ASD ISM 1402 Protecting stored credentials with security measures
What it says
Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing and stretching them before storage within a database.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStore credentials securely using a password manager, hardware module, or by enhancing them with techniques before saving.
Storing credentials safely is like locking away your most important keys and passwords so only you can access them. If this isn't done, your sensitive information like bank details or personal data could be at risk of being stolen, leading to potential financial loss or identity theft.
Free. Save your status, tasks and notes.
Why it matters
If credentials aren't stored in a password manager, HSM, or salted/hashed/stretched in a database, attackers can recover passwords and gain unauthorised access.
How to implement
The IT team should implement a password manager to store credentials securely.
They can do this by researching and selecting a reputable password manager and ensuring all staff are trained on how to use it effectively.
System administrators should use a hardware security module to enhance the protection of stored credentials.
This involves setting up the hardware module to work with your existing systems and ensuring it is configured to encrypt sensitive information.
Managers should ensure that stored passwords and credentials are protected through techniques like salting and hashing before they go into a database.
This means using software tools to transform the credentials so they are not stored in their original form.
The IT department should stretch passwords in databases to make them stronger against attacks.
They can accomplish this by applying algorithms that increase the time it takes for passwords to be cracked by unauthorised users.
HR and IT should collaborate to periodically review and update the way credentials are stored to adapt to new security threats.
They should schedule regular check-ins to audit credential storage practices and make improvements as needed.
Keep it running
Ensure stored credentials are only kept in an approved password manager or HSM; for databases, verify salting plus strong hashing and stretching parameters and review them periodically.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A demonstration of the password manager software in use: Check that all critical systems use the selected password manager and that staff are trained on it.
Good evidence
Would be seeing a list of all active accounts with updated credentials securely stored within the manager.
- Check 2 of 5What an auditor asks for
Look at
Evidence that sensitive credentials are encrypted using the module.
Good evidence
Result shows that all necessary systems integrate with the module, with logs indicating regular use.
- Check 3 of 5What an auditor asks for
Good evidence
Would include detailed records of the implemented techniques and their effective use.
- Check 4 of 5What an auditor asks for
Good evidence
Will include documentation on the applied methods and any testing results showing increased password resilience.
- Check 5 of 5What an auditor asks for
Ask for
To see evidence of regular credential storage reviews: Review meeting records to ensure they show any identified weaknesses and proposed improvements.
Good evidence
Is a documented record of continuous improvements with assigned actions and completion dates.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.17.
ISM-1402 requires organisations to protect stored credentials using password managers, HSMs, or secure hashing methods before storage. ISO/IEC 27001:2022 Annex A 5.17 overlaps by requiring the allocation and management of authentication information to be controlled, including guidance on appropriate handling. Annex A 5.17 is broader in governance and lifecycle of authentication information, whereas ISM-1402 is a specific technical requirement for protecting credentials at rest.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-RA-ML3.6.
ISM-1402 requires credentials stored on systems to be protected using mechanisms such as password managers, hardware security modules, or salted/hashed/stretched storage. E8-RA-ML3.6 strengthens this outcome by enabling Windows Credential Guard to better protect cached and stored credentials from theft on endpoints. E8-RA-ML3.6 is platform-specific and focused on OS credential isolation, while ISM-1402 also covers secure storage within applications and databases.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-13.2Store keys, secrets and tokens in approved, access-controlled repositories with MFAPartially overlaps
This control partially overlaps IT.PRO-13.2.
IT.PRO-13.2 requires authentication keys, secrets and tokens to be stored in approved secure repositories with access controls and MFA; ISM-1402 names specific protections for stored credentials: a password manager, a hardware security module, or salting, hashing and stretching.
This control partially overlaps IT.PRO-13.3.
IT.PRO-13.3 requires regular scans of codebases, configuration files, file shares and collaboration tools to find and fix unsecured keys, secrets and credentials; ISM-1402 sets the protection stored credentials need: a password manager, a hardware security module, or salting, hashing and stretching.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.