System hardening

search account_circle

policyASD ISM

Guidelines for system hardening

221 controls in this part of theASD ISM. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Authentication hardening

System Login Security Reminder Banner

A login message that reminds users of their security duties when accessing the system.

Use Passwords When Multi-Factor Authentication Isn't Supported

If systems can't use multi-factor authentication, they should use passwords for single-factor authen

Keep Physical Credentials Separate from Systems

Store physical credentials away from systems except when logging in.

Require Minimum 15-Character Passwords for Security

Passwords for sensitive systems must have at least 15 characters to enhance security.

Ensuring Strong Passwords for TOP SECRET Systems

Passwords on TOP SECRET systems should be at least 20 characters to ensure strong security.

Enforcement of Secure Session Locking Measures

Sessions lock after inactivity or maximum duration, blocking access until users re-authenticate with

Implement Multi-factor Authentication for User Access

Unprivileged system users must use multi-factor authentication to log in to enhance security.

Disable Insecure LAN Manager Authentication

Systems must disable outdated LAN Manager and NT LAN Manager authentication to enhance security.

Use Multi-Factor Authentication for Privileged Users

Privileged users must verify their identity using multiple forms of identification to log into syste

Randomly Generate User Account Credentials

User account passwords must be created randomly to enhance security.

Implement Multi-Factor Authentication for Security

Users need to use multiple identification methods to ensure secure access.

Protecting Stored Credentials with Security Measures

Store credentials securely using a password manager, hardware module, or by enhancing them with tech

Implement Multi-factor Authentication

Users need multiple forms of ID to access sensitive online services, enhancing security.

Implement Multi-factor Authentication for Data Repositories

Require multi-factor authentication for accessing data storage to enhance security.

Ensure User Authentication Before System Access

Verify user identities before they can access any system.

Ensure Strong Passwords for SECRET Systems

Passwords for SECRET systems must be at least 17 characters long to enhance security.

Ensure Secure Construction of Passwords

Passwords must not use predictable sequences, like quotes or sentences, and must meet minimum word c

Minimum Password Length for Secure Systems

Passwords for secure systems should have at least 6 characters to enhance security.

Ensure Strong Passwords for SECRET System Authentication

Passwords for SECRET systems using multi-factor authentication must be at least 8 characters.

Ensure Strong Passwords for TOP SECRET Systems

TOP SECRET systems must use passwords of at least 10 characters for added security.

Mandate Credential Changes Upon Compromise

Change user account credentials if they're compromised or potentially insecure.

Verifying User Identity for New Credentials

Users need to show proof of who they are before getting new login details.

Secure Delivery of User Account Credentials

Credentials are securely delivered to users, or split between users and supervisors if secure delive

Ensure Initial User Credentials Are Changed

Users must change their initial passwords the first time they log in to enhance security.

Avoid Reusing Credentials Across Systems

Users should not use the same passwords on different systems for better security.

Ensuring Credential Input Obscurity

Passwords and personal credentials are hidden when entered in systems to enhance security.

Disabling Vulnerable Authentication Methods

Turn off login methods that can be tricked into accepting false entries.

Configure Service Accounts as Managed Service Accounts

Ensure service accounts are created as Managed Service Accounts for improved security.

Use Multi-factor Authentication for Third-party Services

Use multiple verification steps for accessing external services with sensitive data.

Use Multi-Factor Authentication for Online Services

Users must use multi-factor authentication for online services handling non-sensitive data.

Mandating Multi-Factor Authentication for Customer Services

Customers must use multi-factor authentication when accessing sensitive online services.

Enhance User Security with Phishing-resistant MFA

Multi-factor authentication protects systems by not relying solely on passwords, reducing phishing r

Central Logging of Multi-factor Authentication Events

Multi-factor authentication attempts, whether they succeed or not, are logged together in a central

Strengthening Passwords for Critical Accounts

Ensure passwords for high-risk accounts are strong, unique, and properly managed.

Enable Credential Guard for Credential Protection

Credential Guard is activated to better protect user credentials from unauthorised access.

Limit Cached Credentials to Single Logon

Users' credentials are stored only for their last login to enhance security.

Set 30-Character Minimum for Key Administrator Passwords

Ensure key system accounts use passwords that are at least 30 characters long to enhance security.

Enable Local Security Authority Protection

Ensure the system has measures to secure login details against unauthorized access.

Ensuring Phishing-Resistant Multi-Factor Authentication

Users must use multi-factor authentication that resists phishing when accessing online services.

Enhance Security with Phishing-Resistant MFA

Online services should use multi-factor authentication that cannot be easily tricked by phishing.

Phishing-Resistant Multi-Factor Authentication for Customers

Online services use multi-step security to prevent phishing attacks during customer login.

Monthly Network Scans for Clear-Text Credentials

Monthly scans check for passwords or credentials that are not encrypted.

Implement Multi-factor Authentication for Customer Services

Use multi-factor authentication to protect access to sensitive customer data online.

Enforcing Multi-Factor Authentication for User Security

Users must use multi-factor authentication to access third-party services handling sensitive data.

Ensuring Phishing-Resistant Multi-factor Authentication

Ensure multi-factor authentication resists phishing attempts for secure data access.

Log Single-factor Authentication Events

Keep track of successful and unsuccessful single-factor login attempts.

Enable Memory Integrity for Credential Protection

Ensure memory integrity is activated to safeguard credential data.

Enable Remote Credential Guard for Credential Protection

Activating Remote Credential Guard helps prevent unauthorised access to security credentials.

Disable Non-MFA Authentication Protocols

Ensures systems only use multi-factor authentication by disabling less secure protocols.

Prevent Self-enrollment on Untrusted Devices

Users cannot set up multi-factor authentication on devices that aren't trusted to ensure data securi

Ensure Strong Management of Admin Account Credentials

Make sure admin account passwords in each domain are long, unique, and securely managed.

Enforce Random Credentials for Administrator Accounts

Ensure admin and service account passwords are randomly generated to improve security.

Regularly Change Compromised Credentials

Change computer account passwords every 30 days or if they're compromised or suspected to be.

Regularly Update AD FS Certificates to Prevent Risks

AD FS certificates must be updated twice quickly if compromised or not updated within a year to enha

Ensure CA Servers Use Hardware Security Modules

Microsoft AD CS private keys need a hardware module for secure storage.

Avoid Using Credential Hints in Systems

Systems should not use hints to reveal or guess passwords.

Restrict MFA Options to Phishing-resistant Only

Ensure accounts using strong, phishing-proof MFA can't use less secure authentication methods.

Ensure Secure Screen Locking on Systems

Systems must lock screens after 15 minutes of inactivity, requiring full re-authentication to unlock

Eliminating Security Questions for Authentication

Authentication should not use security questions as they can be easily compromised.

Avoid Email for Out-of-Band Authentication

Do not use email for secondary authentication steps to increase security.

Ensure Passwords Are Not Common or Compromised

Make sure passwords aren't from known compromised or common password lists to enhance security.

Ensure Password Length is at Least 64 Characters

Passwords must allow a maximum length of at least 64 characters for increased security.

No Password Complexity Requirements Enforced

Passwords do not need to follow strict complexity rules.

Enforce Use of All ASCII Characters in Passwords

Allow any printable character to be used in passwords for increased complexity.

Authentication Hardening

Terminate User Sessions and Restart Workstations Daily

Ensure that all user sessions end and computers are restarted every day.

Lock Accounts After Five Failed Logon Attempts

User accounts must lock after no more than five failed login attempts, with the lockout lasting inde

Reset KRBTGT Account Password Twice After Compromise or Yearly

Change the Active Directory KRBTGT service account password twice (allowing replication in between)

Operating system hardening

Disable Automatic Execution for Removable Media

Ensure removable media cannot run programs automatically when inserted.

Disabling Unnecessary Access to Removable Media

Disable writing to removable media unless it's necessary for business.

Disable External Interfaces for Direct Memory Access

Disable external communication ports that could directly access system memory to prevent unauthorise

Disable Unneeded OS Accounts and Services

Remove or turn off unnecessary user accounts and services on operating systems to improve security.

Restrict Unprivileged User Actions on Applications

Ordinary users cannot remove or turn off approved apps on their own.

Change Default OS User Accounts During Setup

Change or disable default OS user accounts during setup to enhance security.

Central Logging of Windows Security Events

Important Windows security events are collected in a central location to monitor system activities.

Ensure Workstation Security with Application Control

Application control is used to secure workstations by managing which programs can run.

Implementing Application Control Measures

Ensure applications are controlled using secure hashing, valid certificates, or designated paths.

Disable Legacy Authentication Methods in Networks

Ensure older and less secure authentication methods are not used to protect network security.

Implement HIPS or EDR on Workstations

Ensure your computers are protected by constantly monitoring for threats.

Restrict File Modifications via Path Rules

Only certain users can change files and folders as allowed by system rules.

Use SOEs for Workstations and Servers

Use pre-configured software setups for all computers and servers to ensure consistency and security.

Ensure Use of Current OS Versions

Use the latest or previous operating system version to keep systems up-to-date.

Use 64-bit Operating Systems Where Supported

Use 64-bit operating systems if they are supported by your computer.

Implement Restrictive OS Hardening Guidelines

Ensure operating systems follow strictest security guidelines from ASD or vendors.

Implement Firewalls to Control Network Connections

Use software firewalls to control what apps and services can connect to your network.

Disable Unnecessary Removable Media Access

If you don't need to use removable devices for work, access to them should be blocked.

Utilise Publisher and Product Names in App Control

Use known publisher and product names to control which applications can run on a system.

Implement Application Control on Internet-Facing Servers

Ensure application security by using controls on servers exposed to the internet.

Prevent Script Execution by Unprivileged Users

Prevent users without admin rights from running scripts or commands that could pose security risks.

Enable Exploit Protection in Operating Systems

Ensure operating system settings are adjusted to block potential attacks.

Implement Microsoft's Application Blocklist

Organisations must use Microsoft's blocklist to stop unauthorised applications from running.

Prevent Unauthorised Changes to Security Settings

Ensure non-admin users cannot change or disable security settings on operating systems.

Annual Review of Standard Operating Environments

Standard Operating Environments must be reviewed and updated once every year.

Prevent Unauthorised Application Installations by Users

Regular users cannot install apps unless they are approved, keeping systems secure.

Implement Microsoft Attack Surface Reduction Rules

Apply Microsoft's rules to reduce potential weaknesses in user applications.

Scan Third-Party SOEs for Malicious Code

Third-party standard operating environments must be checked for viruses and bad configurations.

Disable or Remove Windows PowerShell 2.0

Ensure the outdated PowerShell 2.0 is disabled or uninstalled for security.

Ensure PowerShell Uses Constrained Language Mode

PowerShell should be setup to limit script execution and mitigate potential risks.

Centralised Logging of PowerShell Activities

Ensure PowerShell actions and logs are collected in a central place for monitoring.

Protect PowerShell Script Block Logs

PowerShell logs are safeguarded by secure event logging that ensures their protection.

Disable or Remove Internet Explorer 11

Ensure Internet Explorer 11 is not used to enhance system security.

Ensure .NET Framework 3.5 is Disabled or Removed

.NET Framework 3.5 should be turned off or uninstalled for security reasons.

Implement Application Control on Secure Servers

Ensure servers not connected to the internet have application control for security.

Restrict Application Execution to Approved Set

Only approved software and scripts can run, enhancing system security.

Restrict Execution of Drivers via Application Control

Ensures only approved drivers are run on systems, enhancing security.

Implement Microsoft's Vulnerable Driver Blocklist

Use Microsoft's list to stop harmful drivers from running on systems.

Central Logging of Application Events

All application events, whether allowed or blocked, must be recorded centrally.

Choose Secure Operating System Vendors

Choose OS vendors who prioritise secure design and memory-safe languages or practices.

Enable Security Features for System Protection

Ensure essential security features are active to protect the system during startup.

Restrict File System Permission Changes

Only authorised users can change file permissions for approved applications to maintain system secur

Implement Application Control for User Profiles and Folders

Ensure user and temporary folders for systems, browsers, and emails are secured via application cont

Implement Application Control Exclusions for System Areas

Application control is set up to avoid certain system areas like user profiles and temporary folders

Central Logging of Command Line Events

Track all command line actions by keeping a central log of every new process initiated via the comma

Ensure Operating Systems Have Approved Configurations

Organisations must create and maintain approved configurations for all operating systems.

Central Logging of Security Events on macOS

Ensure security events on macOS systems are logged centrally for monitoring.

Central Logging of Linux System Events

Important Linux system events should be logged in a central location for security purposes.

Operating System Hardening

Prevent Users Disabling, Bypassing or Exempting Application Control

Application control is a security feature that only lets approved software run on a computer, blocki

Ensure Antivirus Protection on Workstations and Servers

Install antivirus software on all computers and servers to detect and prevent malware and ransomware

Annual Validation of Application Control Rulesets

Check and approve application control rules once a year to ensure they are effective.

Server application hardening

Apply Strict Server Application Hardening Guidelines

Servers are secured using the most restrictive guidance from ASD and vendors to protect against vuln

Disable or Remove Unneeded Server Features

Remove unnecessary accounts and features from servers to enhance security.

Limit Server Application User Privileges

Server apps must run separately with only the necessary permissions to operate.

Limit Server Application User Account Privileges

Server applications have restricted user account access to the server's file system.

Secure Server Applications by Changing Default Credentials

Change or remove default user accounts and passwords in server apps to enhance security from the sta

Ensure Privileged Accounts are Secured in AD

Privileged user accounts must belong to a special security group for extra protection.

Select Vendors Committed to Secure Design for Servers

Choose server vendors who ensure secure designs and use safe programming practices.

Use Dedicated Admin Accounts for Domain Controllers

Ensure domain controllers have unique admin accounts not used elsewhere for better security.

Disable Print Spooler on AD DS Domain Controllers

Ensure the Print Spooler is turned off on AD DS domain controllers for security.

Prevent Password Storage in Group Policy Preferences

Make sure passwords aren't saved in Group Policy Preferences for added security.

Central Logging for Microsoft AD Server Activities

Log important actions on Microsoft AD servers in a central location for better monitoring.

SPN Configuration for Active Directory Accounts

Only specialised accounts should have SPNs to increase security in Active Directory setups.

Limit Privileges for User Accounts in Active Directory

User accounts are set up with just the access they need, nothing extra.

Ensure No Duplicate SPNs in Active Directory

Make sure there are no duplicate identifiers for network services in the organisation's Active Direc

Restrict Delegation of Privileged Active Directory Accounts

Ensure privileged accounts are marked as sensitive and cannot be delegated to maintain security.

Require Kerberos Pre-Authentication for User Accounts

All user accounts need extra verification when logging in for better security.

Restrict UserPassword Attribute in AD Accounts

The UserPassword field should not be used to ensure account security.

Secure Account Properties in Active Directory

Do not use account fields that everyone can see to store passwords.

Prevent Reversible Encryption of User Passwords

User account passwords must not be stored in a way that allows them to be easily decrypted.

Restrict Domain Joining to Admin Users Only

Only authorised users can add computers to the network to maintain security.

Use Privileged Accounts for Domain Machine Addition

Special accounts are used for adding computers to the network for security purposes.

Annual Review of Unconstrained Delegation in AD Accounts

Annually review AD accounts for unnecessary delegation and remove if no business need.

Prevent Non-Controller Accounts from Delegating Services

Ensure non-domain controller accounts can't be used to delegate services in Active Directory.

Disable User Security Group Access in Active Directory

When a user is disabled, they lose access to all security groups.

Restrict Pre-Windows 2000 Access Group Membership

Ensure no user accounts are added to the obsolete security group for better system security.

Ensure Server Application Configurations Are Approved

Organisations should create and maintain approved settings for server software to ensure security.

Ensure Exclusive Usage of Microsoft AD Servers

Ensure Microsoft AD servers only run their intended roles, no additional apps unless security-relate

Restrict Access to Microsoft Active Directory Servers

Only privileged users should access key Microsoft servers for security.

Ensure LDAP Signing on AD DS Domain Controllers

Make sure AD servers use secure communication to prevent unauthorised access.

Prevent Storing Passwords in Group Policy Preferences

Ensure passwords are not saved in Group Policy to enhance security.

Ensure SID Filtering for Domain and Forest Trusts

Enable SID filtering for enhanced security between domain and forest trusts.

Limit Service Accounts with SPNs in Active Directory

Reduce the number of special accounts to improve security in Active Directory.

Restrict DCSync Permissions on Service Accounts

Ensure service accounts with SPNs can't simulate domain controller operations.

Annual Review of DCSync Permissions

Review DCSync user permissions yearly and remove them if no longer needed.

Prevent Unconstrained Delegation in Domain Services

Ensure computer accounts do not allow unrestricted delegation to protect security.

Prevent Usage of sIDHistory in User Accounts

Ensure user accounts do not use the sIDHistory attribute for security purposes.

Weekly Audit of sIDHistory in User Accounts

Check user accounts weekly to ensure they don't have the sIDHistory attribute.

Restrict Domain Computers Group in Active Directory

Prevent Domain Computers from changing anything in Active Directory for security.

Enforce Certificate and User Mapping in AD Services

Ensure certificates are accurately matched to users within Active Directory.

Configuration Changes in Active Directory Certificate Services

Ensure a specific security flag is not configured in Microsoft AD CS to maintain system integrity.

Remove Enrollee Supplies Subject Flag from Templates

Ensure certificate templates do not allow users to supply their own subject information.

Restrict Write Access to Certificate Templates

Ensure regular users can't change certificate templates to maintain security.

Remove User Authentication from Extended Key Usages

Ensure that Extended Key Usages do not allow user authentication.

Approval for Certificate Template SANs in AD Services

Approval is needed before using certificate templates that let you specify extra names.

Use Dedicated Accounts for AD FS Administration

AD FS servers should be managed using special accounts not shared with other systems.

Disable Soft Matching After Synchronisation

Ensure soft matching is turned off after syncing Microsoft AD DS with Microsoft Entra ID to enhance

Disable Hard Match Takeover in Microsoft Entra Connect

Ensure that the hard match feature is turned off to prevent unauthorised access in Microsoft Entra C

Prevent Synchronisation of Privileged Accounts

Ensure privileged accounts aren't synced between Microsoft AD DS and Entra ID for security reasons.

Centralised Logging for Server Application Events

Log important events centrally for applications on internet-facing servers for security monitoring.

Central Logging for Security Events on Servers

Record important server activities in a central system to monitor non-internet-connected servers.

Ensure SPNs Use Strong Encryption in AD Services

Service accounts in Active Directory must use strong encryption to secure their SPNs.

Server Application Hardening

Remove Temporary Files After Server Installation

Ensure temporary files are deleted after installing server applications to maintain system security.

Use Latest Release of Internet-Facing Server Applications

Ensure that internet-facing server applications always use the latest software version.

Encrypt Backups of Microsoft AD Servers

Ensure backups of Microsoft AD servers are encrypted and only accessible by admins.

Minimise Members in Privileged Security Groups

Limit the number of users in highly privileged security groups like Domain Admins to enhance securit

Restrict Service Accounts from Privileged Groups

Service accounts shouldn't join Domain or Enterprise Admins for security.

Restrict Computer Accounts in Privileged Security Groups

Ensure computer accounts aren't in highly privileged security groups like Domain Admins.

Domain Computers Group Privilege Restriction

The Domain Computers group should not have any privileged access to maintain security.

Restrict Server Application Extensions to an Approved Set

Only extensions (add-on components) that your organisation has formally approved may be installed an

User application hardening

Select Secure-by-Design Committed Vendors

Choose vendors who prioritise secure design and development in their applications.

Web Browser Hardening with Strict Guidelines

Web browsers must be set with the strictest security settings per ASD and vendor guides.

Prevent Web Browsers from Processing Ads

Block web browsers from displaying online ads to enhance security.

Restrict Java Processing in Web Browsers

Ensure web browsers are set to block Java from running online.

Restrict Macro Editing to Privileged Users

Only authorised users can edit trusted Microsoft Office macros to prevent malicious code.

Blocking Internet-Originating Macros in Office Files

Microsoft Office blocks macros from files downloaded from the internet to enhance security.

Prevent Users from Changing Office Macro Security Settings

Users cannot alter the security settings for Microsoft Office macros, ensuring consistent protection

Disable OLE in Microsoft Office for Security

Microsoft Office is set to block OLE, a feature that could pose security risks.

Prevent User Changes to Browser Security Settings

Users cannot modify web browser security settings to ensure consistent protection.

Prevent Child Processes in Microsoft Office

Microsoft Office is configured to prevent it from starting other programs or processes.

Prevent Microsoft Office from Creating Executable Files

Microsoft Office is set to not produce executable files to enhance security.

Prevent Microsoft Office from Injecting Code

Microsoft Office is configured to not insert code into other programs for security reasons.

Prevent PDF Applications from Creating Child Processes

PDF software can't start other programs, stopping potential security threats.

Disabling Microsoft Office Macros for Unauthorised Users

Microsoft Office macros are turned off unless users have a proven need for them.

Enable Antivirus Scanning for Office Macros

Ensure Microsoft Office is set to scan macros for viruses to protect against malware.

Prevent Win32 API Calls by Office Macros

Microsoft Office macros cannot make direct calls to Windows APIs.

Ensuring Secure Execution of Microsoft Office Macros

Only safe Microsoft Office macros are allowed to run, using security measures like sandboxing or tru

Prevent Enabling Untrusted Microsoft Office Macros

Macros from untrusted sources in Microsoft Office can't be enabled through standard interfaces.

Prevent Changes to Email Client Security Settings

Users are not allowed to change the security settings on their email clients.

Change Default User Credentials During Setup

Change or remove default user accounts when setting up applications to enhance security.

Prevent Users from Changing Security Settings in Apps

Users can't change security settings in office software, keeping configurations secure.

Prevent Changes to PDF Application Security Settings

Users are restricted from changing security settings in PDF applications.

Ensure Security Configuration Is Immutable by Users

Users cannot modify the security settings of security products.

Hardening Office Productivity Suites

Secure your office apps using the strictest guidance from ASD and vendors to keep your data safe.

Harden PDF Applications Using ASD Guidance

Ensure PDF applications are securely configured following official security guidelines.

Ensure Macros Are Free of Malicious Code

Verify that Microsoft Office macros are safe before signing or storing them in trusted locations.

Restrict Non-V3 Signed Macros in Microsoft Office

Microsoft Office can't enable macros signed with old methods via common interfaces.

Ensure User Application Configurations are Approved

Make sure that all user applications follow approved setup guidelines to keep systems secure.

User Application Hardening

Restrict User Application Extensions

Limit application extensions to those approved by the organisation.

Use Latest Releases of User Applications

Ensure all user applications like email and web browsers are updated to their latest versions.

Disable Unneeded Accounts, Components, Services and Application Functionality

Unneeded user accounts, components, services and functionality within user applications must be disa

Validate Microsoft Office Trusted Publishers List At Least Annually

Check the list of trusted publishers in Microsoft Office at least once a year so only approved softw

Hardening User Applications with ASD and Vendor Guidance

User applications are hardened by applying both ASD and vendor hardening guidance to their configura

Remove Temporary Installation Files Post-Installation

Remove all temporary installation files created during user application installation once the applic

Disable AI Applications' Direct Access to External Public Data Sources

AI applications that handle classified (sensitive) information must not be able to reach out to exte

AI Applications Flag Risky Actions for Approval

AI applications are configured so that a defined set of risky actions are held for human approval be

Monitor Baselines for AI Application Performance

Establish baselines of expected behaviour and performance for AI applications and continuously monit

Virtualisation Hardening

Secure By Design Vendor Isolation Mechanisms

Use software isolation tools from vendors committed to secure design principles and practices.

Same Classification and Security Domain for Shared Isolation Hosts

When software isolation shares one physical server for SECRET or TOP SECRET work, the server and eve

Harden Software Isolation Mechanisms Sharing Physical Computing Resources

A software-based isolation mechanism is software (such as a hypervisor or container engine) that let

Harden the Operating System Beneath Software Isolation Mechanisms

When you run a software-based isolation mechanism (software that separates different workloads, such

Patch Isolation Mechanisms and Underlying Operating Systems Promptly

When you run a software-based isolation mechanism that shares the same physical computing resources

Integrity Monitoring and Logging for Isolation Mechanism

Ensure shared resources have integrity monitoring and logging for safety and transparency.

Replace Unsupported Software-Based Isolation Mechanisms Sharing Physical Resources

A software-based isolation mechanism is software that keeps separate workloads apart while they shar

Back to the full Australian Government Information Security Manual control list, or browse the complete control library.