ASD ISM 1553 Disable TLS compression for security
What it says
TLS compression is disabled for TLS connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTLS connections should not use compression to prevent security risks.
This control is about turning off a feature called TLS compression in secure online connections. It matters because if TLS compression is on, it might let cyber attackers steal sensitive information like passwords or credit card numbers by exploiting weaknesses in the way data is compressed. This could lead to data breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
If TLS compression is used, attackers might exploit CRIME-like vulnerabilities to steal sensitive data, risking financial and reputational damage.
How to implement
The IT team should check the settings on all servers and applications to make sure TLS compression is turned off.
They can do this by reviewing the configuration files or settings panels where encrypted communication options are set. A step-by-step guide or checklist can help ensure nothing is overlooked.
System administrators should regularly update the documentation for all software that uses TLS to ensure current settings are always recorded.
They should include screenshots or descriptions of the relevant settings, noting locations where TLS compression options are configured.
IT managers should coordinate with their vendors or service providers to confirm that products and services they use also have TLS compression disabled.
They should request confirmation in writing that the vendors do not enable this feature in their services.
Cyber security consultants or IT security personnel should conduct security assessments on organisation networks to verify that TLS compression is disabled.
They can use specific testing tools to simulate attacks to ensure the settings are secure.
Technology procurement staff should include requirements to disable TLS compression in their vendor and purchase agreements.
Before finalising any contract, review technical specifications to ensure compatibility with this security requirement.
Keep it running
Regularly verify TLS configuration does not allow compression (e.g., openssl/nmap scans) after patches or upgrades, as some updates can re-enable it.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The server configuration documents: Request the configuration files or documentation showing TLS settings for all servers.
Look at
The sections that relate to TLS mode settings, specifically checking if compression is off.
Good evidence
Is clear documentation showing TLS compression explicitly disabled.
- Check 2 of 5What an auditor asks for
Ask for
Network security assessment reports: Request a recent security audit report related to TLS configurations.
Look at
A specific section that discusses TLS settings, especially noting comments on compression.
Good evidence
Is a detailed report with no vulnerabilities found related to TLS compression.
- Check 3 of 5What an auditor asks for
Ask for
Communication logs with vendors: Request emails or letters where vendors confirm their products have TLS compression disabled.
Look at
The details of the exchanges to ensure that the confirmation covers the software or service in question.
Good evidence
Is a clear statement from the vendor addressing the TLS compression status.
- Check 4 of 5What an auditor asks for
Ask for
About personnel training records: Request records showing training sessions for IT staff on setting up TLS correctly.
Look at
Attendance lists and training materials that cover TLS settings, specifically on disabling compression.
Good evidence
Includes comprehensive logs of training and materials used.
- Check 5 of 5What an auditor asks for
Ask for
The change management documentation: Request logs from any system changes involving TLS configurations.
Look at
Records for recent changes to check if disabling compression was included as part of the updates.
Good evidence
Includes change requests and completion notes stating TLS compression was disabled.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1553 requires TLS compression to be disabled for TLS connections to reduce protocol-level cryptographic risk. Annex A 8.20 mandates that networks and network devices be secured, managed, and controlled, typically encompassing hardening TLS configurations on network appliances. ISM-1553 outlines a specific, testable TLS hardening setting, whereas Annex A 8.20 covers a wider scope of network security governance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.