Skip to content
Cryptography
ASD ISMISM-0485

ASD ISM 0485 Use public key authentication for SSH access

What it says

Public key-based authentication is used for SSH connections.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure SSH connections use public key authentication for enhanced security.

This control requires that when someone connects to your systems over the internet using a Secure Shell (SSH), they should use a special digital key instead of just a password. This matters because passwords can be guessed or stolen, but a digital key is much harder for attackers to crack, keeping your systems safer from unauthorised access.

Why it matters

Without public key SSH authentication, passwords can be stolen or brute-forced, enabling unauthorised access.

How to implement

  1. The IT team should generate a unique pair of SSH keys for each user who needs access.

    This means creating a public key and a private key using SSH software and securely distributing them to users while keeping the private key secret.

  2. System owners should make sure their systems are configured to accept only public key authentication.

    This involves editing the SSH configuration file on each server to disable password login and allow only key-based access.

  3. IT managers should educate users on how to securely store their private keys.

    This means explaining that keys should be kept on a secure device, such as their work computer, and not shared or emailed to anyone.

  4. The HR department should work with IT to update employee onboarding and offboarding processes.

    This involves assigning SSH keys to new employees and revoking them promptly when employees leave.

  5. Cyber security leads should schedule regular checks to ensure keys are in use and not lost.

    This can involve periodically reviewing a list of active keys and verifying if users still need them for their roles.

Keep it running

Audit authorised_keys regularly, remove stale keys, and enforce key-only SSH (disable PasswordAuthentication).

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The SSH configuration files of critical systems to review authentication settings. Look to see if password login is disabled and SSH key authentication is enabled.

    Good evidence

    Shows password authentication off and key authentication on.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Includes a list matching current, verified employees to their respective keys.

  3. Check 3 of 5What an auditor asks for

    Ask for

    To see records of key distribution and training.

    Look at

    Documentation that users received their keys securely and attended a training session on their use.

    Good evidence

    Provides recent dates and specific details of the distribution and training activities.

  4. Check 4 of 5What an auditor asks for

    Look at

    Entries showing successful logins using key-based authentication rather than passwords.

    Good evidence

    Will show key-based logins and no password entry attempts.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see evidence of key revocation for former employees.

    Look at

    A log or record indicating prompt key removal upon job termination.

    Good evidence

    Includes documented removal within 24 hours of departure.

Mappings

Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.5.17Management of authentication informationPartially meets
  • A.8.5Secure authentication technologies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.