ASD ISM 1947 Remove user authentication from extended key usages
What it says
Extended Key Usages that enable user authentication are removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that Extended Key Usages do not allow user authentication.
This control is about ensuring that certain parts of your system that deal with verification keys are not used to log users in. If this isn't done, your company could experience unauthorised access, putting confidential information at risk and potentially resulting in financial and reputational harm.
Free. Save your status, tasks and notes.
Why it matters
If user-authentication EKUs remain on certificates, they can be used for client logon, enabling unauthorised access to systems and data.
How to implement
The IT team should review the certificate templates used in Active Directory Certificate Services.
They need to identify any templates that include user authentication and update them by removing this capability. They can do this by following step-by-step instructions available in Microsoft's documentation.
The system administrator should organise a training session for staff involved with managing certificates.
This session should explain why removing user authentication from these templates is important and demonstrate how to identify and modify the settings. The training could consist of an interactive workshop with practical exercises.
The compliance officer ought to check with the IT department to ensure that any newly deployed or existing certificate templates do not allow user authentication.
They can ask for an updated list of all certificate templates and their current settings related to user authentication.
The security manager should set up a procedure for regularly reviewing certificate permissions.
This includes a schedule for checks and balances to ensure continuous adherence to the policy of not using these certificates for user authentication.
The IT team should implement automated monitoring tools to alert them if any certificate templates are configured incorrectly in the future.
These tools could be simple scripts that scan the certificate settings periodically and notify the administrator of any discrepancies.
Keep it running
Audit certificates/AD CS templates and remove EKUs that permit user auth (eg Client Authentication, Smart Card Logon) to prevent certificate-based logon.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of all certificate templates currently in use: Ensure that this list is recent and covers all relevant systems in Active Directory Certificate Services.
Look at
Any templates that mention enabled user authentication options.
Good evidence
Would show no templates with user authentication enabled.
- Check 2 of 5What an auditor asks for
Look at
The dates and types of changes recorded in the system.
Good evidence
Would show recent updates to remove user authentication capabilities along with approvals from responsible parties.
- Check 3 of 5What an auditor asks for
Look at
Course materials or attendance sheets.
Good evidence
Is training records showing that staff attended a session on certificate management in the last year.
- Check 4 of 5What an auditor asks for
Good evidence
Demonstration will involve an admin successfully modifying a template as per guidelines.
- Check 5 of 5What an auditor asks for
Ask for
Records from automated monitoring tools: These could be logs or alerts related to certificate management.
Look at
How often these tools run and any notifications that were triggered.
Good evidence
Includes logs showing consistent, periodic checks with zero unauthorised authentication configurations.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
ISM-1947 requires organisations to remove Extended Key Usages (EKUs) in certificates that enable user authentication, ensuring certificates cannot be (mis)used for interactive logon or user authentication pathways. Annex A 8.5 requires organisations to implement secure authentication technologies and procedures aligned to access restrictions, which includes selecting, configuring and hardening authentication mechanisms (including certificate-based authentication) to reduce misuse. ISM-1947 is a single, prescriptive technical hardening measure that would typically sit underneath an Annex A 8.5 secure-authentication design and configuration standard, but Annex A 8.5 also covers many other authentication methods and procedural requirements beyond EKU configuration.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.