ASD ISM 1000 Utilising perfect forward secrecy for IPsec
What it says
PFS is used for IPsec connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse PFS to ensure past IPsec keys can't be used if current ones are compromised.
Perfect Forward Secrecy (PFS) is like changing the locks every time someone opens the door, ensuring that if a key is stolen, it can't be used to unlock the door in the future. This is important for securing communications because if someone gets hold of your current security keys, they won't be able to access past messages, keeping your sensitive information safe.
Free. Save your status, tasks and notes.
Why it matters
Without IPsec PFS, a compromised key can allow decryption of previously captured VPN traffic, exposing sensitive data.
How to implement
IT team should review current IPsec settings to ensure PFS is enabled.
This involves checking the configuration files on network devices to see if PFS settings, like key group exchange methods, are turned on.
The network administrator should configure devices to use encryption methods that support PFS.
This can be done by consulting documentation for each device type, like routers or firewalls, and applying settings that specify using PFS-compatible algorithms.
Managers should verify that all staff handling cyber security understand the importance of PFS in protecting past communications.
They can arrange training sessions or workshops that explain how PFS works and its role in securing data.
System owners should regularly update device firmware and patches to maintain PFS capabilities.
This involves setting up a schedule to automatically check for vendor updates and apply them to all IPsec-connected devices.
IT support staff should verify that PFS is operational after changes to the network.
They can conduct regular tests using network traffic simulators to ensure that security keys are changing as expected with each new session.
Keep it running
Ensure IPsec VPNs use PFS in phase 2 (ESP). Periodically verify IKE/IPsec proposals and rekey settings enforce PFS.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The PFS configuration documentation: Request the configuration settings or screenshots from network devices that show PFS is enabled.
Look at
The encryption settings to ensure PFS groups or algorithms are selected.
Good evidence
Documentation shows strong, up-to-date PFS settings enabled on all relevant devices.
- Check 2 of 5What an auditor asks for
Ask for
Network device firmware updates records: Verify records showing regular updates were applied to all devices supporting PFS.
Look at
Update logs or change control forms.
Good evidence
Up-to-date logs indicating all critical devices are regularly patched with the latest PFS-supporting updates.
- Check 3 of 5What an auditor asks for
Ask for
Documentation proving that relevant staff have been trained in PFS and its importance.
Look at
Attendance lists and training content.
Good evidence
Lists of participants along with materials that clearly explain PFS benefits and setup.
- Check 4 of 5What an auditor asks for
Ask for
A schedule of PFS testing: Request documentation showing when and how PFS effectiveness has been tested recently.
Look at
Testing logs and results.
Good evidence
A routine testing record showing that PFS was successfully verified to be operational in all tests conducted.
- Check 5 of 5What an auditor asks for
Ask for
Security policy documents: Request the organisation's cyber security policy that includes mention of PFS.
Look at
Policy details and revision dates.
Good evidence
A clearly written, formal document outlining PFS implementation and including recent updates or reviews.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1000 requires the use of PFS for IPsec connections to limit the impact of key compromise across sessions. Annex A 8.24 requires rules for effective use of cryptography and cryptographic key management to be defined and implemented, under which requiring PFS for VPNs/IPsec is a concrete key-management/crypto-policy rule. ISM-1000 is a specific implementation detail (PFS on IPsec), whereas Annex A 8.24 covers cryptography and key management across all relevant use cases, algorithms, and lifecycle practices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.