Skip to content
Cryptography
ASD ISMISM-1771

ASD ISM 1771 Use AES encryption for IPsec connections

What it says

AES is used for encrypting IPsec connections, preferably ENCR_AES_GCM_16.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

AES encryption, especially ENCR_AES_GCM_16, is recommended for securing internet protocol connections.

This control is about using a type of online lock called AES encryption to protect your internet connections from being accessed by criminals. If you don't use this encryption, your sensitive information, like customer data or confidential business emails, could be intercepted by malicious actors, leading to breaches that could damage your reputation and result in financial losses.

Why it matters

If IPsec is not encrypted with AES (preferably ENCR_AES_GCM_16), attackers can intercept or alter in-transit traffic, exposing sensitive data.

How to implement

  1. The IT team should ensure that all internet protocol connections use AES encryption, specifically the ENCR_AES_GCM_16 version, to protect data in transit.

    This can be done by configuring network devices like routers and firewalls to use this form of encryption for IPsec connections.

  2. Managers should schedule regular training for the IT staff to stay updated on encryption best practices.

    This could involve webinars or workshops, ensuring the team knows how to implement AES encryption effectively.

  3. System owners need to collaborate with IT professionals to assess current encryption protocols and upgrade them if necessary.

    This involves reviewing existing system settings and making sure they align with ENCR_AES_GCM_16 standards.

  4. A security officer should conduct a thorough evaluation of third-party services to confirm they use AES encryption on their interfaces.

    This can be done by requesting encryption method disclosures from these service providers.

  5. IT staff should document all changes made to the encryption settings, including the timing and rationale for the change.

    This documentation will be vital for regular audits to ensure compliance and can serve as a reference for troubleshooting future issues.

Keep it running

Regularly review IPsec proposals/SA settings to ensure AES is used, preferably ENCR_AES_GCM_16, and remove weaker ciphers from all peers.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    A network configuration report: Request a detailed report showing encryption settings on network devices such as routers and firewalls.

    Look at

    The encryption protocol settings and confirm they list AES encryption, preferably ENCR_AES_GCM_16.

    Good evidence

    Shows devices configured with ENCR_AES_GCM_16 and consistent across the network.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Training records: Request attendance logs and materials from any conducted staff trainings on encryption.

    Look at

    Evidence that the IT team has been trained on AES encryption methods in the last year.

    Good evidence

    Is an up-to-date training log with participant names and dates.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Vendor compliance documents: Request assurances or reports from third-party vendors detailing their encryption methods.

    Look at

    The section detailing encryption standards.

    Good evidence

    Includes documentation verifying the use of AES encryption for all internet protocol security connections with traceable verification.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Change history documentation: Request logs of changes made to the system's encryption configurations.

    Look at

    Entries for updates to the encryption settings.

    Good evidence

    Will show detailed, dated records of when AES encryption, specifically ENCR_AES_GCM_16, was implemented.

  5. Check 5 of 5What an auditor asks for

    Ask for

    A review meeting's minutes: Request minutes from meetings where encryption upgrades were discussed and planned.

    Look at

    Mentions of AES encryption implementation and decisions made about its configuration.

    Good evidence

    Is well-documented minutes that include the discussions and decisions related to using ENCR_AES_GCM_16.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.