ASD ISM 1861 Enable Local Security Authority protection
What it says
Local Security Authority protection functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure the system has measures to secure login details against unauthorised access.
This control is about making sure that your computer systems have a strong lock on your login information to prevent unauthorised access. If you don't protect these login details, someone could break into your system and potentially steal sensitive information, causing both reputational and financial harm.
Free. Save your status, tasks and notes.
Why it matters
If LSA protection is not enabled, malware can dump LSASS credentials, enabling unauthorised access and lateral movement.
How to implement
The IT team should enable local security authority protection on all computers in the organisation.
They should go into the system settings of each computer, find the security options, and turn on the protection for local security authority, which secures the login process.
System administrators should regularly update software to maintain security features in the local security authority.
They should monitor for any updates from the software provider and apply these updates monthly to ensure continued protection against new threats.
Managers should ensure that the staff are trained on recognising phishing attempts that may try to steal their login credentials.
Arrange workplace training sessions that demonstrate common phishing techniques and offer tips on how to verify the legitimacy of email requests.
The IT team should conduct regular audits of system logs to identify any suspicious attempt to access login credentials.
They should review these logs weekly, watching for multiple failed login attempts or logins at unusual hours, which could indicate a security threat.
System owners should set up a recovery plan in case of a breach in login security.
Establish steps to follow, such as notifying users and changing compromised passwords, and include these in a formal document accessible to IT staff.
Keep it running
Verify LSA protection is enabled (RunAsPPL) after patching or upgrades, and alert if LSASS protection is disabled.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The security settings documentation: Request the document which outlines the local security authority settings on systems.
Look at
Whether local security authority protection is enabled.
Good evidence
Documentation shows all systems have local security authority protection enabled and updated.
- Check 2 of 5What an auditor asks for
Ask for
To review the software update schedule: Check for a documented schedule of updates applied to systems managing local security protection.
Look at
Monthly update entries.
Good evidence
The schedule lists consistent monthly updates for all systems.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request records of training programs conducted on phishing awareness.
Look at
Attendance lists and training material used.
Good evidence
The presence of comprehensive training records, signed attendance sheets, and examples of training content.
- Check 4 of 5What an auditor asks for
Ask for
System log reviews: Request logs of system activity reviews.
Look at
Notes or reports on actions taken in response to suspicious activities.
Good evidence
Documented log reviews highlight proactive steps in response to suspicious login attempts.
- Check 5 of 5What an auditor asks for
Ask for
The recovery plan document: Request a copy of the breach recovery plan.
Look at
Detailed steps on managing compromised login credentials.
Good evidence
The plan includes clear, actionable steps and responsibilities for managing and communicating a breach.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.5, Local Security Authority protection functionality is enabled, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-RA-ML3.5.
E8-RA-ML3.5 requires Local Security Authority (LSA) protection functionality to be enabled to harden credential handling and reduce credential theft. ISM-1861 mandates enabling LSA protection with the same intent and technical outcome. Both controls are effectively the same requirement expressed in different frameworks, with no material difference in scope or depth.
This control partially overlaps E8-RA-ML3.6.
ISM-1861 requires LSA protection to be enabled to harden the Local Security Authority process and reduce exposure of authentication secrets. E8-RA-ML3.6 requires Credential Guard, which isolates and protects credentials using virtualisation-based security and complements LSA protection against credential dumping. While both reduce credential theft, E8-RA-ML3.6 focuses on VBS isolation rather than the specific LSA protection setting mandated by ISM-1861.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.