ASD ISM 1269Ensure Databases and Web Servers are Separated
Official control statement
Database servers and web servers are functionally separated.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Databases and web servers should be kept separate to enhance security.
What this means in practice
This control is about keeping your database servers (where you store all your important data) separate from your web servers (which manage your website). Keeping these servers separate is crucial because it reduces the chances of an attacker accessing sensitive information if your website is hacked.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Mar 2022
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for database systemsSection
Database serversTopic
Functional separation between database servers and web servers
Why it matters
Mixing databases and web servers invites attackers to access sensitive data via compromised web apps, risking data breaches.
Operational notes
Regularly audit server connections to ensure strict separation and configure firewalls to limit inter-server communication.
Implementation tips
- The IT team should create separate physical or virtual servers for databases and web services. They can achieve this by setting up different servers on different networks or using separate cloud instances to handle web traffic and data storage tasks.
- System administrators should use network segmentation to divide the network into smaller, isolated sections. They can do this by configuring firewalls to define clear boundaries and rules between the segments where the databases and web servers operate.
- Managers should ensure that there are different access control policies for database and web server administrators. This means providing them distinct user accounts and permissions so only authorised personnel can access each type of server.
- The IT security team should perform regular security testing on both types of servers. This involves using scanning tools to check for vulnerabilities in each server type and isolating any issues found without affecting the other server.
- Procurement officers should work with IT to invest in robust monitoring tools. These tools should be set up to alert staff about any suspicious activity indicating that one type of server is trying to access the other unauthorizedly.
Audit / evidence tips
- AskNetwork diagrams: Request a detailed network map showing the separation of databases and web serversLook atClear indications of different segments or zones for the serversGoodDiagrams showing distinct segments with clear labels and separation
- AskAccess control policies: Request the official documents outlining who has access to what serversLook atThe role descriptions and permissions associated with database and web server accessGoodPolicies showing different access rights and roles for each server type
- AskSecurity testing reports: Request the latest vulnerability scan results for both server typesLook atThe scan dates and action plans for any identified issuesGoodRegularly updated reports showing resolved issues and follow-up actions
- AskMonitoring logs: Request logs from monitoring tools that track access and traffic between serversLook atThe timestamps, flagged activities, and response recordsGoodLogs showing no unauthorised access attempts with prompt responses to any unusual activity
- AskIncident response documentation: Request records of any incidents where server separation might have failedLook atThe description of the incidents, responses, and lessons learnedGoodDetailed reports showing swift incident management and preventive measures implemented afterward
Cross-framework mappings
How ISM-1269 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 8.22 | Annex A 8.22 requires segregating groups of information services and systems within networks to limit lateral movement and unauthorised a... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Database systems
See all Guidelines for database systems controls, or browse the full ASD ISM library.