Skip to content
Gateways
ASD ISMISM-0637

ASD ISM 0637 Implementing demilitarised zones in gateways

What it says

Gateways implement a demilitarised zone if external parties require access to an organisation's services.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Gateways use demilitarised zones to safely allow outside parties access to organisational services.

A Demilitarised Zone (DMZ) in networking is like a buffer area that helps protect an organisation's internal network when dealing with outside parties. Think of it as a way to show outsiders what they need to see without letting them roam around where they're not supposed to be. Without a DMZ, you risk exposing sensitive parts of your network, which can lead to data breaches or unauthorised access.

Why it matters

Without a DMZ, internet-facing services can expose internal networks directly, increasing the likelihood of unauthorised access and data breaches.

How to implement

  1. IT Team should identify the services that need to be accessed by outside parties.

    Begin by listing services that must be externally accessible, like email servers or web servers. Ensure they are isolated from sensitive internal systems by placing them in the DMZ.

  2. System administrators should configure a firewall around the DMZ.

    Set up firewall rules that limit which internal resources can be accessed from the DMZ and vice versa, allowing only necessary traffic.

  3. IT Team should regularly update and patch systems in the DMZ.

    Schedule frequent checks to ensure all applications and systems are up to date to prevent vulnerabilities.

  4. Security manager should organise training for staff on DMZ usage policies.

    Explain the importance of the DMZ and how it helps protect core network services, making sure everyone understands the rules about which systems can and cannot be accessed externally.

  5. The network manager should monitor traffic in and out of the DMZ.

    Utilise network monitoring tools to track unusual patterns that might indicate a security threat, and create alerts for abnormal behaviour.

Keep it running

Review DMZ firewall rules and segmentation regularly, and monitor DMZ logs for suspicious inbound traffic to ensure internet access cannot reach internal networks.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The network architecture diagram.

    Look at

    Which systems are placed in the DMZ and ensure they are separate from internal networks.

    Good evidence

    Diagram clearly showing isolated DMZ with limited access routes to internal resources.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Firewall configuration files.

    Look at

    The rules set for traffic through the DMZ.

    Good evidence

    Configurations showing restricted access, allowing only the necessary external connections.

  3. Check 3 of 5What an auditor asks for

    Look at

    Timelines showing regular patch updates.

    Good evidence

    Records demonstrating consistent patching and updating of systems in the DMZ.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Staff training records on DMZ policies.

    Look at

    Attendance records and training material.

    Good evidence

    Documentation of recent training sessions with attendee signatures and content covered.

  5. Check 5 of 5What an auditor asks for

    Look at

    Alerts and incidents related to DMZ traffic.

    Good evidence

    Logs showing active monitoring and a history of threat detection and response.

Mappings

Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.22Network segregation for securityPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.