ASD ISM 2050 Validate digital signature certificates securely
What it says
When digital signatures are processed by software, they are validated against a certificate trust chain and checked for revocation using a Certificate Revocation List or with the Online Certificate Status Protocol.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSoftware checks digital signatures against trusted certificates and ensures they haven't been revoked.
Digital signature certificates are like ID cards for software, proving they are legitimate and from a trusted source. If these certificates aren't checked properly, malicious software could slip through, posing risks like data theft or system compromise.
Free. Save your status, tasks and notes.
Why it matters
If certificate chains and revocation (CRL/OCSP) aren't validated, attackers can use forged or revoked signing certs to deliver trusted-looking malware.
How to implement
IT team should regularly update the list of trusted certificates: This involves keeping software libraries up-to-date with recent trusted digital certificates to avoid using expired or revoked ones.
Use a trusted provider or service to obtain these updates.
System owners should verify the authenticity of software: When installing new software, check if its digital signature matches a trusted certificate.
This is done by viewing the certificate details provided in the installation prompt.
Security personnel must monitor certificate validity: set up the system to automatically check if certificates are revoked or expired, using protocols like the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).
This ensures only valid certificates are used.
Procurement teams should ensure vendors provide valid certificates: When purchasing software, require vendors to provide proof that their digital signatures are backed by valid and current certificates.
Request accompanying documentation with any software purchases.
IT managers should train staff on recognising valid certificates: Training should include how to spot warning signs that a certificate might be invalid or revoked, and how to report it.
Use practical examples during training sessions to illustrate potential risks of ignoring certificate validation.
Keep it running
Regularly update the certificate trust store and automate checks for revocation using CRLs or OCSP to ensure constant validation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of trusted certificates: Request the comprehensive list of certificates that the IT team maintains for software validation.
Look at
The date of the last update and the source of the certificates.
Good evidence
Is an up-to-date list showing the latest trusted certificates sourced from a reliable authority.
- Check 2 of 5What an auditor asks for
Ask for
Software verification logs: Request logs showing digital signature validation for installed software on organisational systems.
Look at
Records indicating successful verification or rejection of signatures.
Good evidence
Is detailed logs showing consistent checks against trusted certificates.
- Check 3 of 5What an auditor asks for
Ask for
A policy document: Request the organisation's digital signature verification policy document.
Look at
The procedures and responsible roles defined within.
Good evidence
Is a detailed document outlining the steps to verify digital signatures, including revocation check methods.
- Check 4 of 5What an auditor asks for
Ask for
Vendor compliance documentation: Request to see the documentation vendors provide regarding their software's digital signatures.
Look at
Evidence that the signatures are backed by valid and non-revoked certificates.
Good evidence
Contains vendor-submitted documentation with visible certificate details and expiry dates.
- Check 5 of 5What an auditor asks for
Ask for
Training records: Request evidence of training sessions conducted on digital signature validation.
Look at
Attendance logs and training materials.
Good evidence
Includes records of recent training sessions with clear focus on certificate validation and practical examples discussed.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-2050 requires software to validate digital signatures using certificate trust chains and revocation checking (CRL/OCSP). This is a specific cryptographic assurance mechanism that fits within Annex A 8.24's broader requirement to define and implement effective use of cryptography and cryptographic key management. Annex A 8.24 covers wider governance and lifecycle topics (algorithms, key generation, storage, rotation and revocation processes), while ISM-2050 focuses on runtime signature certificate validation.
ASD Essential Eight: 1 mapping
This control supports E8-RM-ML3.1.
E8-RM-ML3.1 requires macros to execute only when digitally signed by a trusted publisher (or from a Trusted Location/sandbox). ISM-2050 supports E8-RM-ML3.1 by enforcing robust certificate chain and revocation checks for digital signatures, ensuring the 'trusted publisher' decision is technically sound. E8-RM-ML3.1 outlines macro execution policy, while ISM-2050 defines cryptographic validation practices that bolster signature trustworthiness.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.