ASD ISM 1929 Ensure LDAP signing on AD DS domain controllers
What it says
Lightweight Directory Access Protocol signing is enabled on Microsoft AD DS domain controllers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure AD servers use secure communication to prevent unauthorised access.
This control ensures that communications with Active Directory servers, which help manage user access in your organisation, are secure. If this isn't done, unauthorised people could spy on or tamper with communications, leading to potential data breaches or unauthorised access to sensitive information.
Free. Save your status, tasks and notes.
Why it matters
If LDAP signing is not enforced on AD DS domain controllers, attackers can tamper with LDAP traffic to gain unauthorised access.
How to implement
IT team should configure LDAP signing: Review the current server configuration and ensure that LDAP signing is enabled.
This helps secure the communication between servers and prevents tampering.
System administrators should update server policies: Adjust the Group Policy settings on domain controllers to require LDAP signing.
This is done through the Group Policy Management Console by navigating to the appropriate policies and enabling LDAP signing.
IT team should test configurations: After implementing the LDAP signing requirement, conduct tests to ensure all applications and services can still connect to the domain controllers as expected, identifying any compatibility issues.
IT managers should communicate changes: Inform relevant staff about what changes have been made to server settings and any potential impacts, particularly concerning application access that might be affected.
Policy makers should update IT security policies: Ensure that organisational policies reflect the need for LDAP signing, documenting the change and why it was necessary for security.
This may involve updating the IT security policy document and employee handbooks.
Keep it running
Confirm Domain Controllers enforce LDAP signing via Group Policy and re-check regularly to detect drift after updates or changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Server policy settings documentation: Request the document or report showing the Group Policy settings for domain controllers.
Look at
The authentication policies section to see if LDAP signing is turned on.
Good evidence
Document shows a policy requiring LDAP signing for all domain controllers.
- Check 2 of 5What an auditor asks for
Ask for
A server configuration report: Request a detailed report from IT showing current settings for domain controllers.
Look at
LDAP signing enabled status.
Good evidence
Report confirms that LDAP signing is turned on for all domain controllers.
- Check 3 of 5What an auditor asks for
Ask for
Testing logs or results: Review logs or documents that show the results of LDAP signing functionality tests.
Look at
Confirmation that all systems requiring Active Directory access have been tested and are working.
Good evidence
Logs show successful tests for all key systems with no critical failures.
- Check 4 of 5What an auditor asks for
Ask for
Communication records: Check emails or meeting notes where changes to LDAP settings were explained to necessary staff.
Look at
Clear summaries and explanations of changes.
Good evidence
Communication records show clear instructions and potential impact assessments shared with staff.
- Check 5 of 5What an auditor asks for
Ask for
Updated IT security policies: Request the latest security policy documents that include LDAP signing requirements.
Look at
Sections that specify LDAP signing as a requirement.
Good evidence
Policies specifically mention LDAP signing as essential for server communications.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.5.
ISM-1929 requires enabling LDAP signing on AD DS domain controllers to ensure integrity of authentication-related directory communications. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures, which can include ensuring authentication protocols (such as LDAP binds and directory queries used during logon) are protected against manipulation. ISM-1929 is a concrete configuration for LDAP integrity, while Annex A 8.5 covers a wider set of authentication methods, processes, and controls.
This control partially meets A.8.20.
ISM-1929 requires LDAP signing to be enabled on Microsoft AD DS domain controllers to protect directory authentication/integrity against tampering and downgrade-style attacks. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured and managed, which includes enforcing secure protocols and configurations on directory services carried over the network. ISM-1929 is a specific technical hardening requirement for one protocol/service, whereas Annex A 8.20 is broader across all networked services and devices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.