Skip to content
Cryptography
ASD ISMISM-1453

ASD ISM 1453 Ensure PFS is enabled for TLS connections

What it says

Perfect Forward Secrecy (PFS) is used for TLS connections.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

TLS connections must be set up to protect past data even if the server's private key is compromised.

This control is about using something called Perfect Forward Secrecy (PFS) to protect data transferred online. It ensures that even if someone gets hold of the keys used to secure these transfers, they can't access past data. Without PFS, if a hacker steals a key, they could unlock all your previous communications, risking a breach of private or sensitive information.

Why it matters

Without PFS, a stolen TLS private key can decrypt previously captured sessions, exposing historical sensitive data and enabling major breaches.

How to implement

  1. IT Team should check if Perfect Forward Secrecy is supported: They need to review the configuration of your TLS (Transport Layer Security) settings on servers.

    To do this, update server configurations to only allow PFS-supporting cipher suites, which decide how your data is encrypted during transfer.

  2. System Owners should work with IT to ensure compatibility: Communicate with IT to confirm that all your systems and applications are compatible with the latest TLS configurations.

    Ensure any legacy systems are updated or replaced to support PFS.

  3. Procurement managers should include PFS as a requirement: When buying new systems or software, ensure vendors commit to PFS in their security specifications.

    Include this requirement in all tenders and contracts to ensure compliance.

  4. IT Team should regularly update software: Ensure all software and servers involved in data transmission are kept up-to-date with the latest security patches.

    This helps maintain the efficacy of PFS as vulnerabilities are discovered and fixed over time.

  5. Conduct regular training for IT staff: Organise sessions to keep the team informed about PFS and how to manage TLS settings effectively.

    Encourage them to document their processes and share insights to maintain consistent security standards.

Keep it running

Audit TLS to allow only ECDHE/DHE suites (PFS) and disable RSA key exchange. Re-test after updates to ensure forward secrecy remains enabled.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Server configuration files: Review the settings to confirm PFS-enabled cipher suites are the only ones active.

    Look at

    Restrictive options that only allow secure connections.

    Good evidence

    Will show PFS-only configurations without exceptions.

  2. Check 2 of 5What an auditor asks for

    Look at

    Which applications and services use secure communications. Check for recent updates and TLS settings support, confirming PFS implementations.

    Good evidence

    Will include documentation showing that all key apps are updated and configured to use PFS.

  3. Check 3 of 5What an auditor asks for

    Good evidence

    Includes documented obligations from suppliers to support PFS in their solutions.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Staff training logs.

    Look at

    Records of IT training sessions focused on security and TLS management.

    Good evidence

    Demonstrates regular sessions, attendance records, and updated training materials.

  5. Check 5 of 5What an auditor asks for

    Good evidence

    Highlights a recent analysis that confirms no unsupported cipher suites are enabled.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.