Communications systems

search account_circle

policyASD ISM

Guidelines for communications systems

33 controls in this part of theAustralian Government Information Security Manual. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Fax machines and services

Prohibit the Use of Fax Machines for Messages

Fax machines and online fax services should not be used to send or receive messages.

Multifunction devices

Prevent MFD Connections to Digital Phone Systems

Do not connect multifunction devices (MFDs) to digital telephone systems.

Develop and Maintain MFD Usage Policy

Establish a policy to guide the proper use of multifunction devices.

Limit Document Sensitivity on MFDs Based on Network Classification

Multifunction devices should not scan or copy documents that are more sensitive than the network the

Ensure Strong Authentication for Multi-Function Devices

Multi-function devices should have security measures as strong as those for computers they connect t

Require User Authentication for Multifunction Devices

Users must log in to use MFDs for printing, scanning, or copying.

Central Logging of Multifunction Device Use

Uses of multifunction devices are logged centrally for tracking purposes.

Multifunction Devices

Place Multifunction Devices Where Their Use Can Be Observed

Multifunction devices (combined printers, scanners, copiers and fax machines) are located in open, v

Telephone systems

Guidelines for Discussing Sensitive Information Over Phones

Staff are informed about what sensitive information can be talked about on phone calls.

Advising on Risks of Non-Secure Telephone Systems

Staff are informed about security dangers of using unsecured phones for sensitive talks.

Visual Indication for Secure Telephone Connections

Telephone systems must show a visual cue for the security level of a call when using encryption.

Encrypt External Traffic for Sensitive Calls

Sensitive phone calls should be encrypted to prevent eavesdropping when using outside systems.

Use of Speakerphones in TOP SECRET Areas

Speakerphones can only be used in secure rooms when discussing TOP SECRET matters.

Implement Off-hook Audio Protection on Telephones

Use features to prevent phone conversations being heard in sensitive areas.

Off-hook Audio Protection Using Push-to-Talk Devices

In SECRET and TOP SECRET areas, special handsets or headsets are used to prevent unintended audio tr

Develop and Maintain Telephone System Usage Policy

Create and keep a policy for how phones should be used within the organisation.

Telephone Systems

Use Encrypted Cordless Systems for Sensitive Conversations

Do not use cordless phones for sensitive talks unless they use ASD-approved encryption.

Video conferencing and Internet Protocol telephony

Use Video and Voice-Aware Firewalls at Gateways

Ensure firewalls and proxies can handle video and voice data for secure conferencing and calls.

Secure Protocols for Video and IP Telephony

Video and IP calls must use secure protocols to keep communications private and safe.

Ensure Secure Protocols for Video and IP Calls

Video and IP calls must use secure protocols to protect communication.

Ensure Secure IP Telephony Device Authentication

Ensure only authorised IP phones can register and use the network, blocking unauthorised and unused

Authenticate Video Calls and Manage Settings

Ensure all video call actions and settings changes are verified with authentication and authorisatio

Secure Two-Way Authentication for Video Calls

Video calls must use secure two-way authentication to ensure calls are encrypted and cannot be reuse

Ensure Authentication for IP Telephony Actions

Users must be verified for all actions such as registering phones and accessing voicemail on IP tele

Ensure Traffic Separation for Video Conferencing and Telephony

Keep video conferencing and IP phone data separate from other data using VLANs or similar methods.

Restrict IP Phone Network Access in Public Areas

Public area IP phones cannot connect to data networks or access voicemail and directories.

Restrict Microphone and Webcam Use in SECRET Areas

Don't use microphones or webcams on non-classified computers in areas handling SECRET projects.

Implement Individual Logins for Secure IP Phone Use

Ensure each user has a unique login when using IP phones for secret conversations.

Develop a Denial of Service Response Plan

Create and maintain a plan to handle service disruptions for video calls and IP telephony.

Restricting Devices in Top Secret Areas

Do not use microphones or webcams with non-Top Secret devices in Top Secret areas.

Secure Video Conferencing and Telephony Systems

Ensure video and IP telephony systems are secured against threats.

Develop a Denial of Service Response Plan

Create a plan to detect, maintain, and respond to service disruptions in video and telephony systems

Video Conferencing and Internet Protocol Telephony

Separate Video Conferencing and IP Telephony Traffic From Other Data

Keep video conferencing and internet phone (IP telephony) traffic separated, either by physical cabl

Back to the full Information Security Manual (ISM) control list, or browse the complete control library.