ASD ISM 1006 Prevent unauthorised access to network traffic
What it says
Security measures are implemented to prevent unauthorised access to network management traffic.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSecurity measures are in place to ensure that only authorised users can access network management systems.
This control is about making sure only the right people can access and control your network systems. Imagine if someone unwanted got into your network, they could steal data, disrupt services, or even take over your systems. This control helps prevent that by keeping unauthorised users out of your network management areas.
Free. Save your status, tasks and notes.
Why it matters
If network management traffic is accessed by unauthorised parties, attackers can capture credentials, alter configurations, and take control of network devices.
How to implement
Managers should ensure that only authorised staff are on the list of those allowed to access network management systems.
They can do this by working with the IT team to identify and review all individuals who currently have access, making sure these people should indeed have it, and updating the list regularly.
The IT team should implement strong passwords and regular password changes for anyone accessing network management systems.
This can be done by setting password policies in the system that require a mix of letters, numbers, and symbols, and prompting users to update their passwords every few months.
System owners should work with the IT team to set up network segmentation.
This means dividing the network into smaller parts so that if one area is compromised, the rest remains safe. They can achieve this by creating sub-networks or using virtual local area networks (VLANs) to isolate network management traffic.
The IT team should establish logging and monitoring of all access to network management systems.
This involves setting up software that records who accesses what and when, and reviewing these logs regularly for any unusual behaviour.
Managers should ensure ongoing staff training on the importance of network security.
They can organise regular workshops or online courses to teach employees about security best practices, reminding them of the dangers of unauthorised access and how to prevent it.
Keep it running
Encrypt network management traffic (e.g., SSH/SNMPv3/TLS), restrict admin access, and log/alert on unauthorised attempts to management interfaces.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of authorised users who can access network management systems: Verify its existence and whether it's up to date.
Look at
Clear identification of each individual and the date of their last access review.
Good evidence
Includes a current list with evidence of regular updates.
- Check 2 of 5What an auditor asks for
Ask for
Evidence of password policy enforcement: Request documentation showing how strong passwords are mandated and changed regularly.
Look at
The configuration settings and user compliance records.
Good evidence
Shows a robust password policy applied across all users.
- Check 3 of 5What an auditor asks for
Ask for
Network diagrams that show segmentation: Verify if the network is divided into segments to restrict access.
Look at
Labels or annotations that clearly indicate separated parts of the network.
Good evidence
Includes a clearly segmented network with restricted access to sensitive areas.
- Check 4 of 5What an auditor asks for
Ask for
To see recent access logs for network management systems: Request details on how access is tracked and audited.
Look at
Completeness of logs, including date and time stamps, user IDs, and actions performed.
Good evidence
Shows comprehensive logs with no unexplained anomalies.
- Check 5 of 5What an auditor asks for
Ask for
About staff training records: Request documentation or a schedule that shows when staff were last trained on network security.
Look at
Training modules or attendance records that confirm participation.
Good evidence
Includes recent and recurring training sessions, with broad staff participation.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-1006 requires security measures to prevent unauthorised access to network management traffic. ISO/IEC 27001:2022 Annex A 5.15 requires access control policies and procedures for controlling physical and logical access to information assets, which would include governing access to network management systems and their management traffic. ISM-1006 is a specific requirement within that broader access control policy framework.
This control partially meets A.8.3.
ISM-1006 requires security measures to prevent unauthorised access to network management traffic. ISO/IEC 27001:2022 Annex A 8.3 requires organisations to restrict access to information and associated assets in accordance with access control policy, which would include restricting access to network management systems and the management traffic they generate. ISM-1006 is a specific application of access restriction to the network management plane, while Annex A 8.3 applies across all information assets.
This control partially meets A.8.20.
Annex A 8.20 requires networks and network devices to be secured and controlled, including protection of administrative and management planes. ISM-1006 directly supports this by requiring measures to prevent unauthorised access to network management traffic, reducing the risk of device takeover and configuration tampering. Annex A 8.20 is broader as it covers all network traffic and device security controls, not only management-plane traffic protections.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.