ASD ISM 2018 Secure BGP routing with RPKI-registered IP addresses
What it says
Routes for RPKI-registered IP addresses that are advertised from invalid Autonomous Systems, or that are longer than allowed, are rejected or deprioritised by routers that exchange routes via BGP.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRouters reject or down-rank invalid IP address routes to enhance BGP security.
This control is about making sure that the internet routes used to send and receive data are secure and accurate. If this isn't done, your data could be sent through the wrong paths, posing risks like loss of sensitive information or even your website or services being inaccessible. It's like ensuring your mail gets delivered to the right address and not everyone else's mailbox.
Free. Save your status, tasks and notes.
Why it matters
Without rejecting/deprioritising RPKI-invalid BGP routes (wrong origin AS or too-long prefix), traffic can be hijacked, intercepted or blackholed, causing outages and misrouting.
How to implement
Internet Service Providers (ISPs) should work with network engineers to register their IP addresses with the Resource Public Key Infrastructure (RPKI).
This involves verifying every IP address and linking them to a specific network to prevent unauthorised use.
Network administrators must configure routers to automatically reject or down-rank any incorrect routes.
This can be done by setting up rules that specify which paths are valid and should be preferred according to RPKI data.
The IT team should routinely check RPKI data for any changes or updates.
By regularly verifying RPKI records, you can ensure that only valid and authorised routes are advertised.
Cyber security managers should train staff on the importance of RPKI and secure BGP routing.
Provide workshops or simple guides to explain how correct routing protects our online activities from being hijacked.
Business owners should liaise with their network provider to ensure compliance with RPKI guidelines.
This means confirming with your service provider whether they are implementing secure routing practices, as recommended by government agencies like the Australian Cyber Security Centre (ACSC).
Keep it running
Maintain ROA-based BGP policy: regularly refresh RPKI cache/ROAs, set routers to reject or deprioritise RPKI-invalid (and max-length exceeded) routes, and alert on validation state changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network's RPKI validation status report: Request to see records that show the validation outcomes of your current IP address routes.
Look at
The report for any invalid or out-of-date entries.
Good evidence
Shows all routes as valid and lists recent validation dates.
- Check 2 of 5What an auditor asks for
Ask for
To see how routers are set up to handle routing decisions.
Look at
Scripts or configurations that reference rejecting or down-ranking invalid routes.
Good evidence
Is clear, documented settings that specifically enforce these rules.
- Check 3 of 5What an auditor asks for
Look at
Evidence of training sessions or materials covering RPKI and secure BGP routing.
Good evidence
Includes up-to-date training content and attendance records.
- Check 4 of 5What an auditor asks for
Ask for
The communication log with the network provider: Request evidence of discussions between the organisation and their ISP regarding secure routing practices.
Look at
Email exchanges or meeting notes.
Good evidence
Includes recent, documented interactions affirming compliance with RPKI practices.
- Check 5 of 5What an auditor asks for
Look at
A recent, regular schedule of checks.
Good evidence
Is a verified log indicating consistency and up-to-date information.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
Annex A 8.20 requires secure management and control of networks to protect information and maintain trusted connectivity. ISM-2018 supports this by requiring BGP routers to reject or deprioritise invalid RPKI-originated routes, reducing the likelihood of traffic misdirection, interception or outage. Annex A 8.20 is broader because it covers network security across all protocols, devices and segments, while ISM-2018 is specific to BGP routing validation behaviour.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.