Skip to content
Gateways
ASD ISMISM-0619

ASD ISM 0619 User authentication for network gateway access

What it says

Users authenticate to other networks accessed via gateways.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure users verify their identity before accessing networks through gateways.

This control is about making sure people prove who they are before they can access your network through special entry points called gateways. If you don't do this, anyone pretending to be someone else could get in, leading to leaks of sensitive information or disruption of your operations.

Why it matters

Without gateway user authentication, attackers can impersonate valid users, gaining unauthorised access to sensitive networks and disrupting critical services.

How to implement

  1. IT team should install authentication software: Choose a reliable software that requires users to enter a username and password or another form of identity verification before accessing the network through gateways.

    Ensure it's installed on all gateway entry points and is easy for users to understand.

  2. System owners need to maintain a list of authorised users: Create a list of individuals who are allowed to access the network through these gateways.

    Update it every time someone joins or leaves the team, so only the right people have access.

  3. Managers should train their staff on security protocols: Arrange short training sessions to explain why authentication is necessary and how to correctly use the verification tools.

    This keeps everyone informed and helps prevent mistakes.

  4. HR should coordinate with IT to update access rights: Whenever there's a staffing change, immediately inform the IT team to remove access for departing staff and set up access for new employees through the gateways.

  5. Conduct regular access reviews: System owners should schedule quarterly reviews of who's accessing the network via gateways, ensuring that only current, authorised users are on the list.

    Adjust access rights promptly as needed.

Keep it running

Implement per-user authentication on gateways and regularly audit gateway access logs to detect and respond to unauthorised attempts swiftly.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The user access list: Request a copy of the current list of users authorised to access the network through gateways.

    Look at

    Names that match current employee records and ensure no past employees have access.

    Good evidence

    List will be up-to-date, reflecting only current staff needing access.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see authentication logs: Request logs that show instances of users logging into the network via gateways.

    Look at

    The dates and times of access to ensure there are no irregular or unexpected patterns.

    Good evidence

    Log will show a small number of failed attempts and all accesses during expected work hours.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Evidence of training sessions: Collect records or attendance lists from security training sessions about the authentication process.

    Look at

    Proof that all staff, especially new hires, attended the sessions. A well-documented training process is an indicator that staff understand and follow security protocols.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To review recent access changes: Request documentation of recent staffing changes and corresponding updates to access rights through the gateways.

    Look at

    Quick action in adding or removing users from the system. Proper documentation will show timely updates aligning with hiring or terminations.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To observe a verification test: Have a member of staff demonstrate the authentication process for accessing the network.

    Look at

    Smooth operation without workarounds or shortcuts. A well-functioning system will consistently prompt for credentials and log access accurately.

Mappings

Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.5Secure authentication technologies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.