ASD ISM 1370 Ensure only server-initiated TLS renegotiation
What it says
Only server-initiated secure renegotiation is used for TLS connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly the server can start secure renegotiation for TLS connections to maintain security.
This control means that only the server, and not the user's computer, can start or restart a secure connection. This is crucial because if a user's device could start this process, a hacker might trick the connection into becoming less secure, putting sensitive information at risk.
Free. Save your status, tasks and notes.
Why it matters
Without server-controlled TLS renegotiation, systems face increased risk of DoS or connection hijacking, leading to potential data breaches.
How to implement
The IT team should configure all servers to control how secure connections start.
They can adjust server settings to make sure only the server can initiate these connections by checking options in the server's security settings.
System administrators should verify that software updates for servers are applied to keep security settings up to date.
Regularly apply patches and updates to fix any potential security holes that could let others control connections.
IT professionals should use testing tools to simulate server-initiated and non-server-initiated connection attempts.
This will help identify whether the current server settings correctly allow only the server to start secure connections.
Security personnel should create a network policy that clearly states the server's role in initiating TLS renegotiation.
Distribute this policy among the IT team to ensure consistent understanding and application.
Managers should organise training sessions for the IT team on the importance of server-initiated secure connections.
These sessions can help reinforce best practices in maintaining secure communication over the network.
Keep it running
Configure TLS to reject client-initiated renegotiation and allow only server-initiated secure renegotiation; verify with TLS scanners after changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The server configuration documentation: Request the server settings that specify who can initiate secure connections.
Look at
Explicit settings where only the server is allowed to start the connection.
Good evidence
Will show settings or scripts that enforce this rule.
- Check 2 of 5What an auditor asks for
Ask for
The network policy documents: Review policies regarding TLS connection management.
Look at
Clear guidelines on server-controlled renegotiation. Good documentation will include steps to maintain these settings and the responsible parties.
- Check 3 of 5What an auditor asks for
Ask for
Logs or records of a recent security check: Check if the IT team has logged and reviewed connection attempts to ensure they follow the protocol.
Good evidence
Will have a log showing attempts were made and correctly controlled by the server.
- Check 4 of 5What an auditor asks for
Ask for
To see recent server update and patch records: Verify that servers have been updated to close any known security risks tied to connection initiation vulnerabilities. Good records will show regular updates and patches applied.
- Check 5 of 5What an auditor asks for
Ask for
Training records: Request evidence of recent training conducted for IT staff on server security settings. Confirm that they cover server-initiated connections.
Good evidence
Is a dated attendance list and training materials reviewed.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1370 requires TLS connections to permit only server-initiated secure renegotiation, reducing exposure to renegotiation-related weaknesses. Annex A 8.24 requires rules for effective use of cryptography and key management, which would typically include specifying acceptable TLS protocol behaviours and secure configuration standards. ISM-1370 is a specific technical cryptographic configuration requirement, while Annex A 8.24 is broader and policy/standard-driven across cryptography and key management beyond TLS renegotiation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.