ASD ISM 1236 Blocking malicious and anonymous domain names
What it says
Malicious domain names, dynamic domain names and domain names that can be registered anonymously for free are blocked by web content filters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWeb filters block known harmful domains and those registered anonymously or for free.
This control is about using web filters to automatically block access to harmful websites, including those that hide who registered them or can be set up for free. If we don't do this, people in your organisation could accidentally visit dangerous websites, leading to data breaches or security issues.
Free. Save your status, tasks and notes.
Why it matters
If malicious, dynamic or free anonymous domains aren't blocked by web filtering, users may browse to phishing/malware sites, causing credential theft, malware infection and data loss.
How to implement
IT team should set up a web filtering tool: They need to install software designed to block access to known harmful or suspicious websites.
This involves using services that maintain lists of such websites and configuring the software to enforce these restrictions.
Managers should educate staff about web filtering: They need to hold short training sessions explaining why certain websites are blocked.
This helps people understand that these measures are in place for security, even if they find it inconvenient.
Procurement should ensure web filters are up-to-date: When buying or renewing software, they should check that the web filtering tool auto-updates to the latest list of harmful websites.
This keeps protection current as new threats emerge.
System owners should regularly test the web filter: They need to check that it's correctly blocking known bad websites and reporting what it's doing.
Set this up as a monthly task and review any user complaints about false positives (websites wrongly blocked).
Security teams should monitor block reports: Regularly review reports generated by the filtering software to see which sites are being blocked and investigate any patterns that suggest new threats.
Adjust policies if new types of threats are identified.
Keep it running
Keep web content filter threat feeds current, enable blocking for malicious, dynamic DNS and free anonymous domains, and review web proxy/DNS logs to tune categories and add emerging domains.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The web filter installation documentation: Request records from the IT team detailing what software is used and how it's configured to block anonymous or free domains.
Look at
The configuration settings for terms like 'anonymous domain blocking' and 'free domain blocking'.
Good evidence
Is clear settings that show these kinds of domains are actively blocked.
- Check 2 of 5What an auditor asks for
Ask for
Records of staff training sessions: Request the schedule and agenda of meetings held to educate staff about web filtering.
Look at
What topics were covered and attendance lists. Good sessions should include an explanation of why blocking is essential and record attendance from all departments.
- Check 3 of 5What an auditor asks for
Ask for
To see the subscription details of the web filter: Request documentation of the current software subscription.
Look at
Auto-update capabilities and periodic renewal dates.
Good evidence
Indicates up-to-date subscription with automatic updates enabled, showing the organisation is actively managing this risk.
- Check 4 of 5What an auditor asks for
Ask for
The test logs of the web filter: Request records from system owners showing the results of recent tests on the web filtering system.
Look at
Documented evidence of sites tested and the system's blocking actions.
Good evidence
Includes a log with blocked sites and any corrective actions taken.
- Check 5 of 5What an auditor asks for
Ask for
Access to recent block reports: Request to see recent reports from the web filtering software.
Look at
Frequent suspicious sites and unusual spikes in blocking activity.
Good evidence
Includes a summary of findings and actions taken by the security team.
Mappings
Closest match in ISO/IEC 27001: A.8.23, Web filtering to reduce malicious website exposure, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.23.
ISM-1236 requires web content filters to block malicious domains, dynamic domains, and domains that can be registered anonymously for free. ISO/IEC 27001:2022 Annex A 8.23 requires managing access to external websites to reduce exposure to malicious content, which can be implemented via web filtering and domain/category blocking. ISM-1236 is a specific, prescriptive subset focused on domain-name blocking criteria, whereas Annex A 8.23 is broader and technology-agnostic about how web access is managed.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-09.2Block outbound connections to known malicious and untrusted destinations using threat intelligencePartially overlaps
This control partially overlaps IT.PRO-09.2.
IT.PRO-09.2 requires outbound network connections to known malicious or untrusted destinations to be blocked; ISM-1236 requires web content filters to block malicious domains, dynamic domains and domains that can be registered anonymously for free, a specific web case of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.