ASD ISM 1899 Restrict unauthorised network connections
What it says
Network devices that do not belong to administrative infrastructure cannot initiate connections with administrative infrastructure.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDevices outside the network can't establish connections with administration systems.
This control is about making sure only the devices that are part of your core administrative systems can connect to them from outside your network. It's like ensuring only trusted friends can come into your house. If unknown devices are allowed to connect, they can create security holes, leaving your important systems vulnerable to attacks and data breaches.
Free. Save your status, tasks and notes.
Why it matters
If non-admin network devices can initiate connections to administrative infrastructure, attackers can reach privileged services and pivot to compromise admin accounts and systems.
How to implement
The IT team should review and identify the devices that are part of the administrative systems.
This means creating a list of all approved devices that can communicate with your administrative infrastructure. They can organise a meeting to validate this list with system owners.
System administrators should configure network settings to block unauthorised devices.
This involves setting up firewalls or filtering rules to only allow the identified, approved devices to connect. Use simple rules based on the device's unique identifiers such as its IP or MAC address.
The security manager should train staff on identifying unauthorised devices.
They can hold workshops explaining why it's important to keep an eye out for devices not on the approved list and who to report them to if noticed.
The IT security officer should regularly review network connection logs.
They should set up a fortnightly reminder to audit these logs, looking for any unexpected device connections, and take action to block or investigate them.
Managers should establish protocols for reporting and reacting to connection attempts by unauthorised devices.
This involves writing a simple procedure document and sharing it with all employees so they know the steps to follow if they spot an unauthenticated connection attempt.
Keep it running
Enforce segmentation so only approved management subnets/jump hosts can initiate sessions to admin interfaces; apply ACLs/firewall rules and alert on blocked connection attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of authorised devices: Request documentation that lists every device allowed to connect to the admin network.
Look at
Whether all devices have been reviewed and approved by the right personnel.
Good evidence
Is a comprehensive list with sign-off from the IT manager.
- Check 2 of 5What an auditor asks for
Look at
Settings that restrict connections only to approved devices.
Good evidence
Configuration will clearly list these rules with no gaps.
- Check 3 of 5What an auditor asks for
Ask for
Recent network log reviews: Request evidence of regular log review activities.
Look at
The dates and details of these reviews to see if they're performed consistently.
Good evidence
Includes dated logs showing signed-off reviews with findings.
- Check 4 of 5What an auditor asks for
Look at
Clearly explained guidelines and examples.
Good evidence
Set of materials will be up-to-date and comprehensive.
- Check 5 of 5What an auditor asks for
Ask for
Incident response records: Request records of any investigations into unauthorised connection attempts.
Look at
The follow-up actions and outcomes documented.
Good evidence
Record will show a timeline of actions and resolutions.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1899 requires that non-administrative network devices cannot initiate connections to administrative infrastructure, enforcing strong separation of admin networks from other networks. Annex A 8.20 requires organisations to secure, manage and control networks and network devices to protect information systems and applications, which includes implementing controls such as ACLs, firewalls and routing restrictions. ISM-1899 is a specific network-connection restriction within the broader network security management expectations of Annex A 8.20.
This control partially meets A.8.22.
ISM-1899 requires that devices outside administrative infrastructure are prevented from initiating connections into administrative infrastructure. Annex A 8.22 requires segregation of groups of information services, users and information systems within organisational networks, typically via segmentation, zoning and traffic filtering. ISM-1899 is a concrete segregation outcome focused on administrative infrastructure connectivity, while Annex A 8.22 is broader and covers segregation across many business/system groupings.
ASD Essential Eight: 1 mapping
This control supports E8-RA-ML2.4.
ISM-1899 requires that non-administrative devices cannot initiate connections to administrative infrastructure, limiting direct reachability to admin systems. E8-RA-ML2.4 mandates conducting administrative activities through jump servers, which operationalises this separation by concentrating admin access paths through controlled intermediaries. ISM-1899 strengthens the effectiveness of jump servers by preventing bypass paths from standard networks into admin infrastructure.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.