ASD ISM 1256 Implement file-based access controls for databases
What it says
File-based access controls are applied to database files.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse file permissions to safeguard database files from unauthorised access.
This control is about setting special rules for who can see or change your database files. Imagine your database as a filing cabinet full of important documents: if anyone can open it, someone could take sensitive information without you knowing. By using file-based access controls, you limit who has the keys to that cabinet, reducing the chance of a security breach.
Free. Save your status, tasks and notes.
Why it matters
Without file-based controls on database files, attackers can read or modify data, logs or backups, causing leaks and integrity loss.
How to implement
System owners should determine which staff need access to database files.
Start by listing all people currently able to access the files and remove those who don't need it. Limit the number to only those who absolutely require it for their job.
IT teams should set specific file permissions on the database files.
They can do this by using operating system tools to restrict who can read, write, or delete files. Ensure these permissions are reviewed regularly to stay up to date with staff changes.
Managers should create a process for requesting and granting access to database files.
This should include a form that people fill out, which is then approved by a senior staff member before access is given.
The IT department should perform regular checks to ensure file-based access controls are correctly in place.
They can use simple scripts or software to report who accessed files and when.
HR should ensure that any changes in staff status, like leaving the company or changing roles, are promptly communicated to IT.
This helps in adjusting file access permissions immediately, avoiding lapses in security.
Keep it running
Audit OS ACLs on database data, log and backup files so only DB service accounts and admins can access them; review after role changes.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Documentation on current file access permissions.
Look at
Employee names and their levels of access. Good evidence shows a short list of people with an appropriate access level alongside regular audit logs.
- Check 2 of 3What an auditor asks for
Ask for
The latest audit or report on file access reviews. Review how often these checks are done and any findings documented.
Good evidence
Audit involves regular review cycles and actions taken on findings.
- Check 3 of 3What an auditor asks for
Ask for
Security training records related to database access.
Look at
Records indicating staff understand how access is managed and supervised. Well-documented training helps in reducing human error related to file access.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-1256 requires applying file permissions to database files to protect them from unauthorised access. Annex A 5.15 requires organisations to establish and implement access control rules and procedures for physical and logical access based on business and security requirements. ISM-1256 fits as a concrete database-file control that would be defined and governed under the broader policy/procedure framework in Annex A 5.15.
This control partially meets A.8.3.
ISM-1256 requires file-based access controls (e.g. OS-level permissions/ACLs) to be applied directly to database files to prevent unauthorised access. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which can include controlling access to database files. ISM-1256 is a specific technical implementation detail within the broader access restriction requirement of Annex A 8.3.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.