ASD ISM 2150 Gateways block connections for unauthorised RMM and remote access tools
What it says
Network connections for unauthorised RMM tools and remote access tools are blocked at gateways.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGateways must stop network traffic from remote monitoring and management (RMM) and remote access tools that the organisation has not approved, so attackers cannot use them as a back door.
Remote monitoring and management (RMM) tools and remote access tools (products such as remote-desktop and screen-sharing software) let someone control a computer from somewhere else. IT teams use approved versions of these tools legitimately, but attackers love them too, because a remote access tool that is already installed and talking out to the internet looks like ordinary administration traffic and gives them hands-on-keyboard control without needing to write their own malware. This control says the organisation's gateways (the points where its networks connect to the internet or other external networks) must block the network connections used by RMM and remote access tools that have not been authorised. The organisation decides which of these tools are approved, and everything else in that category is denied at the gateway. It matters because an unauthorised remote access tool is a common way attackers keep persistent access after an initial compromise, and it is also how insiders or well-meaning staff can open unmanaged paths into the network. Blocking the connections at the gateway means that even if such a tool is installed on a device, it cannot reach its operator on the outside.
Free. Save your status, tasks and notes.
Why it matters
If unauthorised RMM and remote access tools can connect through the gateway, an attacker who installs one (or abuses one a user has installed) gains interactive, persistent control of internal systems that blends in with legitimate administration traffic. That access can be used to move laterally, steal data and deploy ransomware, and it can persist for long periods because nothing at the network edge stops it. Unmanaged remote access paths also bypass the organisation's approved, monitored remote access channels, so security teams lose visibility of who is connecting and from where.
How to implement
Security or IT management defines and documents which RMM and remote access tools are authorised for the organisation, so gateway administrators have a clear allow list to build rules against.
Gateway or firewall administrators enable application-control or category-based blocking on every internet and external gateway for the RMM and remote access tool category, then add explicit exceptions only for the documented authorised tools.
Gateway administrators supplement application signatures with domain, IP and protocol block rules for known unauthorised remote access tools where the gateway platform cannot identify a tool by signature alone.
Gateway administrators subscribe to and apply vendor signature and category updates on a regular schedule so newly released or rebranded remote access tools are covered by the block rules.
Network security staff configure gateway logging for blocked RMM and remote access connections and hand repeated hits from the same internal host to the security operations team for investigation and tool removal.
Keep it running
Day to day, this control depends on two things being kept current: the organisation's list of authorised RMM and remote access tools, and the gateway rules that block everything else in that category.
Gateway administrators maintain block rules (application-control signatures, category filters, domain and IP lists, or protocol and port rules as the platform supports) covering the connections that unauthorised RMM and remote access tools use. Because vendors change their infrastructure and new tools appear regularly, those signatures and lists need routine updates rather than a one-off configuration.
When a business area asks to use a new remote access tool, the request goes through the organisation's approval process before any gateway exception is created, and exceptions are scoped to the approved tool. Gateway logs showing blocked remote access connections are useful signals: repeated blocks from a single host may indicate an installed but unauthorised tool that should be investigated and removed.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the organisation's list of authorised RMM and remote access tools and the approval record behind it.
Look at
Check that the list is specific, current and formally approved rather than a loose collection of tools people happen to use.
Good evidence
A dated, approved list naming each authorised tool exists and the gateway exceptions map directly to it.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the gateway or firewall configuration that blocks RMM and remote access tool connections on each internet and external gateway.
Look at
Look for application-control, category or explicit block rules covering remote access tools, and confirm they apply to all gateways, not just the main one.
Good evidence
Every gateway has an active rule set that denies the remote access tool category by default with narrow exceptions for authorised tools only.
- Check 3 of 5What an auditor asks for
Ask for
Ask for evidence that gateway application signatures and block lists are kept up to date.
Look at
Check the signature version, update schedule and last update date on each gateway.
Good evidence
Signatures and lists have been updated recently on a regular cadence so new or renamed remote access tools are caught.
- Check 4 of 5What an auditor asks for
Ask for
Ask for gateway logs or reports showing blocked RMM and remote access tool connections over a recent period.
Look at
Confirm that blocks are actually being recorded and see whether repeated blocks from the same host were followed up.
Good evidence
Logs show the rules firing in practice and repeated hits from an internal host led to an investigation and removal of the tool.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the results of any test or validation that unauthorised remote access tools cannot connect through the gateway.
Look at
Look for a documented test, such as attempting a connection with a non-approved tool from inside the network, and its outcome.
Good evidence
A recent test demonstrates that a non-approved tool's connection is blocked at the gateway while an authorised tool still works.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-2150 requires gateways to block network connections for unauthorised remote monitoring and management (RMM) and remote access tools to prevent their use as back doors. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which commonly includes perimeter filtering, egress controls and blocking unwanted protocols/applications. ISM-2150 is a specific, concrete network security measure that sits within the broader network/device security outcomes of Annex A 8.20.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.