ASD ISM 0553 Authenticate video calls and manage settings
What it says
Authentication and authorisation is used for all actions on a video conferencing network, including call setup and changing settings.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all video call actions and settings changes are verified with authentication and authorisation.
This control ensures that all the actions you take on a video call, like starting a call or changing settings, are done by someone who's been verified. It's like double-checking that the person making changes is really supposed to be doing it. If you skip this, anyone might make unapproved changes or eavesdrop, potentially exposing sensitive conversations or causing disruptions.
Free. Save your status, tasks and notes.
Why it matters
If video call setup and settings changes aren't authenticated and authorised, attackers can join calls, change meeting options, or disrupt sessions, exposing sensitive discussions.
How to implement
The IT team should enforce user login for all video call setups.
This can be done by requiring everyone to sign in with a unique username and password before starting or joining a call, ensuring that only authorised people can participate.
Managers need to set up permissions for changing video call settings.
This involves specifying who can alter settings like mute features or participant access, which can be managed through user roles in the conferencing tool.
IT should regularly audit the video conference logs.
Set up a schedule, perhaps monthly, to review who accessed calls and what changes they made, looking for patterns that might indicate misuse or unauthorised access.
HR should clearly communicate video call procedures to staff.
Run training sessions where employees learn why it's important to use secure login details and adhere to set protocols before initiating or adjusting calls.
System owners should assign a gatekeeper for video conferencing settings.
This person will be responsible for reviewing and approving any requests for changes to settings, ensuring a clear trace of accountability.
Keep it running
Enforce authentication/authorisation for call setup and settings changes; review meeting and admin logs and alert on failed logins or unauthorised attempts to change call settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The video conferencing user access policy: Review this document to see how user roles and access permissions are specified.
Look at
How permissions are distributed among roles and if there's a clear process for granting access.
Good evidence
Is a comprehensive document with detailed role-based access clearly outlined.
- Check 2 of 5What an auditor asks for
Look at
The attendance list and any changes made to settings during the meeting. Verify that all attendees were authorised users according to the policy.
Good evidence
Is a detailed log showing authorised participant activity and no unauthorised changes.
- Check 3 of 5What an auditor asks for
Ask for
The training records for employee video call protocols: Check the participants and frequency of these sessions. Ensure regular training is conducted and attended by all relevant staff.
Good evidence
Includes recent training dates and staff participation records.
- Check 4 of 5What an auditor asks for
Look at
The schedule and find when the last review was carried out. Verify that identified discrepancies or anomalies were addressed.
Good evidence
Is a dated report showing completed reviews and corrective actions taken.
- Check 5 of 5What an auditor asks for
Ask for
Incident reports related to video conferencing: Review these for any access or authorisation issues. Ensure there was an appropriate response and follow-up for each incident.
Good evidence
Involves detailed reports with documented resolutions and preventive measures for future occurrences.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.17.
Annex A 5.17 requires organisations to control the allocation and management of authentication information (e.g., credentials) via a defined process and to instruct personnel on correct handling. ISM-0553 relates by requiring authentication and authorisation for video conferencing actions, which depends on appropriate credential handling. However, ISM-0553 is service-specific.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.