Skip to content
Cryptography
ASD ISMISM-1375

ASD ISM 1375 Use SHA-2 for secure TLS connections

What it says

SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudorandom function (PRF) for TLS connections.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

TLS connections must use SHA-2 for better security, acting as a key and message verifier.

This control means that when you are using secure connections over the internet, the technology behind it should use something called SHA-2, which is like a lock and key system to keep information private and prevent tampering. It's important because if the technology used is outdated or weak, then data could be stolen or changed by cyber criminals, leading to data breaches or financial losses.

Why it matters

Using outdated hash algorithms for TLS like SHA-1 can lead to vulnerabilities, risking data confidentiality and integrity during internet communications.

How to implement

  1. The IT team should ensure that all software used for secure internet connections, such as websites and email servers, are configured to use the SHA-2 hashing algorithm.

    This can be done by checking the software settings and upgrading or applying patches if necessary.

  2. Business owners should consult with a trusted IT consultant to review their current internet security systems to verify if SHA-2 is being used.

    Set up an initial assessment to discuss any needed changes and potential risks of not updating.

  3. System administrators should update the configuration settings of any Transport Layer Security (TLS) connections to use SHA-2 as the secure hashing method.

    This involves accessing server configuration files and adjusting the security suite settings accordingly.

  4. The procurement team should make sure that new technology purchases, especially those involving secure communications, are specified to support SHA-2.

    This includes checking product specifications and confirming it with the vendor before purchase.

  5. Office managers should schedule regular check-ins with the IT team to ensure that all systems remain compliant with security standards using SHA-2 for encryption, assisting in maintaining an ongoing security posture.

Keep it running

Verify TLS is configured to use SHA-2 for HMAC/PRF and monitor for unexpected downgrade to SHA-1 in negotiated cipher suites.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The server configuration documentation: Request documents that show the server's setup for secure connections.

    Look at

    The encryption protocol settings to confirm that SHA-2 is specified.

    Good evidence

    Includes a documented list indicating SHA-2 as the preferred hashing algorithm.

  2. Check 2 of 5What an auditor asks for

    Ask for

    A report from the IT security audit confirming SHA-2 implementation: Request the latest security audit report.

    Look at

    Notes verifying that SHA-2 supports secure transactions.

    Good evidence

    Would clearly highlight where SHA-2 is used throughout secure systems.

  3. Check 3 of 5What an auditor asks for

    Ask for

    To see the purchase orders for recent IT systems: These should show specifications or requirements for SHA-2 support.

    Look at

    Any agreements or assurances from suppliers indicating SHA-2 compatibility.

    Good evidence

    Should have comprehensive documentation backing the SHA-2 requirement.

  4. Check 4 of 5What an auditor asks for

    Ask for

    The security policy documents: Check that the organisational security policy mandates the use of SHA-2 for all relevant systems.

    Look at

    Specific references to SHA-2 in the document.

    Good evidence

    Includes a clearly outlined policy specifying SHA-2 as a mandatory standard.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Evidence of any recent IT staff training: Examine training session outlines or modules that cover secure TLS practices, including SHA-2.

    Look at

    Trainings that cover why SHA-2 is important.

    Good evidence

    Is detailed training records showing SHA-2 knowledge has been shared with the IT staff.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.