search account_circle

policyASD ISM

Guidelines for gateways

63 controls in this part of theACSC ISM. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Content filtering

Filter Gateway Files for Allowed Types

Ensure only permitted file types are imported or exported through gateways.

Block Malicious or Uninspectable Files

Block files flagged as harmful or that cannot be scanned to prevent threats.

Quarantine Suspicious Files for Review

Files flagged as risky are held until checked and cleared or blocked.

Filtering Content of Gateway and CDS Files

Files passing through gateways or security systems are checked for unwanted or harmful content.

Ensure File Integrity Through Signature Validation

Files with digital signatures or checksums must be verified at system boundaries to ensure integrity

Ensure Content Validation for Gateway Files

Check files coming in and out of gateways to ensure they meet security standards.

Ensure Content Conversion at Gateways

Files going through gateways must be converted to ensure security and compatibility.

Ensure Gateway and CDS File Content Sanitisation

Files passing through gateways or CDSs are cleaned to remove harmful content.

Antivirus Scanning of Gateway Files

Files going through gateways are checked with several antivirus programs for safety.

Controlled Unpacking of Archive Files for Filtering

Ensure unpacked archive files do not disrupt system filters or cause unavailability.

Analyse Executable Files in Sandboxes

Files coming through gateways are tested in a safe environment to catch suspicious activities.

Ensure Rigorous Testing of Content Filters

Content filters need thorough testing to make sure they work properly and can't be bypassed.

Content Checking for Imported or Exported Files

Files passing through gateways or data systems are checked to ensure they meet security requirements

Content Filtering

Unpack Archive Files for Content Filtering at Gateways

Archive files moving through gateways or Cross Domain Solutions are unpacked first so their contents

Decrypt Encrypted Files for Content Filtering

Encrypted files must be decrypted to check their content when transferred through gateways.

Cross Domain Solutions

Consult ASD Before Changing CDS Connectivity

Consult ASD when adding connections to cross domain systems and follow their guidance.

Train Users on Secure Use of CDSs

Users must be trained on securely using CDSs before they can access them.

Implementing CDS for Secure Network Segmentation

Cross Domain Solutions connect SECRET or TOP SECRET networks with other networks securely.

Ensure Network Paths are Isolated in CDSs

Systems manage separate and secure network paths for upward and downward data movements to prevent s

Central Logging of CDS Security Events

Ensure all key security events of Cross Domain Solutions are logged centrally for monitoring.

Use Protocol Breaks to Separate Network Layers

Ensure data flows are separated by breaking protocols at each network level for security.

Ensure CDSs Separate Upward and Downward Data Paths

CDSs have independent security controls for data going both up and down between networks.

Regular Assessment of Security Events in CDS

Every three months, security events are reviewed to ensure CDS are working correctly and follow data

Diodes

Use of Diodes for Unidirectional Gateway Security

Use special devices (diodes) to ensure data flows one way only between networks, enhancing security.

High Assurance Evaluation of Unidirectional Gateways

Ensure diodes used between secure and public networks are highly evaluated for safety.

Use NSA-evaluated Degaussers for Media Destruction

When destroying media, use degaussers approved by the NSA to ensure effectiveness.

High Assurance Evaluation for Network Diodes

Diodes ensure secure, one-way data flow between secret and other networks.

Firewalls

High Assurance Evaluation for Diode Gateways

Ensure diodes for secure data flow in sensitive networks are thoroughly evaluated for high security.

Utilising Evaluated Firewalls for Network Security

Firewalls are installed to separate the organisation's networks from the public internet, enhancing

Gateways

Regular IRAP Assessment of Sensitive Gateways

Sensitive gateways must have an IRAP assessment at least every two years using the latest ISM standa

Restrict Privileges for Gateway Administrators

Gateway admins have only the necessary access permissions for their tasks.

Training for Gateway System Administrators

Gateway system admins must be formally trained to operate and manage the gateways effectively.

Requirement for Gateway System Administrators Nationality

Only Australian nationals can manage gateways to certain secure networks.

Ensure Separation of Duties for Gateway Admins

Different people handle administrative tasks for gateways to reduce security risks.

User Authentication for Network Gateway Access

Ensure users verify their identity before accessing networks through gateways.

Ensuring Network Authentication via Gateways

IT devices must prove their identity to access networks through gateways.

Implementing Secure Network Gateways

Set up gateways to securely connect networks from different security levels.

Manage Gateways Between Different Security Domains

Secure shared network components by assigning management to higher security system admins or a trust

Restrict Data Flows with Authorised Gateways

Gateways should block any data transfers not specifically approved.

Central Logging for Gateway Security Events

Log gateway events and alerts to monitor data flows and detect intrusion attempts.

Implementing Demilitarised Zones in Gateways

Gateways use demilitarised zones to safely allow outside parties access to organisational services.

Regular Testing of Gateway Security Configurations

Gateways are tested every six months or after changes to ensure they meet security standards.

Inspecting and Filtering Data with Gateways

Gateways check and filter data to ensure only safe data passes through the network.

Prevent IP Source Address Spoofing in Gateways

Gateways block fake IP addresses to protect network entries.

Employment Screening for Gateway Administrators

Ensure appropriate screening and security clearance for gateway admins based on system sensitivity.

Eligibility Criteria for Gateway System Administrators

Only Australian or seconded foreign nationals can manage government-only network gateways in Austral

Secure Management Paths for Network Gateways

Gateways are managed separately from any networks they are connected to ensure security.

Secure BGP with Valid ROA for IP Addresses

Ensure public IP addresses are protected by valid Route Origin Authorisation records to enhance secu

Secure BGP Routing with RPKI-Registered IP Addresses

Routers reject or down-rank invalid IP address routes to enhance BGP security.

Routine Security Assessments for TOP SECRET Gateways

TOP SECRET gateways are reviewed for security by authorised assessors every two years.

Peripheral switches

Use Evaluated Peripheral Switches Securely

Use verified switches to safely share devices between different computer systems.

Evaluate Peripheral Switches for Security Domains

Ensure devices used to share equipment between classified systems meet high security standards.

Ensure High Assurance for Peripheral Switches

Peripheral switches used between classified and unclassified systems must undergo a thorough securit

Web application firewalls

Restrict Access and Conceal Web Server IP Addresses

Avoid revealing server IPs and limit access exclusively to WAFs and authorised networks.

Web content filters

Inspect and Decrypt TLS Traffic through Gateways

Gateways decrypt and check TLS internet traffic for safety reasons.

Implement Domain Name Allow and Block Lists

Create a list of approved or blocked domains for secure web traffic management.

Restrict Active Content with Web Filters

Web filters block active content from unapproved websites.

Implementing Web Content Filters for Safety

Web filters help block harmful content from the internet.

Block Direct IP Access to Websites

Web filters prevent website access if using an IP address instead of a domain name.

Blocking Malicious and Anonymous Domain Names

Web filters block known harmful domains and those registered anonymously or for free.

Implement Web Content Filters for Outbound Traffic

Use web filters on outgoing internet traffic to block unsuitable content where necessary.

Web proxies

Ensure All Web Access Uses Proxies

All web access must go through web proxies to control and monitor internet use.

Log Web Proxy Activity for Security Analysis

Record details of websites accessed through web proxies, including web address and user info, for se

Back to the full ASD ISM control list, or browse the complete control library.