ASD ISM 1836 Require Kerberos pre-authentication for user accounts
What it says
User accounts require Kerberos pre-authentication.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll user accounts need extra verification when logging in for better security.
This control means that every user account in the organisation needs to have extra verification when logging in, known as Kerberos pre-authentication. This matters because it adds a layer of security to prevent unauthorised access. Imagine if someone could easily break into your email or work systems because your account doesn't have enough protection.
Free. Save your status, tasks and notes.
Why it matters
Without Kerberos pre-authentication, attackers can perform offline password guessing (AS-REP roasting), risking unauthorised access to sensitive data.
How to implement
IT team should configure Kerberos pre-authentication for all user accounts.
This involves changing settings in your Active Directory, which is like a phonebook for your company's computers and users, to require this extra step when someone logs in.
Managers should ensure that the IT team has the resources and time to set up Kerberos pre-authentication.
They can do this by scheduling regular check-ins to track progress and address any blockers.
System owners should verify that Kerberos pre-authentication is activated by working with the IT team to conduct tests.
They can do this by trying to log in with a test account and ensuring the system prompts for additional verification.
IT team should communicate changes to employees to ensure they understand the new login process.
They can create a simple guide explaining what the extra step will look like and why it's important.
System administrators should monitor and review Kerberos authentication logs regularly.
This can be done by setting specific criteria in your monitoring tools, looking at who attempted to log in and from where.
Keep it running
Enforce Kerberos pre-authentication on all user accounts and regularly audit AD/IdP settings to detect any accounts with pre-auth disabled.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The Active Directory settings change report.
Look at
Changes recorded that indicate pre-authentication is required.
Good evidence
Is a report showing that Kerberos pre-authentication is enabled for all accounts.
- Check 2 of 5What an auditor asks for
Look at
How the system behaves during user login attempts.
Good evidence
Demonstration shows the system requiring an additional verification step.
- Check 3 of 5What an auditor asks for
Ask for
The logs from monitored authentication attempts.
Look at
Entries that show attempts and successes of logins with pre-authentication involved.
Good evidence
Log reveals no unusual or unauthorised access occurrences.
- Check 4 of 5What an auditor asks for
Look at
How the changes were communicated to staff members.
Good evidence
Plan includes emails, training sessions, and helpful guides explaining the changes.
- Check 5 of 5What an auditor asks for
Ask for
The test results of the newly implemented pre-authentication process.
Look at
Documented outcomes of test logins and any issues or errors encountered.
Good evidence
Outcome shows successful tests with no critical errors.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
ISM-1836 requires Kerberos pre-authentication to be enforced for user accounts to strengthen authentication and prevent certain Kerberos-based attacks. This relates directly to Annex A 8.5, which requires implementing secure authentication technologies and procedures appropriate to access restrictions. ISM-1836 is a specific technical safeguard within the broader ISO requirement to select and implement secure authentication mechanisms.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.