ASD ISM 1603 Disabling vulnerable authentication methods
What it says
Authentication methods susceptible to replay attacks are disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTurn off login methods that can be tricked into accepting false entries.
This control is about turning off ways to log in that can easily be tricked. If we don't do this, someone could pretend to be you and get into your systems, causing chaos by stealing information or messing things up.
Free. Save your status, tasks and notes.
Why it matters
If replay-susceptible authentication methods remain enabled, attackers can capture and reuse credentials to impersonate users, causing breaches and disruption.
How to implement
IT team should identify all current login methods used in the organisation.
They can make a list by reviewing system settings and user access points to check if outdated or weak methods are still in use.
System owners should work with the IT team to disable any login methods vulnerable to replay attacks.
This involves turning off or updating methods that can be fooled by copied information, like some older password systems.
Managers should inform staff about any changes to login procedures.
They can do this through a team meeting or an email that clearly explains what will be different and how to use the new, secure login methods.
Procurement should ensure any new technology bought by the organisation uses strong, modern authentication methods.
They should ask vendors if the product includes protections like encryption and multi-factor authentication.
HR should include training on secure login practices in their onboarding for new employees.
This can be a simple online course or a video call that explains why secure logins matter and how to use them properly.
Keep it running
Audit and disable replay-susceptible methods (e.g., NTLMv1, PAP, CHAP); enforce MFA and modern protocols like Kerberos, TLS, and SCRAM.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all authentication methods currently in use.
Look at
The list to see if any outdated methods are still active.
Good evidence
Shows only modern, secure methods being used with clear labels.
- Check 2 of 5What an auditor asks for
Ask for
Records of meetings or communications about disabling vulnerable authentication methods.
Look at
Meeting notes or emails for decisions made about removing old methods.
Good evidence
Includes sign-off from IT and system owners.
- Check 3 of 5What an auditor asks for
Ask for
To see a policy document on authentication methods.
Look at
Statements about disallowing or phasing out non-secure methods and descriptions of secure alternatives.
Good evidence
Shows a recent policy detailing specific safe practices.
- Check 4 of 5What an auditor asks for
Look at
Training materials or attendance records to ensure staff are informed.
Good evidence
Includes up-to-date materials distributed to all relevant staff with confirmation of understanding.
- Check 5 of 5What an auditor asks for
Ask for
A vendor contract or procurement document for new tech purchases.
Look at
The specs or requirements for authentication.
Good evidence
Indicates the use of advanced, secure login methods like multi-factor authentication.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
ISM-1603 requires authentication methods that are susceptible to replay attacks to be disabled. This relates to Annex A 8.5 because implementing secure authentication technologies and procedures typically includes selecting protocols and mechanisms that resist replay (and deprecating insecure ones). Annex A 8.5 is broader as it covers authentication security generally (technology selection and procedural controls), not specifically the disabling of replay-vulnerable methods.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; ISM-1603 requires authentication methods susceptible to replay attacks to be disabled, an insecure setting such a baseline switches off.
- IT.PRO-13.5Disable legacy authentication protocols and restrict, monitor and decommission exceptionsPartially overlaps
This control partially overlaps IT.PRO-13.5.
IT.PRO-13.5 requires legacy authentication protocols to be disabled or, if not feasible, restricted, monitored and scheduled for decommissioning; ISM-1603 requires authentication methods open to replay attacks to be disabled, targeting weak methods by replay risk rather than age.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.