ASD ISM 1532 Avoid using VLANs for network separation
What it says
VLANs are not used to separate network traffic between an organisation's networks and public network infrastructure.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDo not use VLANs to separate internal networks from the public internet.
This control advises against using VLANs, or Virtual Local Area Networks, to separate your organisation's internal networks from the internet. If you rely on VLANs alone for this separation, you could be putting your data at risk, as VLANs can be vulnerable to attacks that allow intruders to bypass these barriers.
Free. Save your status, tasks and notes.
Why it matters
Relying on VLANs for network separation exposes sensitive data to potential breaches by attackers exploiting VLAN hopping techniques.
How to implement
Network Administrators should reevaluate current network configurations to ensure that VLANs are not the primary method for separating internal networks from the public internet.
They can achieve this by using separate physical networks or firewalls instead.
IT Managers should work to establish a policy that clearly prohibits the use of VLANs for isolating internal networks from the internet.
This policy should outline acceptable methods for network separation, such as firewalls or dedicated routers.
Security Officers should organise training for IT staff to help them understand the limitations of VLANs for network separation and educate them on more secure alternatives.
This training could be done through workshops or e-learning modules focused on network security best practices.
IT Teams should inspect all connection points between internal and public networks to ensure that secure methods like firewalls are in place instead of relying on VLANs.
This can involve conducting regular audits of network configurations and ensuring compliance with the established network separation policy.
System Engineers should implement and regularly update firewall rules to ensure they are effectively separating internal networks from the public internet.
This involves defining rules that control which data is allowed to pass and regularly reviewing these rules to address emerging threats.
Keep it running
Ensure separation from public infrastructure uses physical links or encrypted tunnels, not VLANs; review switch trunking and ACLs to prevent VLAN hopping.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current network topology diagram: Request a detailed diagram showing how internal networks are separated from the public internet.
Look at
Technologies used for segmentation, ensuring they don't rely solely on VLANs.
Good evidence
Will show firewalls or physical separation methods clearly noted.
- Check 2 of 5What an auditor asks for
Ask for
The network security policy document: Request the written policy that details how the organisation separates internal networks from the internet. Look to see if the policy mentions firewalls or other secure methods instead of VLANs.
Good evidence
Policy will explicitly prohibit VLAN use for this purpose.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request documentation of recent training sessions on network security for IT staff.
Look at
Evidence that these sessions covered the limitations of VLANs and alternatives for secure network separation.
Good evidence
Includes session agendas, dates, and participant lists.
- Check 4 of 5What an auditor asks for
Ask for
A firewall configuration snapshot: Request a current configuration export from the firewall in use.
Look at
The rules to ensure they effectively control traffic between internal networks and the internet.
Good evidence
Configuration will have specific rules reducing unnecessary exposure to the internet.
- Check 5 of 5What an auditor asks for
Ask for
Recent network audit reports: Request reports from any network audits conducted in the past year. Look to see if they assessed VLAN use and recommended changes.
Good evidence
Report will identify VLAN issues and document corrective actions taken.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1532 requires organisations to avoid using VLANs as the separation mechanism between internal networks and public network infrastructure (e.g. the internet). ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which encompasses robust boundary design and controls for network separation. ISM-1532 is a specific prescriptive design constraint within the broader network security management expected by Annex A 8.20.
This control partially meets A.8.22.
ISM-1532 requires that VLANs are not used to separate traffic between an organisation's networks and public network infrastructure. ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of information services, users and information systems within organisational networks, which includes (but is not limited to) the approach used at the internet boundary. ISM-1532 is a specific prohibition about one segregation method in a particular context, while Annex A 8.22 is a broader requirement to implement network segregation generally.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.