ASD ISM 2167Disabling Pre-Shared Key Fallback Authentication for MACsec
MACsec links must not be allowed to fall back to a Pre-Shared Key for authentication when the primary method fails, so a weaker, static secret can never quietly take over.
Plain language
MACsec (IEEE 802.1AE) encrypts traffic between two directly connected network devices, such as a switch and a router or two switches across a leased link. Before the encryption can start, the two ends have to authenticate each other and agree on keys. This is usually done through a stronger method such as 802.1X with certificate-based EAP (EAP-TLS), but many devices also support a simpler option: a Pre-Shared Key (PSK), which is a fixed secret typed into both ends. Some products let you configure the PSK as a fallback, meaning if the primary authentication fails, the link silently switches to the PSK instead. This control requires that PSK fallback is disabled. It matters because a fallback path is only as strong as its weakest option. A static key is easier to steal, is rarely rotated, and gives an attacker a way to force a downgrade: if they can disrupt the primary authentication (for example by interfering with the certificate or authentication server), the link drops to the PSK, which they may already have obtained. With fallback disabled, a failure of the primary method causes the link to fail closed rather than continue on a weaker secret, which is the safer outcome for a link carrying sensitive traffic.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2026
Control Stack last updated
05 Sept 2026
E8 maturity levels
N/A
Official control statement
The use of a Pre-Shared Key as a fallback authentication method for MACsec is disabled.
Why it matters
If PSK fallback remains enabled, an attacker who obtains or guesses the static key, or who can disrupt the primary authentication method, can force the MACsec link to downgrade and then decrypt, inject or replay traffic on what is assumed to be a protected link. The downgrade can occur without any alert, so the organisation may believe the link is strongly authenticated when it is not, undermining the confidentiality and integrity assurance MACsec was deployed to provide.
Operational notes
Day to day, this is a configuration setting on each MACsec-capable interface or key-agreement policy. Network engineers should treat PSK fallback as off by default in their standard templates, and any change management for MACsec links should include a check that fallback has not been re-enabled while troubleshooting a failed link. When a MACsec link will not establish, the correct response is to fix the primary authentication (certificates, authentication server reachability, clock skew), not to switch on PSK fallback as a workaround. Configuration compliance tooling or scheduled scripts can compare running configuration against the approved baseline and flag any interface where PSK fallback is present. Vendor syntax varies, so keep a per-platform note of the exact commands or settings that represent "fallback disabled" so audits and peer reviews are consistent.
Implementation tips
- Network engineers: inventory every device and interface where MACsec is configured, record the primary authentication method in use, and note whether a PSK fallback option is present on each platform.
- Network engineers: on each MACsec interface or MKA (MACsec Key Agreement) policy, remove or explicitly disable the PSK fallback setting using the vendor-specific command, then verify with a show or status command that only the primary method is listed.
- Network architecture or standards owners: update the organisation's MACsec configuration template and hardening standard so that PSK fallback is disabled by default and any exception needs documented approval.
- Network operations: add a configuration compliance rule (in the network management or config-audit tool) that scans running configurations for PSK fallback settings on MACsec interfaces and raises a ticket if one is found.
- Network operations and change managers: include a test step in MACsec change tickets that confirms the link fails closed when the primary authentication is unavailable, so a broken primary method is fixed rather than bypassed with a PSK.
Audit / evidence tips
- AskAsk for the list of all devices and interfaces where MACsec is configured, including the authentication method used on each.Look atCheck that the inventory is complete and current, and that each entry records the primary authentication method and whether a PSK fallback option exists on that platform.GoodA maintained inventory covering every MACsec link, with the primary method recorded for each and no link configured to fall back to a PSK when that method fails.
- AskAsk for the running configuration (or a configuration export) of a sample of MACsec interfaces or MKA policies.Look atLook for any PSK fallback keyword or setting on those interfaces and compare against the vendor documentation for what disabled looks like.GoodNo PSK fallback setting is present or it is explicitly set to disabled on every sampled interface, matching the vendor's documented disabled state.
- AskAsk for the organisation's MACsec hardening standard or configuration template.Look atCheck whether it states that PSK fallback must be disabled and whether it describes an exception process.GoodThe standard clearly requires PSK fallback to be disabled, the template reflects this, and any exception requires documented risk approval.
- AskAsk for output from the configuration compliance or config-audit tool that checks MACsec settings.Look atConfirm there is a rule targeting PSK fallback, see how often it runs, and review any recent findings and how they were resolved.GoodAn active rule runs on a regular schedule, recent reports show no open findings, and any historical findings were fixed within the agreed timeframe.
- AskAsk for recent change tickets or incident records involving MACsec links that failed to establish.Look atCheck how the failure was resolved and whether PSK fallback was enabled as a workaround at any point.GoodFailures were resolved by fixing the primary authentication method, with no evidence of PSK fallback being turned on, even temporarily.
Cross-framework mappings
How ISM-2167 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(3)expand_less | ||
| Annex A 8.5 | ISM-2167 addresses secure authentication for MACsec by prohibiting PSK fallback, reducing the risk of weaker authentication being used wh... | |
| Annex A 8.9 | ISM-2167 requires organisations to disable MACsec's Pre-Shared Key (PSK) fallback authentication so links cannot silently downgrade to a ... | |
| Annex A 8.20 | ISM-2167 requires disabling PSK fallback for MACsec authentication to prevent downgrade to weaker authentication on Layer 2 links | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Networking
See all Guidelines for networking controls, or browse the full ASD ISM library.