ASD ISM 1241 Ensuring secure web application output encoding
What it says
Output encoding is performed on all output produced by web applications.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWeb applications must correctly encode all their outputs to prevent security risks.
When web applications output information to users, they need to encode this information properly to prevent security risks like data breaches or malware attacks. If this isn't done, cybercriminals might take advantage of it by tricking the application into running harmful scripts, which could lead to loss of sensitive information or control over the site.
Free. Save your status, tasks and notes.
Why it matters
Without output encoding on all web application responses, attackers can inject scripts (XSS), resulting in session theft, data leakage, and site hijacking.
How to implement
The IT team should review the web application code to identify parts where output is sent to users, such as web pages or data files.
Check that parts like text boxes and other outputs are properly encoded using established coding libraries or methods. This means turning potential harmful content into harmless text that users and computers can safely read.
Developers should apply consistent output encoding to all parts of web applications where data is shown to users.
Ensure they use reliable coding strategies such as HTML or JavaScript encoding, making it much harder for harmful scripts to run by accident.
The IT security team should conduct regular tests on web applications using security tools to scan for any areas left without proper encoding.
Use online tools or software auditing services to find loopholes where encoding is missing, offering a chance to fix those gaps before any harm occurs.
Business managers should provide resources and training sessions on secure coding practices for their development teams.
Arrange workshops or hire experts to demonstrate how proper encoding can prevent breaches and protect organisational data.
Chief Information Officers (CIOs) must ensure policies are in place for developers to follow when encoding outputs in web applications.
Develop guidelines that detail the accepted encoding techniques and routinely update them as new threats arise or technology evolves.
Keep it running
Confirm all dynamic output is context-appropriately encoded (HTML, attribute, JS, URL) and regression test templates and APIs after changes to prevent XSS.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The web application's development and security policies: Request documentation on encoding practices.
Look at
The guidelines provided to developers detailing how to encode outputs.
Good evidence
Includes clear, current policies with examples of applied encoding techniques.
- Check 2 of 5What an auditor asks for
Ask for
Records of recent security tests and audits of web applications: Request reports on tests checking for encoding errors.
Look at
Documented results showing tests have been carried out and any fixes applied.
Good evidence
Would show regular testing schedules and evidence of resolved issues.
- Check 3 of 5What an auditor asks for
Ask for
To see training schedules and materials for developers on secure coding practices: Request training content relating to output encoding.
Look at
Sessions that include specific encoding strategies and why they're necessary.
Good evidence
Would include a regular training schedule with updated material reflecting current best practices.
- Check 4 of 5What an auditor asks for
Ask for
A demonstration of the web application's output encoding in action: Request access to a controlled application environment to see encoding at work.
Look at
Encoding in parts where users input and see data.
Good evidence
Demonstration shows consistent encoding application and no visible encoding errors.
- Check 5 of 5What an auditor asks for
Ask for
Code review records that include output encoding checks: Request documentation from development cycles showing attention to encoding.
Look at
Formal reviews that include output encoding checks.
Good evidence
Record includes checklists with detailed notes and sign-offs from senior developers or security experts.
Mappings
Closest match in ISO/IEC 27001: A.8.25, Secure development lifecycle, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.25.
ISM-1241 addresses a specific secure development requirement: encoding all web application output to prevent unsafe interpretation in browsers. Annex A 8.25 requires rules for secure development of software and systems to be established and applied, which would normally include standards for output encoding/escaping for web applications. ISM-1241 is one concrete rule within a secure development lifecycle, while Annex A 8.25 is broader and covers the full set of secure development rules and practices.
This control partially meets A.8.28.
ISM-1241 requires that output encoding is performed on all output produced by web applications to prevent injection-style client-side attacks (e.g. XSS). Annex A 8.28 requires secure coding practices to be applied across software development, which commonly includes output encoding/escaping in web applications. ISM-1241 is a specific secure coding requirement focused on web output handling, while Annex A 8.28 is broader and covers many additional coding practices beyond output encoding.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.