Skip to content
Cryptography
ASD ISMISM-1373

ASD ISM 1373 Ensure TLS Connections do not use Anonymous DH

What it says

Anonymous DH is not used for TLS connections.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Do not use Anonymous Diffie-Hellman for secure connections to prevent security vulnerabilities.

This control is about making sure that when your systems talk to each other securely over the internet, they don't use a risky shortcut called Anonymous Diffie-Hellman (DH). If this shortcut is used, it leaves the door open for cybercriminals to sneak in and eavesdrop on your private information. Imagine hiring a security guard who doesn't ask your name or ID; that's what Anonymous DH effectively does.

Why it matters

Using Anonymous DH exposes TLS sessions to man-in-the-middle attacks, enabling interception or alteration of sensitive data in transit.

How to implement

  1. IT team should review the current transport security settings: They need to check the systems and servers to ensure Anonymous DH is not used.

    This involves looking into the configuration files of each system to confirm that stronger methods, like encrypted certificates, are used instead.

  2. System owner should regularly engage cyber security consultants: Hire experts periodically to check that your systems comply with modern security standards, particularly avoiding Anonymous DH.

    This can be done by scheduling annual external security audits and reviewing the findings.

  3. Management should ensure IT staff are up-to-date on best practices: Organise regular training sessions to educate your team on the latest in secure communications protocols.

    By attending webinars and workshops, the IT team can stay informed on regulatory changes and new risks.

  4. Procurement should involve IT in purchasing decisions: When buying new hardware or software, get the IT team to review security configurations to ensure they do not employ Anonymous DH by default.

    This involves a pre-purchase checklist review of security standards and consultant vetting.

  5. Leadership should establish a clear security policy: A policy should be documented stating Anonymous DH is not allowed.

    This includes creating a clear employee handbook or guideline that outlines the secure methods each team must use to protect communications.

Keep it running

Audit TLS configs to disable ADH/anon cipher suites (e.g., ADH-*) and confirm servers only offer authenticated DHE/ECDHE suites after changes.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The transport security configuration documentation: Request detailed setup guides or records from IT showing what protocols are enabled.

    Look at

    Specific mentions that Anonymous DH is disabled.

    Good evidence

    Includes detailed configuration files indicating use of secure protocols only.

  2. Check 2 of 5What an auditor asks for

    Look at

    The protocols initiated during recent secure sessions.

    Good evidence

    Will show only authorised protocols such as HTTPS or TLS with certificates being used.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training records regarding protocol use: Request evidence of staff training on secure protocols.

    Look at

    Signed attendance sheets or certificates from recent training sessions.

    Good evidence

    Includes documentation of recent IT training that included avoidance of Anonymous DH.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Reports from recent security evaluations focusing on communication protocol checks.

    Look at

    Details about the checking of Anonymous DH usage.

    Good evidence

    Outcome shows reports where experts confirm secure practices.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Policy documentation: Obtain the company's security policy documents that should mention the prohibition of Anonymous DH.

    Look at

    Sections focused on TLS configurations and required security measures.

    Good evidence

    Is a clear policy statement forbidding Anonymous DH in secure communications.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.