Skip to content
System hardening
ASD ISMISM-2010

ASD ISM 2010 Ensure SPNs use strong encryption in AD services

What it says

Service accounts configured with an SPN use the Advanced Encryption Standard for encryption.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Service accounts in Active Directory must use strong encryption to secure their SPNs.

Service accounts in Active Directory are like special user accounts used by applications or services, not by people. Ensuring these accounts use strong encryption means that the data they handle is kept safe from prying eyes. If this isn't done, sensitive information could be intercepted and misused, leading to data breaches or loss of trust in your business.

Why it matters

If SPN service accounts allow RC4/DES, attackers can Kerberoast and crack tickets to access services and data, causing breach and reputational harm.

How to implement

  1. The IT team should review all service accounts in your Active Directory.

    Identify which accounts are still using old or weak encryption methods. Use system tools to list these accounts and mark them for updating.

  2. Managers should ensure the IT team has the time and resources to update encryption settings.

    This might involve scheduling downtime if necessary and working out a plan to let staff know about any disruptions.

  3. The IT team must upgrade encryption settings for all service accounts to use the Advanced Encryption Standard (AES).

    This could involve modifying account properties in the directory settings to ensure AES is selected.

  4. System owners should document these changes and keep records of which accounts have had their encryption updated.

    This can be done by noting each change in a dedicated log file or spreadsheet.

  5. Managers should communicate with stakeholders about the importance of strong encryption and any changes in security protocols.

    Use simple language to explain why these updates are essential for protecting sensitive information and maintaining business integrity.

Keep it running

Audit SPN accounts for msDS-SupportedEncryptionTypes; require AES128/256, disable RC4/DES, and validate Kerberos ticket encryption after changes.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    A report listing all service accounts in Active Directory.

    Look at

    The encryption settings associated with each account.

    Good evidence

    Shows that all accounts are using Advanced Encryption Standard (AES).

  2. Check 2 of 5What an auditor asks for

    Look at

    A clear record of which accounts were updated and when.

    Good evidence

    Includes a complete list with no accounts using outdated encryption methods.

  3. Check 3 of 5What an auditor asks for

    Ask for

    IT policy documents related to encryption standards.

    Look at

    A policy that mandates AES for all service accounts.

    Good evidence

    Is a policy document that is endorsed by management and reviewed annually.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see the change management log for the encryption updates. Check the entries for confirmation of successful AES upgrades.

    Good evidence

    Includes an entry for each service account with a completion date.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Evidence of staff training or communication about encryption updates.

    Look at

    Meeting notes or communications that explain what changes were made and why.

    Good evidence

    Includes records of staff briefings or emailed updates with positive feedback.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.