Essential Eight AH-ML1.3 Web browsers block web ads from the internet
What it says
Web browsers do not process web advertisements from the internet.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure web browsers do not display internet ads to prevent potential security risks.
This control is about making sure your web browsers block internet advertisements. It matters because some ads can sneak nasty software onto your computer, which might steal your information or cause other trouble. Stopping ads helps keep your computer and data safe.
Free. Save your status, tasks and notes.
Why it matters
If browsers process internet ads, malvertising can deliver malware or credential theft via ad networks, leading to compromise and data loss.
How to implement
IT team should install ad blocker extensions on all company web browsers.
This can be done by selecting a reputable ad blocker from the browser's extension store and installing it on each browser used by the organisation.
System administrator should configure web content filtering to block advertisements on the network.
This can be achieved by setting up filters on the network's firewall or router to block ad-serving domains.
IT manager should ensure users cannot disable ad blockers in their browsers.
This can be done by applying browser settings through group policy that prevent changes to the extension settings.
IT support should provide training to all staff on why blocking ads is important.
This can be done through a short online session explaining the risks of 'malvertising' and how it can affect them.
Keep it running
Enforce browser policies or approved ad-blocking extensions to block internet ads, and regularly test updates so ads are not processed.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How are web advertisements blocked in the organisation's web browsers?
Look at
Check for installed ad blocker extensions in the web browsers used across the organisation.
Good evidence
All web browsers have a verified ad blocker extension installed that is active.
- Check 2 of 2What an auditor asks for
Ask for
What measures are in place to prevent users from disabling ad blockers?
Look at
Review group policy settings related to browser extensions and user permissions.
Good evidence
Policies are in place that lock ad blocker settings so users cannot change or disable them.
Mappings
Closest match in ASD Information Security Manual: ISM-1485, Prevent web browsers from processing ads, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
Annex A 8.7 requires organisations to implement measures that protect against malware and to support them with user awareness. E8-AH-ML1.3 relates by requiring web browsers to block web ads from the internet, reducing malvertising-based malware delivery. E8-AH-ML1.3 is a specific hardening technique for a particular malware vector, while Annex A 8.7 is broader and covers multiple vectors and awareness.
ASD Information Security Manual: 2 mappings
This control is equivalent to ISM-1485.
E8-AH-ML1.3 requires that web browsers do not process web advertisements from the internet to reduce exposure to malvertising and ad-delivered exploitation. ISM-1485 states the same requirement that web browsers do not process web advertisements from the internet. Both controls have the same technical intent and endpoint/browser enforcement scope, with no material difference in depth or coverage.
This control partially meets ISM-0963.
E8-AH-ML1.3 requires preventing web browsers from processing internet-served advertisements. ISM-0963 requires implementing web content filtering to block potentially harmful web-based content, which can include advertising and related ad networks as part of broader content categories. E8-AH-ML1.3 is a specific subset of the broader web filtering outcome described by ISM-0963.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML1.3 requires that web browsers do not process web advertisements from the internet, a browser setting such a baseline would enforce.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.