ASD ISM 1761 Use NIST curves for ECDH encryption

The IT team should ensure that their encryption software is configured to use the NIST P-384 curve when setting up secure communications.

They can do this by checking the settings in their encryption tools or consulting with their software vendors to confirm that these settings are available and enabled.

System owners should collaborate with their IT providers to ensure that any new systems they procure include support for NIST curves, particularly P-384, for encrypting data.

This involves having detailed discussions before purchase and verifying the encryption capabilities with the vendor.

Managers should oversee staff training sessions about secure communications and why using specific encryption settings, like NIST P-384, can protect against data breaches.

This can be achieved through a one-hour interactive workshop using simple, relatable analogies to explain complex concepts.

The procurement team should update their purchasing checklists to require that any encryption product supports NIST P-384 or higher.

They can implement this by creating a new section on the checklist specifically for technical compliance and ticking it off during vendor evaluations.

Executives should set a policy that mandates the use of recommended NIST curves across all levels of the organisation where sensitive information is being communicated.

This can be done by formalising it in the organisation's cyber security policy documents and ensuring everyone, from managers to employees, adheres to it.