Skip to content
System hardening
ASD ISMISM-1840

ASD ISM 1840 Prevent reversible encryption of user passwords

What it says

User account passwords do not use reversible encryption.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

User account passwords must not be stored in a way that allows them to be easily decrypted.

This control is about making sure that user passwords are stored in a way that they can't be easily deciphered, which means avoiding methods where passwords can be undone into plain text. This matters because if passwords are stored insecurely, someone who gains access to them can easily use or misuse user accounts, leading to data breaches, financial loss, or damage to the organisation's reputation.

Why it matters

If passwords are stored with reversible encryption, a breach could expose passwords and enable credential reuse and account takeover across systems.

How to implement

  1. IT team should configure the password storage settings: Ensure all passwords in systems, especially in Active Directory, are stored using one-way hashing methods that cannot be reversed back to the original password.

    Use secure, recommended algorithms like bcrypt or Argon2 to safeguard user passwords.

  2. System owner should review policies: Establish and document clear policies on how passwords are stored, ensuring there is no option for reversible encryption.

    Work with IT experts to update these policies regularly to match latest security practices and educate staff on these protocols.

  3. IT security specialist should perform regular audits: Conduct frequent checks of system settings to confirm that reversible encryption of passwords is not enabled.

    Use tools to scan for configurations that might allow password reversal and fix them immediately.

  4. Managers should train staff: Arrange for regular training sessions to ensure all staff understand the company's password security policies and why reversible encryption is not secure.

    Highlight the potential risks of insecure password practices.

  5. Procurement should verify security standards: When acquiring new software or systems, ensure they comply with security standards that prevent reversible encryption of passwords.

    Work closely with vendors to confirm systems are configured correctly out-of-the-box.

Keep it running

Regularly confirm password storage uses strong one-way hashing (e.g., bcrypt/Argon2) with unique salts, and audit systems to ensure no reversible encryption is enabled.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The password policy document: Request a copy of the organisation's password management policy.

    Look at

    How the policy describes password storage methods.

    Good evidence

    Will specify the use of strong, one-way encryption methods and explicitly state the prohibition of reversible encryption.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Configuration screenshots: Request screenshots from the configuration settings in Active Directory or equivalent systems showing password settings.

    Look at

    Whether reversible encryption options are disabled.

    Good evidence

    Includes clear indicators like tick boxes unchecked for reversible encryption options.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Audit logs: Request logs indicating checks or audits of password storage settings.

    Look at

    How frequently these audits happen and their results.

    Good evidence

    Would show regular audits with any issues found and addressed quickly.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Training records: Request records of staff training sessions on password security.

    Look at

    The frequency and content of these sessions.

    Good evidence

    Includes regular training with a specific focus on password storage risks and best practices.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Software vetting documents: Request documents related to the vetting process when acquiring new systems.

    Look at

    How security standards and password storage were assessed.

    Good evidence

    Would show thorough evaluations against security benchmarks like the Essential Eight.

Mappings

Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.17Management of authentication informationPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.