ASD ISM 1506 Disable SSH version 1 for security
What it says
The use of SSH version 1 is disabled for SSH connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSSH version 1 is turned off to improve security for SSH connections.
This control means switching off the older version of a tool called SSH that lets people connect securely to computers over the internet. It matters because the older version has security holes that can let attackers in, which could mean someone could steal information or take control of your systems.
Free. Save your status, tasks and notes.
Why it matters
Enabling SSH version 1 exposes systems to man-in-the-middle attacks, risking interception or modification of sensitive data in transit.
How to implement
IT team should check all servers: Review which servers are using SSH connections to ensure none are using version 1.
Use a network monitoring tool to identify these connections and make a list for updating.
System administrator should update configurations: Turn off SSH version 1 on servers by adjusting the server software settings.
Follow the software provider's guide to make this change and apply updates as necessary.
IT security lead should test the updates: After disabling SSH version 1, perform a security check to ensure connections are using the newer version.
Use a network scanner to verify the change is active.
Manager should communicate changes: Inform all staff that the older SSH version will be turned off and explain how the change strengthens security.
Provide guidance for anyone who connects remotely on how to access systems using the updated setup.
HR or IT trainer should plan a training session: Organise a short session for staff to show how to use the new SSH version for secure connections.
Include a practical demonstration and a Q&A period at the end.
Keep it running
Configure SSHD to allow only protocol 2. Regularly audit sshd_config and run automated checks to detect SSH v1 being enabled.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Server configuration reports: Request a document showing which SSH versions are active on each server.
Look at
Any instances of SSH version 1 still in use.
Good evidence
The report lists only SSH version 2 or higher as active.
- Check 2 of 5What an auditor asks for
Ask for
Records of changes made to the server configurations regarding SSH versions.
Look at
Dates and descriptions of changes to verify when SSH version 1 was disabled.
Good evidence
A change log showing SSH version 1 removal with corresponding dates.
- Check 3 of 5What an auditor asks for
Ask for
Network scan results: Request logs from recent network scans to check for SSH version use.
Look at
Logs to ensure only version 2 connections appear.
Good evidence
A scan report listing no connections using SSH version 1.
- Check 4 of 5What an auditor asks for
Ask for
Records of training sessions held on the new SSHversion.
Look at
Attendance and training content details.
Good evidence
A training record with dated attendance lists and covered topics.
- Check 5 of 5What an auditor asks for
Ask for
The communication plan: Request a copy of the plan or emails sent to inform staff about the SSH change.
Look at
The communication content to see clear instructions and rationale.
Good evidence
A plan or email detailing the change, its importance, and clear next steps for users.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1506 requires organisations to disable SSH version 1 for SSH connections to reduce network-exposed cryptographic and protocol weaknesses. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which typically includes hardening remote administration services such as SSH and enforcing secure protocol versions. ISM-1506 is a concrete technical hardening step, whereas Annex A 8.20 covers broader network security management and controls beyond SSH.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.