Skip to content
Cryptography
ASD ISMISM-0479

ASD ISM 0479 Avoid using ECB mode for symmetric encryption

What it says

Symmetric cryptographic algorithms are not used in Electronic Codebook Mode.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Symmetric encryption should not use ECB mode as it is less secure.

When we encrypt information, we're scrambling it so that only people with the right key can read it. Think of encryption like a secret code for your private data. This control means we shouldn't use a specific way of scrambling called 'ECB mode' because it's like using the same simple pattern for everything, which makes it easier for criminals to see what's going on in our data, like cracking a repetitive code in a puzzle book.

Why it matters

Using ECB mode reveals repeated plaintext patterns in ciphertext, enabling traffic analysis and increasing the chance of data compromise.

How to implement

  1. IT team should review current encryption practices: Identify if any systems use the ECB mode for encryption.

    Do this by checking current encryption software settings and documentation.

  2. System owners should collaborate with IT: Replace ECB mode if found with a more secure mode, like CBC (Cipher Block Chaining) or GCM (Galois/Counter Mode).

    Request assistance from cyber security experts if needed.

  3. Managers should ensure all staff understand the importance of strong encryption: Organise regular training sessions so employees grasp why certain encryption modes, like ECB, aren't secure.

  4. Procurement should coordinate with IT when purchasing encryption tools: Ensure new products support recommended encryption modes and comply with Australian Signals Directorate (ASD) guidelines.

  5. Compliance officers should establish a regular review schedule: Set up annual or bi-annual reviews of encryption methods used across systems to ensure compliance with security standards.

Keep it running

Prohibit ECB in libraries/configs; enforce AEAD modes (AES-GCM/CCM) and add tests/scans to detect and block ECB usage in builds.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of encryption methods currently in use: Verify this list with the IT department.

    Look at

    Alternative encryption modes like CBC or GCM being listed.

    Good evidence

    No mention of ECB mode in the current methods.

  2. Check 2 of 5What an auditor asks for

    Look at

    Sections describing encryption modes. Good documentation specifically prohibits ECB mode.

    Good evidence

    Includes explicit prohibition of ECB mode.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training records.

    Look at

    Evidence that cyber security importance has been communicated, especially regarding secure encryption practices.

    Good evidence

    Reflects regular training sessions that highlight why ECB mode is not suitable.

  4. Check 4 of 5What an auditor asks for

    Look at

    Live settings or screenshots showing encryption modes in operation.

    Good evidence

    Outcome shows avoidance of ECB mode and usage of recommended modes like CBC or GCM.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Supplier compliance proof when purchasing encryption products.

    Look at

    Procurement documentation ensuring vendors provide products compliant with ASD guidelines.

    Good evidence

    Includes confirmation that products support secure modes and exclude ECB.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.