ASD ISM 1030 Deploy NIDS/NIPS for gateway traffic monitoring
What it says
A NIDS or NIPS is located immediately inside the outermost firewall for gateways and configured to generate event logs and alerts for network traffic that contravenes any rule in a firewall ruleset.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInstall and configure systems to detect and alert on unauthorised network traffic past the main firewall.
This control is about placing systems that will watch over your network right inside your main firewall. These systems alert you if something suspicious gets through, which is crucial because it helps catch potential threats before they can do damage. Without it, harmful activities could go unnoticed, leading to data breaches or system disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without a NIDS/NIPS inside the outermost gateway firewall, traffic breaching firewall rules may go unlogged and undetected, enabling compromise.
How to implement
The IT team should install a Network Intrusion Detection System (NIDS) or Network Intrusion Prevention System (NIPS) just inside the main firewall.
They can do this by choosing a reliable system, setting it up physically in the network, and ensuring it's plugged into the correct network segment.
The IT manager should configure the NIDS/NIPS to monitor for suspicious traffic.
This involves setting it up to compare network activity against a set of rules or patterns that signal unauthorised actions.
System administrators should ensure the NIDS/NIPS generates logs and alerts.
They need to configure the system to automatically record whenever it detects suspicious activities and send alerts to the security team.
The security team should regularly review the alerts generated by NIDS/NIPS.
They should check these alerts daily to understand if there are recurring issues and resolve them promptly.
The procurement officer should ensure there is a budget for regular maintenance and updates of the NIDS/NIPS.
This can be done by liaising with IT to understand the system's requirements and including these costs in the financial planning.
Keep it running
Place the NIDS/NIPS immediately inside the outermost gateway firewall and tune signatures to alert/log any traffic that contravenes firewall rules.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network diagram: Request the document that shows where the NIDS/NIPS is installed.
Look at
Its position relative to the main firewall.
Good evidence
The diagram should show the NIDS/NIPS placed immediately inside the main firewall.
- Check 2 of 5What an auditor asks for
Ask for
The alert log: Request logs from the NIDS/NIPS that record unusual activities.
Look at
Entries that detail what was detected and when.
Good evidence
Regular entries indicating detection attempts with timestamps and actions taken.
- Check 3 of 5What an auditor asks for
Ask for
Configuration documentation: Request the setup guidelines for the NIDS/NIPS.
Look at
Whether rules align with organisation's security policies.
Good evidence
Detailed configurations showing compliance with security standards and policies.
- Check 4 of 5What an auditor asks for
Ask for
Security team training records: Request proof of staff training on responding to NIDS/NIPS alerts.
Look at
Training dates and contents.
Good evidence
Recent and regular training records with clear objectives and attendee lists.
- Check 5 of 5What an auditor asks for
Ask for
A maintenance report: Request evidence of regular checks and updates.
Look at
Frequency and detail of maintenance activities.
Good evidence
A report showing scheduled upkeep, software updates, and any issue resolutions.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
ISM-1030 requires NIDS/NIPS-generated event logs and alerts for gateway traffic that breaches firewall rules. Annex A 8.15 requires producing, storing, protecting and analysing logs for activities, exceptions and other relevant events across the organisation's systems. ISM-1030 is a specific log source and alerting requirement at the perimeter, while Annex A 8.15 is broader log management and analysis across many systems and does not prescribe IDS/IPS deployment or placement.
This control partially meets A.8.16.
ISM-1030 requires deploying a NIDS/NIPS at the gateway perimeter and generating event logs and alerts for traffic that contravenes firewall rules. Annex A 8.16 requires monitoring networks/systems/applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents, which commonly includes IDS/IPS capabilities at network boundaries. ISM-1030 is narrower because it specifies a particular control location and detection basis (firewall rule violations), whereas Annex A 8.16 covers wider anomaly monitoring and response across many environments.
This control partially meets A.8.20.
Annex A 8.20 requires networks to be secured, managed and controlled, which includes monitoring and detecting unauthorised or policy-violating network activity. ISM-1030 supports this by requiring a NIDS/NIPS inside the outermost firewall for gateways and alerting on traffic that contravenes firewall rules, strengthening detection and response for perimeter control failures. Annex A 8.20 is broader because it covers overall network security, whereas ISM-1030 is a specific monitoring placement and configuration requirement.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-MF-ML2.8.
E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1030 requires deploying a NIDS/NIPS inside the outermost firewall and generating logs/alerts for traffic that contravenes firewall rules, which contributes additional detection telemetry relevant to internet-facing exposure. They overlap on monitoring and detection via log review, but ISM-1030 focuses on gateway network traffic controls rather than server event log analysis.
This control supports E8-AH-ML2.15.
E8-AH-ML2.15 requires organisations to analyse cyber security events in a timely manner to identify incidents. ISM-1030 requires deploying a NIDS/NIPS at gateways and configuring it to generate event logs and alerts, which is a key prerequisite source of cyber security events for timely analysis. ISM-1030 focuses on implementing a specific detection capability at the network perimeter, while E8-AH-ML2.15 is the broader analytical and incident-identification requirement once events are generated.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.