ASD ISM 0529 Avoid using VLANs for different security domains
What it says
VLANs are not used to separate network traffic between networks belonging to different security domains.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDo not use VLANs to separate networks with different security levels.
When you set up different parts of your network for security reasons, don't rely on VLANs (Virtual Local Area Networks) to keep them apart. Using VLANs can lead to serious security risks because they aren't foolproof against attacks that could jump from one secured area to another. This matters because if one part of your network is breached, attackers could access sensitive data in other parts too.
Free. Save your status, tasks and notes.
Why it matters
Relying on VLANs to separate different security domains can allow cross-domain access if VLAN hopping or misconfiguration occurs, exposing sensitive data.
How to implement
The network administrator should review current network segmentation strategies.
Ensure that sensitive and non-sensitive network areas are physically separated rather than relying solely on VLANs, which can be bypassed with certain attacks.
The IT manager should conduct a risk assessment of the current VLAN usage.
Include factors like potential data exposure and the impact of a breach across network segments, emphasising the need for physical or additional logical separation methods.
IT security staff should install additional network security equipment, such as firewalls or routers, to physically separate different security domains within the network, thereby reducing reliance on VLAN separation.
The IT team should work alongside a security consultant to design a layered network security architecture.
This should include using multiple security measures, such as firewalls and network intrusion detection systems (IDS), beyond just VLANs.
System owners should document and regularly review the network design and security policies.
Update these documents to reflect changes in technology or business operations, ensuring network separations are maintained through reliable means.
Keep it running
Ensure different security domains use physical or cryptographic separation, not VLANs. Review switch configs and routing/ACL paths to confirm no cross-domain VLAN connectivity.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network architecture diagram: Request the most recent diagram illustrating the physical and logical separation of network segments.
Look at
Clear indications of additional security measures beyond VLAN use.
Good evidence
Shows multiple layers of network security, with physical separations where needed.
- Check 2 of 5What an auditor asks for
Look at
Acknowledgments of VLAN limitations and alternative security measures.
Good evidence
Record specifies alternative or additional security solutions employed.
- Check 3 of 5What an auditor asks for
Ask for
A report on recent penetration testing or network audits: This should include results on how well VLANs are used in conjunction with other security measures.
Look at
Any findings on VLAN weaknesses or recommendations.
Good evidence
Report highlights segregated security zones with more robust protections.
- Check 4 of 5What an auditor asks for
Look at
How access might have moved across network segments.
Good evidence
Document details how multiple security domains stayed isolated despite breach attempts, highlighting effective alternative separations.
- Check 5 of 5What an auditor asks for
Look at
Approvals and completion logs of changes that enhance network security beyond simple VLAN segmentation.
Good evidence
Log shows proactive steps taken to separate network domains securely.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-0529 requires that VLANs are not used to separate network traffic between different security domains, pushing organisations to use stronger separation mechanisms for domain boundaries. Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information, which includes applying appropriate architectural controls to prevent cross-domain compromise. ISM-0529 supports Annex A 8.20 by reducing the risk of misconfiguration or bypass of logical separation where security domain separation is required, but Annex A 8.20 is much broader than segmentation choices alone.
This control partially meets A.8.22.
ISM-0529 requires that VLANs are not used to separate network traffic between networks belonging to different security domains. Annex A 8.22 requires organisations to segregate groups of information services, users and systems within networks, which can include multiple technical methods for segmentation. ISM-0529 is a specific constraint on an unsafe segmentation approach (VLANs across security domains), whereas Annex A 8.22 is broader and technology-agnostic about how segregation is achieved.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.