Ensure Databases and Web Servers are Separated
Databases and web servers should be kept separate to enhance security.
Plain language
This control is about keeping your database servers (where you store all your important data) separate from your web servers (which manage your website). Keeping these servers separate is crucial because it reduces the chances of an attacker accessing sensitive information if your website is hacked.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Feb 2022
Control Stack last updated
19 Mar 2026
E8 maturity levels
N/A
Guideline
Guidelines for database systemsSection
Database serversOfficial control statement
Database servers and web servers are functionally separated.
Why it matters
Mixing databases and web servers invites attackers to access sensitive data via compromised web apps, risking data breaches.
Operational notes
Regularly audit server connections to ensure strict separation and configure firewalls to limit inter-server communication.
Implementation tips
- The IT team should create separate physical or virtual servers for databases and web services. They can achieve this by setting up different servers on different networks or using separate cloud instances to handle web traffic and data storage tasks.
- System administrators should use network segmentation to divide the network into smaller, isolated sections. They can do this by configuring firewalls to define clear boundaries and rules between the segments where the databases and web servers operate.
- Managers should ensure that there are different access control policies for database and web server administrators. This means providing them distinct user accounts and permissions so only authorised personnel can access each type of server.
- The IT security team should perform regular security testing on both types of servers. This involves using scanning tools to check for vulnerabilities in each server type and isolating any issues found without affecting the other server.
- Procurement officers should work with IT to invest in robust monitoring tools. These tools should be set up to alert staff about any suspicious activity indicating that one type of server is trying to access the other unauthorizedly.
Audit / evidence tips
- AskNetwork diagrams: Request a detailed network map showing the separation of databases and web servers GoodDiagrams showing distinct segments with clear labels and separation
- AskAccess control policies: Request the official documents outlining who has access to what servers GoodPolicies showing different access rights and roles for each server type
- AskSecurity testing reports: Request the latest vulnerability scan results for both server types GoodRegularly updated reports showing resolved issues and follow-up actions
- AskMonitoring logs: Request logs from monitoring tools that track access and traffic between servers GoodLogs showing no unauthorized access attempts with prompt responses to any unusual activity
- AskIncident response documentation: Request records of any incidents where server separation might have failed GoodDetailed reports showing swift incident management and preventive measures implemented afterward
Cross-framework mappings
How ISM-1269 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
| sync_alt Partially overlaps (1) expand_less | ||
| Annex A 8.22 | Annex A 8.22 requires segregating groups of information services and systems within networks to limit lateral movement and unauthorised a... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.