Essential Eight AH-ML1.4 Web browser security settings locked down to users
What it says
Web browser security settings cannot be changed by users.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUsers should not be able to change web browser security settings.
This control means that regular users shouldn't be able to change the security settings in their web browsers. It's important because if people can alter security settings, they might accidentally or intentionally make the browser less secure, leaving the business open to hackers and viruses.
Free. Save your status, tasks and notes.
Why it matters
Allowing users to modify browser security settings increases risk of data breaches and malware, undermining central security controls.
How to implement
IT team should set web browser security settings by using group policies, which are rules set from a central location for managing users' computers.
System administrator should ensure that all web browsers are updated to the latest version as these come with more robust security features that are not easily changed.
Security officer should review and document the security settings of all browsers to make sure they match the organisation's security policy.
IT team should disable features like Java and pop-up windows in browsers because these can be commonly exploited by attackers.
System administrator should lock down email attachments that could change browser settings and enforce training for employees not to download suspicious files.
Keep it running
Use GPO/MDM-enforced browser policies to lock security settings. Regularly audit policy compliance and block local overrides to prevent unauthorised changes.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Are users able to change web browser security settings?
Look at
Check the group policy management console for settings related to browser security.
Good evidence
All browser security settings are managed centrally, and users cannot change them without administrative access.
- Check 2 of 2What an auditor asks for
Ask for
Are browser security settings regularly reviewed for compliance?
Look at
Look for logs or documentation showing regular audits of browser security settings.
Good evidence
Regular audits are performed and documented, confirming that security settings remain in place as intended.
Mappings
Closest match in ASD Information Security Manual: ISM-1585, Lock web browser security settings against human user changes, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
E8-AH-ML1.4 requires that web browser security settings are locked down so users cannot change them. Annex A 8.9 requires establishing, documenting, implementing, monitoring and reviewing security configurations across hardware, software, services and networks, which includes browser configuration as one component. E8-AH-ML1.4 is a specific endpoint/browser configuration constraint, whereas Annex A 8.9 is an organisation-wide configuration management requirement.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1585.
E8-AH-ML1.4 requires that web browser security settings are locked down so users cannot change them. ISM-1585 states the same requirement, explicitly mandating that web browser security settings cannot be changed by users. The scope and intent align closely, with both focused on preventing user-driven weakening of browser security posture.
This control partially meets ISM-1412.
E8-AH-ML1.4 requires that web browser security settings are locked down so users cannot change them. ISM-1412 requires web browsers to be hardened using ASD and vendor guidance, which typically includes enforcing policies so users cannot relax security settings. E8-AH-ML1.4 covers only the lock-down aspect, whereas ISM-1412 addresses a broader hardening baseline across multiple browser security controls.
- ISM-0382Prevent unprivileged human users uninstalling or disabling approved applicationsPartially overlaps
This control partially overlaps ISM-0382.
ISM-0382 requires that unprivileged users cannot uninstall or disable approved applications. E8-AH-ML1.4 aligns by ensuring unprivileged users cannot change web browser security settings, reducing the likelihood they can effectively 'disable' protections within an approved browser. The candidate is limited to browser security configuration, while ISM-0382 is focused on preventing removal or disabling of approved applications themselves across the environment.
This control partially overlaps ISM-1235.
E8-AH-ML1.4 requires that web browser security settings cannot be changed by users. ISM-1235 restricts browser (and other application) add-ons/extensions to an organisation-approved set, which is a specific browser-hardening control that often relies on preventing users from changing extension settings or installing new extensions. ISM-1235 is narrower and focused on extension governance, while E8-AH-ML1.4 covers all browser security settings, not just add-ons.
This control partially overlaps ISM-1748.
ISM-1748 requires that users cannot change security settings in their email clients. E8-AH-ML1.4 is closely related in intent because it similarly requires preventing users from changing security settings, but for web browsers rather than email clients. The overlap is the 'lock down user-modifiable security settings' implementation pattern, while each control applies to a different application class and therefore protects different attack surfaces.
This control partially overlaps ISM-1825.
ISM-1825 requires locking security product settings so human users cannot alter protections. E8-AH-ML1.4 requires web browser security settings to be locked down so users cannot change them, applying the same prevention of local weakening of security posture. The shared ground is enforcing immutability of security-relevant settings, but E8-AH-ML1.4 targets browser configuration while ISM-1825 targets security product controls such as AV/EDR/host firewalls.
This control supports ISM-1486.
ISM-1486 requires that web browsers do not process Java from the internet. E8-AH-ML1.4 supports this by ensuring web browser security settings cannot be changed by users, helping maintain the Java-blocking configuration once applied. E8-AH-ML1.4 does not itself mandate blocking Java; it focuses on preventing user-driven configuration drift.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML1.4 requires that web browser security settings cannot be changed by users, which protects the browser settings in such a baseline.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.