ASD ISM 1818 Client authentication for network API access
What it says
Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of data and are accessible over the internet.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure clients are verified before they change data through network APIs on the internet.
This control ensures that only verified users can change important data when using network applications visible on the internet. If this isn't done, unauthorised people or hackers could alter your data, leading to loss of trust, potential financial loss, and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without client authentication for internet-accessible APIs that modify data, unauthorised parties could change records, causing breaches, financial loss and reputational damage.
How to implement
System owners should work with their IT team to establish clear client authentication processes.
This can be done by setting up user accounts with passwords or other verification methods like email confirmations before allowing any data changes.
IT teams need to develop and implement robust verification checks for network APIs.
This can include requiring users to log in with a username and password or using digital certificates to confirm identity.
Managers should ensure that training for staff includes information about secure data management practices.
This can include basic tips on creating strong passwords and recognising phishing attacks.
IT staff should regularly update authentication methods to stay ahead of potential security threats.
This might involve implementing new software updates or changing user authentication methods regularly.
A designated security officer should review and monitor user access logs to detect any unusual activity.
This involves regularly checking the logs to ensure only authorised users are making changes to data.
Keep it running
Review API logs for failed tokens and unusual client IDs; ensure only authenticated, authorised clients can call internet-facing data-modifying endpoints.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documentation outlining the client authentication process for network APIs.
Look at
The steps it includes to verify client identity before data changes are made.
Good evidence
Will detail specific methods, such as password protection or digital verification, and how they are enforced.
- Check 2 of 5What an auditor asks for
Look at
Entries showing regular and authorised access alongside any attempts at unauthorised access. Good logs will have time-stamped entries showing successful and failed access attempts.
- Check 3 of 5What an auditor asks for
Ask for
IT to demonstrate the authentication process live or through recorded sessions.
Look at
The steps a client has to take to verify their identity before accessing APIs.
Good evidence
Demonstration will include easy-to-follow procedures with clear, secure verification steps.
- Check 4 of 5What an auditor asks for
Look at
The guidance provided to understand what practices employees are trained in.
Good evidence
Will include comprehensive, up-to-date security training relevant to client authentication.
- Check 5 of 5What an auditor asks for
Ask for
Records of regular security updates or changes to authentication methods and protocols.
Look at
Update logs or change documents that show the IT team's proactive approach to maintaining security.
Good evidence
Record will clearly document the date, nature of updates, and responsible personnel.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
ISM-1818 requires authentication and authorisation of clients when they call internet-accessible network APIs that can modify data. ISO/IEC 27001:2022 Annex A 8.5 relates by requiring secure authentication technologies and procedures aligned to access restrictions, which is a broader requirement that would encompass robust authentication for API clients. ISM-1818 is more specific in scope (API calls over the internet and modification operations) and explicitly includes authorisation, whereas Annex A 8.5 is a general secure-authentication control not limited to APIs.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.