Skip to content
Software development
ASD ISMISM-2013

ASD ISM 2013 Ensure client authentication for internal network APIs

What it says

Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of data but are not accessible over the internet.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Make sure apps inside your network check who accesses them and what they can do, before allowing data changes.

This control requires you to make sure that anyone accessing apps within your company's internal network is verified and granted the right level of access before they can change any data. This is important because if unauthorised people can make changes, it could lead to data breaches or loss that could harm your business operations and reputation.

Why it matters

Unauthorised calls to internal network APIs could allow data modification, leading to fraud, service disruption, and reputational damage.

How to implement

  1. System owners should identify all internal network APIs that allow data modification within their applications.

    To do this, review application documentation or consult with developers to list each API and its purpose, ensuring a comprehensive understanding of what each API does.

  2. The IT team should set up an authentication system to verify the identity of clients accessing each internal API.

    This can be done using existing systems, like Active Directory, or by setting up a basic username and password check tailored for each API use-case.

  3. Hire or task a developer or IT specialist with implementing authorisation checks for each API to ensure clients can only perform actions they are permitted to do.

    This involves setting up rules within the API that evaluate what data or functions a user is allowed to access based on their role or identity.

  4. Managers should work with the IT team to establish a regular review process for the authentication and authorisation systems.

    Schedule meetings every quarter to review current systems, discuss any incidents, and determine if updates or changes are needed.

  5. Information technology staff should draft a procedure document explaining how to handle and report any issues or breaches related to API access.

    This includes clearly defined steps for identifying an incident, who to notify, and how to restore secure operations.

Keep it running

Require client authentication/authorisation (e.g., mTLS or signed tokens) for internal write APIs; review service accounts/keys and alert on failed auth attempts.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of internal network APIs: Request documentation or listings that identify all APIs within the organisation.

    Look at

    Whether the list includes the purpose and data-modification capabilities of each API.

    Good evidence

    Contains a detailed list of APIs, their functions, and associated user-access controls.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Records of authentication logs: Request logs that show who accessed each API and when.

    Look at

    The timestamps and user identifiers to ensure they align with business hours and authorised personnel.

    Good evidence

    Is a log showing consistent access by verified users only.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Access control policies related to internal network APIs: Request to see written policies that outline how access is granted and who is responsible for overseeing access.

    Look at

    Whether the policy includes clear roles, responsibilities, and access review cycles.

    Good evidence

    Is a policy document that clearly details these expectations.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Any incident reports related to unauthorised API access: Request past reports that document any breaches or attempts at unauthorised access.

    Look at

    The response times, actions taken, and any changes made to prevent future incidents.

    Good evidence

    Details actions taken swiftly to resolve any issues and measures implemented to prevent recurrences.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see the staff training logs on API security procedures: Request records showing when staff were trained on API access and security checks.

    Look at

    Dates, attendees, and training content to ensure all relevant staff have participated.

    Good evidence

    Shows regular training sessions with comprehensive content covered and attendance records.

Mappings

Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.5Secure authentication technologies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.