search account_circle

policyASD ISM

Guidelines for networking

71 controls in this part of theInformation Security Manual (ISM). Each control links to plain-English guidance, audit tips and cross-framework mappings.

Network design and configuration

Comprehensive Network Diagrams for Critical Components

Create network diagrams showing connections, critical servers, and security devices for proper docum

Maintain Comprehensive Network Documentation

Ensure that network documentation is regularly created, updated, and kept available to support netwo

Prevent Unauthorised Network Device Connections

Ensure only approved devices can connect to the network, blocking unauthorised access.

Disable Unused IPv6 on Dual-Stack Devices

Turn off IPv6 capabilities on network devices unless they are actively being used.

Avoid Using VLANs for Different Security Domains

Do not use VLANs to separate networks with different security levels.

Administer VLANs from Trusted Security Domains

VLANs must be managed from the most secure and trusted part of the network.

Disable Unused Network Device Ports

Network devices should have any unused physical ports turned off to prevent unauthorized access.

Prevent VLAN Trunk Sharing Across Security Domains

Ensure network devices do not use shared paths for VLANs from different security areas.

Prevent Unauthorised Access to Network Traffic

Security measures are in place to ensure that only authorised users can access network management sy

Use NIDS/NIPS for Gateway Network Security

Install systems at network gateways to monitor and protect against unauthorised access or threats fr

Deploy NIDS/NIPS for Gateway Traffic Monitoring

Install and configure systems to detect and alert on unauthorized network traffic past the main fire

Limit Network Documentation for Third Parties

When sharing network details, only provide what's needed for others to fulfil their contracts.

Segregate Networks by Server Criticality

Networks have separate zones based on the importance of servers, services, and data.

Implement Network Traffic Control Measures

Restrict network traffic flow to ensure it only supports business needs.

Ensure IPv6 Network Security Appliances Are Used

Use network security devices that support IPv6 to protect networks using IPv6 or both IPv6 and IPv4.

Secure Network Devices by Changing Default Credentials

During setup, change or remove default login details for network devices to enhance security.

Prevent Use of Insecure SNMP Versions on Networks

Avoid using SNMP versions 1 and 2, as they are insecure for network management.

Changing Default SNMP Community Strings on Devices

To enhance security, change default SNMP passwords and disable write access on network devices.

Separate VLANs by Security Domains

Ensure VLANs from different security domains use separate network interfaces to avoid cross-traffic.

Disable IPv6 Tunnelling Unless Necessary

IPv6 tunnelling on network devices should be disabled unless absolutely needed.

Configure IPv6 Addresses with DHCPv6 in Stateful Mode

Use DHCPv6 to manage and log IPv6 addresses centrally for enhanced network organisation.

Minimise Server-to-Server Communication

Servers should reduce interaction with each other to enhance security.

Avoid Using VLANs for Network Separation

Do not use VLANs to separate internal networks from the public internet.

Ensure Network Segregation from Service Providers

Ensure that an organisation's network is kept separate from its service providers' networks for bett

Block Inbound Traffic from Anonymity Networks

Block connections from anonymous networks to keep the organisation's network secure.

Prevent Anonymity Network Traffic in Outbound Connections

Ensure outbound connections to anonymous networks are blocked for security.

Use Protective DNS to Block Malicious Domains

A service that prevents access to harmful website addresses.

Ensure Network Devices Have Trusted Firmware

Network devices must be installed with trusted firmware before their first use to prevent security r

Restrict Exposure of Network Management Interfaces

IT equipment management interfaces should not be accessible from the internet to enhance security.

Document Device Settings for Critical and High-Value Servers

Keep records of settings for important servers and network devices to ensure strong network security

Disable SMBv1 Protocol on Networks

Ensure SMB version 1 is not active on network systems to enhance security.

Central Logging of Events on Internet-Facing Devices

Important events on internet-connected network devices are logged in a central location for security

Central Logging for Network Device Events

Logs activities from internal network devices to keep track of security-related events.

Restrict Internet Access for Networked Devices

Limit internet connection only to devices that need it to ensure security.

Network Design and Configuration

Maintain Effective Functional Separation Between Servers

Each server should perform its own distinct function and not share a machine or operating environmen

Block IPv6 Tunnelling at Externally Connected Network Boundaries

Configure your network security appliances to block IPv6 tunnelling traffic at every point where you

Encrypt Network Data with ASD-Approved Cryptography

Ensure all data over networks is encrypted using approved methods.

Monthly Restart of Network Devices

Ensure network devices are restarted every month to maintain optimal performance.

Encrypt DNS Traffic Between Clients and Servers

DNS lookups sent between your devices and DNS servers must be encrypted using cryptography approved

Service continuity for online services

Strategies for Mitigating Denial-of-Service Attacks

Discuss with cloud providers how to handle costs and actions for denial-of-service attacks to mainta

Protect Online Services from Domain Hijacking

Ensure online service domain security by locking registration and verifying details.

Segregate Critical Services to Prevent DoS Attacks

Critical online services are kept separate to reduce the risk of service disruption from attacks.

Utilising Cloud Providers for Hosting Online Services

Online services are hosted using cloud service providers for improved service continuity.

Ensure High Availability by Using CDNs

Use CDNs to keep websites running smoothly and available when needed.

Restrict IP Disclosure in CDNs

Avoid sharing web server IPs and limit access to them by CDNs and authorised networks for security.

Ensure High Availability for Online Services

Online services should switch easily between zones to maintain availability.

Monitor Capacity and Availability of Online Services

Organisations monitor online services to ensure they can handle traffic and remain available at all

Service Continuity for Online Services

Dynamic Resource Scaling for Demand Spikes

Cloud services must be able to scale resources quickly to handle sudden increases in demand.

Wireless networks

Limit Wireless Range with RF Shielding

RF shielding is used to control the wireless signal range and keep it limited to an organisation's s

Ensure Wireless Devices are Wi-Fi Alliance Certified

All wireless devices must have Wi-Fi Alliance certification for security standards.

Disable Wireless Network Administrative Interfaces

Ensure that administrative access to wireless routers cannot be done through wireless connections.

Ensure Default Wireless SSIDs Are Changed

Change default wireless network names to enhance security.

Secure Naming of Non-Public Wireless Networks

Ensure non-public WiFi network names (SSIDs) don't reveal info about the organisation or location.

Prevent SSID Broadcasting on Access Points

Wireless networks should have their SSID broadcasting disabled for security.

Avoid Static IP Addressing on Wireless Networks

Don't use fixed IP addresses for devices on wireless networks to enhance security.

Avoid Using MAC Filtering for Wireless Access Control

Do not use MAC address filtering to control devices connecting to your wireless network.

Implement EAP-TLS for Secure Wireless Authentication

Use secure EAP-TLS with certificates to authenticate devices and disable other methods.

Assessing 802.1X Components in Wireless Networks

Use evaluated devices and servers for secure wireless network authentication.

Requiring Certificates for Wireless Network Access

Devices and users must have certificates to connect to wireless networks.

Certificate Generation for Secure Authentication

Certificates must be created using approved secure tools to verify identities.

Secure Certificates for Network Authentication

Certificates must be secured using access controls, encryption, and authentication to prevent unauth

Limit PMK Caching Duration on Wireless Networks

Ensure that stored authentication data for networks isn't kept for more than a day.

Ensure Wireless Traffic is Secure with WPA3-Enterprise

Use WPA3-Enterprise 192-bit mode to secure information transferred over wireless networks.

Ensure Frequency Separation in Wireless Networks

Wireless networks should use different frequencies to avoid interference with each other.

Enabling 802.11w to Protect Wireless Management Frames

Ensure wireless networks use the 802.11w standard to secure management frames from tampering.

Use Lower-Powered Wireless Access Points for Coverage

Deploy many low-power wireless access points to cover an area instead of few high-power ones.

Enhancing Security with Encrypted RADIUS Communications

Ensure RADIUS server communications are encrypted for increased security.

Secure Default Settings for Wireless Access Points

Ensure wireless access points are secured by updating default settings for enhanced protection.

Ensure User Identity Confidentiality in EAP-TLS

Use available methods to keep user identities private when using EAP-TLS for wireless network authen

Ensure Secure Authenticator Communication for Wireless FT

802.11r is disabled unless secured by approved cryptographic protocol.

Wireless Networks

Segregate Public Wireless Networks from Organisation Networks

Ensure public wireless networks are separate from organisation networks for security.

Back to the full ACSC ISM control list, or browse the complete control library.