ASD ISM 0546 Use video and voice-aware firewalls at gateways
What it says
When video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy, a video-aware or voice-aware firewall or proxy is used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure firewalls and proxies can handle video and voice data for secure conferencing and calls.
This control ensures that the systems we use to protect our internet communication, like firewalls and proxies, are capable of handling video and voice data. This is important because if these systems can't efficiently manage such data, our video calls or online meetings might be insecure. Hackers could eavesdrop on these conversations or cause disruptions, leading to a breach of sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without video/voice-aware firewalls at gateways, SIP/RTP may bypass inspection, enabling eavesdropping or call disruption during sensitive communications.
How to implement
IT Team should review existing firewall settings: They need to check if the current firewalls are configured to handle video and voice data.
This involves consulting the user manual or vendor documentation to ensure those capabilities are enabled.
Procurement should source video and voice-aware solutions: When purchasing firewalls or proxies, they should specify that they need to support video and voice protocols.
This means including those requirements in vendor contracts.
System Owners should test video and voice traffic: Collaborate with the IT team to conduct a test run of video conferences and voice calls through the firewall to confirm they are properly handled without dropping data or losing quality.
IT Team should update software regularly: They need to ensure the firewall and proxy software is up-to-date to support the latest data processing techniques, doing this by scheduling regular maintenance checks and updates.
Managers should provide staff training: Organise training sessions to educate staff on the importance of secure video and voice communication.
This helps them understand why these controls are in place and how to use them effectively.
Keep it running
Confirm gateways use SIP/RTP-aware firewall/proxy functions; regularly test traversal/inspection and keep rules/signatures current for voice/video traffic.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A configuration report from the firewall: Request documentation showing the firewall settings related to video and voice data handling.
Look at
The specific configurations that deal with video and voice protocols.
Good evidence
A report that indicates settings are configured as per vendor recommendations for handling this data type.
- Check 2 of 5What an auditor asks for
Ask for
A procurement specification document: Request the document outlining the requirements for new firewall and proxy equipment.
Look at
Specific mention of video and voice data handling as a requirement.
Good evidence
Clear criteria that any new purchase must support video and voice protocols.
- Check 3 of 5What an auditor asks for
Ask for
A test log of video and voice traffic handling: Request records of any tests conducted to verify that video and voice traffic is properly managed.
Look at
Test results that show data throughput and quality maintenance.
Good evidence
Documented test procedures and results indicating successful management of video and voice traffic.
- Check 4 of 5What an auditor asks for
Ask for
The software update log: Request a record of software update activities for firewall and proxy systems.
Look at
Regular updates including those related to video and voice functionality.
Good evidence
A detailed log showing recent and frequent updates with descriptions including relevant improvements.
- Check 5 of 5What an auditor asks for
Ask for
Training session records: Request evidence of training sessions conducted for staff regarding video and voice security measures.
Look at
Attendance records and training materials used.
Good evidence
Detailed records showing comprehensive training on secure management of video and voice data.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-0546 requires a video-aware or voice-aware firewall or proxy wherever video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy. This is a specific control on how network devices inspect and control real-time media traffic, making it one implementation of the Annex A 8.20 requirement that networks and network devices be secured, managed and controlled. Annex A 8.20 addresses network security broadly, while ISM-0546 applies only to video and voice traffic at gateways.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.