ASD ISM 1454 Enhancing security with encrypted RADIUS communications
What it says
Communications between authenticators and a RADIUS server are encapsulated with an additional layer of encryption using RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure RADIUS server communications are encrypted for increased security.
This control requires using encryption to protect information sent between devices that verify user identities (called authenticators) and your central RADIUS server, which handles user logins. It's important because, without this encryption, sensitive information like passwords could be intercepted by hackers while in transit, putting your network at risk.
Free. Save your status, tasks and notes.
Why it matters
Without RADIUS over IPsec/TLS, RADIUS packets can be intercepted, exposing credentials and enabling unauthorised network access and compromise.
How to implement
The IT team should ensure all RADIUS traffic is encrypted.
They can do this by configuring RADIUS over Transport Layer Security (TLS) or Internet Protocol Security (IPSec) to add an additional layer of security to communications.
The network administrator should ensure the RADIUS server and all authenticators are capable of supporting the chosen encryption method.
This involves checking and, if necessary, updating the devices' firmware or software.
The security manager should establish protocols for using strong, up-to-date encryption standards.
They can consult guidelines from the Australian Cyber Security Centre (ACSC) for recommended encryption practices.
The IT team should conduct regular testing of the encryption setup.
They should simulate network communications to verify that encryption is working effectively and inspecting logs to ensure no unencrypted data is being transmitted.
The procurement team should work with the IT team when acquiring new network hardware to ensure that all equipment supports RADIUS encryption as required by your security policy.
Keep it running
Configure and verify RADIUS over TLS (RadSec) or IPsec between authenticators and the RADIUS server; regularly validate certificates, cipher suites and trust chains.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network configuration documentation: Request documents detailing the RADIUS server settings and encryption configurations from the IT department.
Look at
Details on the encryption methods in use (TLS or IPSec).
Good evidence
Shows specific configurations and encryption protocols.
- Check 2 of 5What an auditor asks for
Ask for
Testing records: Request records of recent encryption tests from the IT team.
Look at
The test procedures and results to verify successful encryption without data leaks.
Good evidence
Would include dates and clear evidence of successful encryption tests.
- Check 3 of 5What an auditor asks for
Ask for
Device compatibility reports: Request a list of devices confirmed to be compatible with TLS or IPSec by the network administrator.
Look at
Specific device names, models, and firmware versions.
Good evidence
Includes confirmation that all devices are compatible with the encryption used.
- Check 4 of 5What an auditor asks for
Ask for
Encryption protocol standards: Request the security policy documents outlining encryption protocols.
Look at
Mentions of specific encryption protocols as guided by the ACSC.
Good evidence
Includes clearly defined and acceptable encryption standards that align with national guidelines.
- Check 5 of 5What an auditor asks for
Ask for
A review meeting record: Request notes or minutes from recent review meetings where encryption practices were discussed.
Look at
Decisions or updates made regarding encryption protocols and compliance checks.
Good evidence
Includes recorded dates and actions from these meetings.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1454 requires encrypting RADIUS communications using RADIUS over TLS or RADIUS over IPsec to protect authentication/authorisation traffic in transit. This is a specific application of ISO/IEC 27001:2022 Annex A 8.24, which requires organisations to define and implement rules for effective use of cryptography and associated key management. Annex A 8.24 covers cryptography use across many contexts (data at rest/in transit, algorithms, key lifecycle), whereas ISM-1454 is limited to one protocol pathway and transport protection approach.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.