ASD ISM 0498 Ensure short lifetimes for IPsec associations
What it says
A security association lifetime of less than four hours (14400 seconds) is used for IPsec connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIPsec connections should expire in less than four hours to maintain security.
Shortening the lifetime of an IPsec connection to under four hours is like changing the locks on your doors every few hours to keep potential burglars at bay. It ensures the data moving across the internet between your systems remains secure, reducing the risk of cyber attackers gaining access to sensitive information.
Free. Save your status, tasks and notes.
Why it matters
If an IPsec security association lifetime exceeds four hours, a compromised key can be used longer, increasing the chance of traffic decryption or tampering.
How to implement
IT team: Regularly configure your IPsec settings to ensure that each connection has a lifetime of less than four hours.
This means adjusting the settings on your routers and firewalls so that they automatically reset these secure connections before the time limit is reached.
Security manager: Review IPsec policy settings to ensure compliance with this control.
Work with network administrators to outline clear guidelines on how IPsec connections are managed and ensure these guidelines are actively followed.
System administrator: Monitor IPsec connection logs to verify the connection lifetimes.
Use network tools to set alerts if a connection exceeds the specified duration, then investigate and rectify the issue promptly.
Procurement manager: Ensure that any new network equipment being purchased is capable of supporting short-lived IPsec security associations.
Consult with the IT team to verify that equipment specifications meet this requirement.
Training coordinator: Organise training sessions for network and IT staff on the importance and process of setting short IPsec lifetimes.
Use scenarios and practical drills to illustrate how this control helps in preventing cyber threats.
Keep it running
Configure IPsec SA lifetimes to <14400 seconds (4 hours) on both peers, and regularly verify tunnel rekeying and expiry via device logs/config audits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The IPsec configuration documentation: Request documents detailing the IPsec settings, including connection lifetime.
Look at
The specific settings for connection lifetimes.
Good evidence
Is documentation showing IPsec configurations with the lifetime settings clearly less than four hours.
- Check 2 of 5What an auditor asks for
Ask for
Network log files: Request recent network logs that include IPsec connection details.
Look at
Timestamp records of IPsec connections to confirm they are not active for more than four hours.
Good evidence
Log files showing renewed connections within the four-hour window.
- Check 3 of 5What an auditor asks for
Ask for
IT team procedures: Request the standard operating procedures (SOPs) that the IT team follows for configuring and monitoring IPsec connections.
Look at
The specifics of lifetime settings included in the SOP.
Good evidence
Is SOP documents that enforce routine checks and adjustments to connection lifetimes.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request records of staff training related to IPsec configurations.
Look at
Attendee lists and training content to confirm staff understand the importance of short IPsec lifetimes.
Good evidence
Includes recent training sessions with evidence of participant understanding and policy compliance.
- Check 5 of 5What an auditor asks for
Ask for
Procurement policy documents: Request policies regarding the acquisition of network equipment.
Look at
Criteria related to the support of IPsec's security measures specifically.
Good evidence
Shows policies mandating the purchase of equipment that can enforce short IPsec lifetimes.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-0498 requires organisations to configure IPsec security association (SA) lifetimes to less than four hours to limit cryptographic exposure and reduce the impact of key compromise. Annex A 8.9 requires security-relevant configurations for networks and services to be established, documented, implemented, monitored and reviewed, which would include IPsec parameters such as SA lifetimes where IPsec is used. The ISO control is broader because it covers configuration management across all IT components, whereas ISM-0498 is a specific configuration requirement for IPsec.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.