ASD ISM 1055 Disable insecure LAN manager authentication
What it says
LAN Manager and NT LAN Manager authentication methods are disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystems must disable outdated LAN Manager and NT LAN Manager authentication to enhance security.
This control is about turning off old, insecure ways of logging into computers and systems, known as LAN Manager and NT LAN Manager. These methods are outdated and can be easily hacked, putting your sensitive information at risk if they remain active.
Free. Save your status, tasks and notes.
Why it matters
If LAN Manager/NTLM authentication remains enabled, attackers can force downgrades and capture weak hashes, enabling credential cracking and unauthorised access.
How to implement
The IT team should disable LAN Manager and NT LAN Manager on all systems.
This can be done by accessing the system settings on each computer and choosing the option to turn off these authentication methods. Follow the guidelines provided by the software manufacturer or refer to the Australian Cyber Security Centre (ACSC) for detailed instructions.
System owners should ensure that all team members are aware of the change and understand how to log in securely using updated methods.
Host a workshop or send out a guide via email that explains the new login process and why these changes are necessary for security.
Managers should maintain regular communication with the IT team to verify that outdated authentication is disabled on newly acquired systems.
Implement a standard procedure for checking settings during the setup of any new device, ensuring these old methods are turned off from the start.
The IT team should keep system software and anti-virus applications up to date to complement the disabling of insecure authentication.
This can be achieved by scheduling regular updates and monitoring alerts from the system's software providers.
Business leaders should involve a cyber security consultant to conduct an annual security review that includes checking for deactivated LAN Manager authentication, ensuring compliance with the latest industry standards and best practices.
Keep it running
Verify Group Policy/security options disable LM and NTLMv1, and monitor for policy drift so legacy authentication methods are not re-enabled by updates.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A system configuration report: Request documentation that shows authentication settings for all networked systems.
Look at
The specific configuration details for each system.
Good evidence
Is a report indicating that both LAN Manager and NT LAN Manager are disabled.
- Check 2 of 5What an auditor asks for
Ask for
Records of IT team training sessions: Request evidence of training or communication about the changes to authentication methods.
Look at
The dates and content covered.
Good evidence
Is documentation showing clear communication about disabling these outdated methods.
- Check 3 of 5What an auditor asks for
Ask for
A list of recently purchased devices: Request records of new systems and the setup procedures followed.
Look at
Evidence that these devices had LAN Manager authentication disabled during initial setup.
Good evidence
Includes detailed setup checklists with completed tasks.
- Check 4 of 5What an auditor asks for
Ask for
The results of a security audit: Request the latest cyber security audit report.
Look at
Sections addressing authentication methods and check the findings.
Good evidence
Is a report confirming that LAN Manager is not used within the organisation.
- Check 5 of 5What an auditor asks for
Ask for
A policy document on system authentication: Request to see internal policies about secure login methods.
Look at
How these policies are being applied.
Good evidence
Includes documented policy directions to disable insecure authentication methods across the organisation.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.5.
ISM-1055 requires organisations to disable insecure legacy authentication protocols (LAN Manager and NTLM variants) to reduce credential compromise risk. Annex A 8.5 requires implementing secure authentication technologies and procedures appropriate to access restrictions, which would typically include prohibiting weak legacy authentication methods. Annex A 8.5 is broader and technology-agnostic (covering authentication approaches generally), while ISM-1055 is a specific hardening requirement for Windows/SMB authentication.
This control partially meets A.8.9.
ISM-1055 requires a specific security configuration: disabling LAN Manager and NT LAN Manager authentication methods. Annex A 8.9 requires organisations to establish, document, implement, monitor and review security configurations across hardware, software, services and networks, under which disabling insecure authentication protocols is a typical baseline setting. Annex A 8.9 is broader because it covers configuration management as a discipline, while ISM-1055 is one concrete configuration item within that discipline.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.5Disable legacy authentication protocols and restrict, monitor and decommission exceptionsPartially overlaps
This control partially overlaps IT.PRO-13.5.
IT.PRO-13.5 requires legacy authentication protocols to be disabled or, if not feasible, restricted, monitored and scheduled for decommissioning; ISM-1055 requires LAN Manager and NT LAN Manager authentication methods to be disabled, a specific case naming two methods.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.