Essential Eight AH-ML1.2 Web browsers must not execute Java content from the internet
What it says
Web browsers do not process Java from the internet.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure web browsers block Java content from the internet to reduce security risks.
This control is about making sure your web browser doesn't run Java content from the internet, which can be a security risk. If Java content is allowed to run, it could be used by hackers to harm your computer or steal your information. It's like cutting off a potential way for crooks to break into your digital space.
Free. Save your status, tasks and notes.
Why it matters
Allowing Java in web browsers can lead to serious breaches, as attackers exploit it for drive-by downloads and remote code execution.
How to implement
IT team should review all web browsers used in the organisation to ensure they don't run Java content by changing browser settings or installing appropriate security add-ons.
System administrators should disable or remove Java plug-ins from web browsers to prevent Java content from running.
This can be done through the browser's settings or group policies.
Security personnel should use web content filters to block Java content from websites accessed through the internet.
This involves setting up rules that prevent Java from being downloaded or executed.
Office managers should communicate with employees about why Java is disabled on web browsers and the importance of not enabling it.
This can be part of a regular security briefing.
Keep it running
Regularly audit browser and plugin settings to ensure Java is blocked for internet content, as updates or user changes can re-enable it.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
What steps have been taken to ensure web browsers do not run Java content?
Look at
Check browser settings and group policies for any configurations related to disabling Java plug-ins or content.
Good evidence
There are group policy settings that clearly show Java is disabled across all browsers, and there is documentation or evidence of regular checks being conducted.
- Check 2 of 3What an auditor asks for
Ask for
Which add-ons or extensions are installed on web browsers that relate to Java?
Look at
Review the list of active extensions or add-ons in the web browsers.
Good evidence
No active Java-related extensions are found, or they are clearly marked as disabled.
- Check 3 of 3What an auditor asks for
Ask for
How are employees made aware of the policy regarding Java content?
Look at
Check for evidence of communication such as memos, emails, or training materials about not using Java content.
Good evidence
Documented employee communications with clear guidelines against enabling Java in browsers, reinforced by security briefings.
Mappings
Closest match in ASD Information Security Manual: ISM-1486, Restrict Java processing in web browsers, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.23.
E8-AH-ML1.2 requires that web browsers do not process Java content from the internet to reduce exposure to exploitation via browser-borne active content. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, which can include blocking risky content types and scripts delivered from the web. Annex A 8.23 is broader because it covers overall web access management (not just Java) and may be implemented via multiple controls (filtering, isolation, policy, monitoring).
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1486.
E8-AH-ML1.2 requires that web browsers do not process Java content sourced from the internet. ISM-1486 states the same requirement, explicitly mandating that web browsers do not process Java from the internet. The scope and intent align directly, so implementing ISM-1486 would largely satisfy E8-AH-ML1.2.
This control is broader than ISM-0961.
E8-AH-ML1.2 requires that web browsers do not process Java content from the internet. ISM-0961 requires client-side active content to be restricted by web content filters to an organisation-approved list of domain names, which can include restricting Java and similar active content. ISM-0961 is broader because it governs multiple forms of active content and uses domain allow-listing as the control mechanism, whereas E8-AH-ML1.2 is a specific prohibition focused on Java execution.
This control partially meets ISM-2110.
ISM-2110 requires user applications to be hardened using ASD and vendor guidance, choosing the most restrictive settings when guidance conflicts. E8-AH-ML1.2 mandates a specific browser hardening outcome (browsers must not process Java from the internet) that would typically be achieved by applying ASD/vendor browser hardening baselines under ISM-2110. The candidate is narrower because it targets one feature in one application category, whereas ISM-2110 covers hardening across all user applications.
This control partially overlaps ISM-0963.
ISM-0963 requires organisations to implement web content filtering to block potentially harmful web-based content. E8-AH-ML1.2 relates by hardening browsers so they must not execute Java content from the internet, which reduces exposure to a common web-delivered attack vector. The overlap is in reducing harmful web content impact, but E8-AH-ML1.2 is an endpoint/browser execution restriction rather than an organisation-wide web filtering control (e.g. category/URL filtering).
This control depends on ISM-1585.
E8-AH-ML1.2 requires that web browsers do not process Java content from the internet. ISM-1585 supports this by preventing users from changing browser security settings, helping ensure Java-blocking settings cannot be weakened or bypassed by end users. ISM-1585 does not itself require Java to be disabled; it reinforces the enforceability and durability of E8-AH-ML1.2.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML1.2 requires that web browsers do not process Java from the internet, a browser setting such a baseline would enforce.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.