them as elementary threat G 0.18. The damage arises gradually — through organisational gaps, outdated configurations and unclear responsibilities.
What’s behind it?
Organisational procedures, technical architectures and security measures must fit the actual operating environment. When the environment changes — new systems, new employees, new business processes, new threats — and security measures do not follow, gaps appear. These gaps are often invisible because every individual process step functions correctly — only the interplay no longer holds together.
Typical planning errors
- Unclear responsibilities — tasks are not assigned to any specific person or role. Patches remain unapplied because nobody feels responsible. Security incidents are not reported because the reporting process is unclear.
- Outdated architectures — network segmentation stems from a time when the company was half its current size. New cloud services are connected without adapting the firewall rules. Legacy systems for which no updates are available continue to run on the production network.
- Security requirements missing in procurement — hardware and software are selected by functionality and price without considering security criteria. The result: retrofitted (expensive) protection or — more often — permanent weaknesses.
- Dependencies overlooked during planning — a maintenance window for the network interrupts a business process nobody identified as network-dependent. A supplier files for insolvency and the supply of spare parts for critical systems collapses.
Impact
Poor planning affects all three protection goals. Outdated configurations open attack paths (confidentiality, integrity); lack of redundancy and non-adapted maintenance processes threaten availability. The insidious part: the damage often appears with a delay, weeks or months after the actual planning gap — and is then attributed to a different cause.
Practical examples
Maintenance contract without security requirements. A company signs a maintenance contract for its production control system. The contract regulates response times and spare parts but contains no security requirements. The service provider uses an unencrypted protocol and a default password for remote maintenance. An attacker exploits exactly this access to enter the production environment.
Structural change without updating evacuation plans. During a renovation, walls are moved and entrances changed. The evacuation route plans are not updated. During an evacuation, employees follow the outdated plans and end up in dead ends — the evacuation time doubles.
Cloud migration without firewall adjustment. A company migrates its customer database to the cloud but fails to update the network policies. The database port remains open for the old internal network segment — and is now reachable from the public internet too. An external penetration test uncovers the misconfiguration.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 90 mapped controls below in the section “ISO 27001 Controls Covering This Threat”.)
Prevention:
- A.5.8 — Information security in project management: Security requirements are integrated into projects from the start.
- A.5.37 — Documented operating procedures: Current, documented procedures prevent knowledge from living only in people’s heads.
- A.8.8 — Management of technical vulnerabilities: Systematic patching continuously adapts the technical protection.
- A.5.2 — Information security roles and responsibilities: Unambiguous assignment of responsibilities prevents accountability gaps.
- A.8.9 — Configuration management: Systematic management of configurations detects deviations early.
Detection:
- A.5.35 — Independent review of information security: Regular audits uncover planning deficits.
- A.5.36 — Compliance with policies, rules and standards for information security: Compliance checks identify deviations from the target state.
Response:
- A.5.26 — Response to information security incidents: When planning deficits lead to incidents, prepared response processes take effect.
BSI IT-Grundschutz
The BSI IT-Grundschutz catalogue links G 0.18 to practically every module — evidence of how fundamental this threat is. Particularly relevant:
- ISMS.1 (Security management) — the central module: requirements for planning, implementation and continuous improvement of the ISMS.
- OPS.1.1.1 (General IT operations) — organisational and technical requirements for ongoing operations.
- OPS.1.2.2 (Archiving) — long-term planning requirements for the retention of information.
- DER.3.1 (Audits and revisions) — systematic review of security measures for currency and effectiveness.
Sources
- BSI IT-Grundschutz: Elementary Threats, G 0.18 — original description of the elementary threat
- ISO/IEC 27001:2022 Section 8.1 — requirements for operational planning and control
- ISO/IEC 27002:2022 Section 5.8 — implementation guidance on information security in project management