ASD ISM 1427 Prevent IP source address spoofing in gateways

IT team should configure the gateway: Ensure the gateway devices are set up to check all incoming traffic for fake addresses.

This can be done by adjusting the settings on your firewall or router to verify that incoming requests are from legitimate and known sources.

System administrator should update filtering rules: Regularly update the rules that the gateway uses to identify fake addresses.

This includes staying informed about current threats by reviewing cyber security advisories from the Australian Cyber Security Centre (ACSC).

Network engineer to monitor logs: Set up a system where network logs are reviewed daily to spot any anomalies.

This involves checking for repeated access attempts from unusual locations which might indicate spoofing attempts.

Business owner to establish a review schedule: Schedule quarterly reviews of gateway security with the IT team.

Include a review of the logs, settings, and any incidents to ensure everything is functioning correctly.

Manager to provide training: Ensure that staff responsible for network monitoring are trained in recognising signs of IP spoofing.

This includes recognising unusual patterns in the logs and knowing the correct escalation procedures.