ASD ISM 1687 Prevent virtualisation of privileged environments
What it says
Privileged operating environments are not virtualised within unprivileged operating environments.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrivileged environments must not be virtualised within non-privileged ones to ensure security.
This control means that parts of your computer systems that need the highest security should not be placed within less secure environments on the same system. This is important because if the secure parts aren't kept separate, it's easier for cybercriminals to get in and access sensitive information, potentially causing harm to your business and your reputation.
Free. Save your status, tasks and notes.
Why it matters
If privileged environments run inside unprivileged VMs, a compromise of the host or hypervisor can capture admin credentials and enable full system takeover.
How to implement
The IT team should ensure that any system configured with high-level security settings is kept separate from less secure areas of the network.
They can do this by using different physical or virtual servers dedicated only to secure environments.
System administrators should review system architecture to ensure that none of their critical applications are running within unprotected areas of the network.
This involves examining where these applications are hosted and ensuring that they are only deployed in secure areas.
The organisation's security officer should create a clear policy that outlines what constitutes a privileged environment and how these should be handled.
This policy should be distributed and explained to relevant staff to ensure understanding.
IT managers should conduct regular training sessions to inform staff about the importance of maintaining separate environments for secure data.
This could involve workshops or online modules that explain the risks of poor separation.
The IT team should implement monitoring tools to alert them if any secure environments are mistakenly placed within less secure ones.
They should look for tools that provide real-time alerts so issues can be addressed immediately.
Keep it running
Confirm privileged workstations/servers are not hosted as guests on unprivileged systems; review hypervisor inventories and alert on new VMs containing admin tools or accounts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network architecture diagram: Request a document that shows how the network is laid out, with clear markings for secure and unsecure areas.
Look at
The separation of privileged and unprivileged environments.
Good evidence
Diagram will show clear boundaries and separate infrastructure for privileged environments.
- Check 2 of 5What an auditor asks for
Ask for
System configuration policies: Request the written policies that describe how systems should be configured and where they should be placed.
Look at
Specific directives on not virtualising privileged environments within unsecure ones.
Good evidence
Policy is clear, specific, and has been recently updated.
- Check 3 of 5What an auditor asks for
Ask for
Log outputs from any monitoring tools used to track system configurations.
Look at
The alerts and actions logged related to misconfigurations.
Good evidence
Log will have regular checks and prompt corrective actions when issues are identified.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request evidence of training sessions conducted with IT staff and administrators.
Look at
Attendance records and session content related to maintaining secure environments.
Good evidence
Record will show regular sessions and comprehensive content involving all relevant staff.
- Check 5 of 5What an auditor asks for
Ask for
Records of any incidents where configurations did not meet policy standards.
Look at
The incident logs for compliance failures and corrective measures taken.
Good evidence
Record shows thorough investigation and resolution with lessons learned applied.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML2.3, Privileged environments are not virtualised within unprivileged environments, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-RA-ML2.3.
E8-RA-ML2.3 requires that privileged operating environments are not virtualised within unprivileged operating environments to prevent privilege boundary collapse. ISM-1687 states the same requirement using essentially identical language and intent. Both controls focus on preventing an unprivileged host from constraining or inspecting a privileged guest (or vice versa) by disallowing that virtualisation arrangement.
This control depends on E8-RA-ML1.5.
E8-RA-ML1.5 requires privileged users to use separate privileged and unprivileged operating environments. ISM-1687 supports this by preventing a privileged environment from being virtualised inside an unprivileged environment, reducing the chance the 'separate' admin context is undermined by the host's lower trust level. ISM-1687 is a specific hardening constraint, whereas E8-RA-ML1.5 is the higher-level separation outcome.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.