Skip to content
System hardening
ASD ISMISM-1931

ASD ISM 1931 Ensure SID filtering for domain and forest trusts

What it says

SID Filtering is enabled for domain and forest trusts.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Enable SID filtering for enhanced security between domain and forest trusts.

This control is all about making sure that only the right people have access to the right things in your computer network. It involves setting up a security check called SID filtering, which helps prevent unauthorised access from other parts of your network. Without this, someone from another part of the network could potentially access sensitive information or disrupt your operations.

Why it matters

Without SID filtering on domain/forest trusts, attackers can inject SIDs to gain unauthorised access across trusts.

How to implement

  1. IT team should enable SID filtering: The IT team should configure all domain and forest trusts within the network to enable SID filtering.

    This means adjusting the settings on the network servers to specify that only trusted security identifiers (SIDs) can be used from other domains.

  2. System administrators should verify settings: System administrators need to regularly check that SID filtering is enabled on all the trust relationships between domains.

    They can do this by using network management tools to look at each domain trust setting.

  3. Security officers should conduct training: Security officers should organise training sessions for IT personnel on why SID filtering is crucial and the basics of how it operates.

    This helps ensure that everyone responsible for maintaining the network understands its importance and functioning.

  4. IT team needs to document configurations: When enabling SID filtering, the IT team should keep detailed records of when and how the filters were set up.

    This can help if there are any issues later and serves as proof for audits.

  5. Managers should review security policies: Managers responsible for network security should review and update policy documents to include SID filtering as a required control.

    This formalises the control within the organisation's security framework.

Keep it running

Regularly verify SID filtering is enabled on all domain/forest trusts and review trust changes at least quarterly.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    A configuration report for domain trusts: Request a report detailing the current settings of domain trusts.

    Look at

    The configuration for an indication that SID filtering is enabled.

    Good evidence

    Is seeing SIDs from external domains are filtered by default.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see policy documents: Request the security policy or protocol documents that reference SID filtering. Look to ensure SID filtering is mentioned as a required security measure.

    Good evidence

    Is a clearly documented policy stating SID filtering is mandatory for all domain trusts.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training records: Request proof of training sessions for IT staff on SID filtering.

    Look at

    Attendance lists and training materials.

    Good evidence

    Is records showing regular training sessions with comprehensive materials on SID filtering concepts.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Change management records: Request logs or records that detail when SID filtering was enabled or modified.

    Look at

    Dates, times, and staff responsible for those changes.

    Good evidence

    Is a clear and detailed change log available for each trust.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see monitoring tools: Request a demonstration of the tools used to monitor domain trusts.

    Look at

    Features that mention or visually confirm SID filtering configurations.

    Good evidence

    Is a tool that visibly shows SID filtering as active and properly configured.

Mappings

Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.9Configuration management for secure IT systemsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.