ASD ISM 0998 Using integrity algorithms for IPsec connections
What it says
AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with AES-GCM) is used for authenticating IPsec connections, preferably NONE.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse specific algorithms for authenticating IPsec connections, preferring none if AES-GCM is used.
This control is about ensuring the data that travels over the internet is genuine and hasn't been tampered with during transmission. It requires using specific methods to check the authenticity of the data. This is crucial because if this isn't done, false or harmful data could be sent or received, leading to potential data breaches or system disruptions.
Free. Save your status, tasks and notes.
Why it matters
Weak or incorrect IPsec integrity algorithms allow packet tampering/spoofing, risking unauthorised access and data compromise.
How to implement
The IT manager should identify where IPsec connections are used in the organisation.
Make a list of all systems that rely on these secure communication channels, so the right integrity checks can be applied.
The network security specialist should configure IPsec connections to use one of the approved algorithms.
This can be done by adjusting settings in the network's routers or firewalls to include AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, or AUTH_HMAC_SHA2_512_256, or by selecting 'none' only if AES-GCM is already in use.
The IT team should test each IPsec connection to ensure it is using the required settings.
After configuration, run network tests and monitor logs to confirm the integrity algorithms are correctly implemented and functioning as expected.
The security officer should document the configurations.
Keep a detailed record of each system's IPsec setup, noting which algorithm is used, for future audits or troubleshooting.
Technical staff should regularly review and update these integrity settings.
As part of maintenance, check periodically that systems are using the latest recommended algorithms to keep up with emerging security threats.
Keep it running
Configure IPsec to use AUTH_HMAC_SHA2_256_128/384_192/512_256, or NONE only when using AES-GCM; regularly verify peer proposals.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The IPsec configuration documentation: Request records that detail how IPsec is set up on each networked system.
Look at
Notes on which integrity algorithms are in use.
Good evidence
Will include authorised settings and a rationale for any 'none' selections with AES-GCM.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of the network configuration: Have the IT team walk you through the router or firewall settings.
Look at
The specific fields where integrity algorithms are set in use.
Good evidence
Shows accurate and compliant settings matching the documentation.
- Check 3 of 5What an auditor asks for
Ask for
Network log reports: Request logs of IPsec traffic that include data on the algorithms used.
Look at
Timestamps and check consistency with network usage patterns.
Good evidence
Shows regular traffic flows using the specified security settings.
- Check 4 of 5What an auditor asks for
Ask for
About the monitoring process: Inquire how the IT team monitors IPsec connections for compliance.
Look at
Procedures and tools used for this purpose.
Good evidence
Includes records of regular checks and timely updates when protocols change.
- Check 5 of 5What an auditor asks for
Ask for
Audit trail records: Seek the formal records of past changes to IPsec configurations.
Look at
Audit reports or change management documents.
Good evidence
Should include change dates, responsible personnel, and reasons for configuration changes.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0998 mandates approved integrity/authentication algorithms for IPsec connections, with a preference for using NONE when AES-GCM provides integrated authentication, to meet cryptographic integrity requirements in transit. Annex A 8.24 requires rules for effective use of cryptography and cryptographic key management to be defined and implemented, which would typically include specifying permitted VPN/IPsec algorithms and modes. ISM-0998 is a concrete algorithm-selection rule for a specific protocol, while Annex A 8.24 is a broader governance and implementation control covering cryptography across the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.