ASD ISM 1269 Ensure databases and web servers are separated
What it says
Database servers and web servers are functionally separated.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDatabases and web servers should be kept separate to enhance security.
This control is about keeping your database servers (where you store all your important data) separate from your web servers (which manage your website). Keeping these servers separate is crucial because it reduces the chances of an attacker accessing sensitive information if your website is hacked.
Free. Save your status, tasks and notes.
Why it matters
Mixing databases and web servers invites attackers to access sensitive data via compromised web apps, risking data breaches.
How to implement
The IT team should create separate physical or virtual servers for databases and web services.
They can achieve this by setting up different servers on different networks or using separate cloud instances to handle web traffic and data storage tasks.
System administrators should use network segmentation to divide the network into smaller, isolated sections.
They can do this by configuring firewalls to define clear boundaries and rules between the segments where the databases and web servers operate.
Managers should ensure that there are different access control policies for database and web server administrators.
This means providing them distinct user accounts and permissions so only authorised personnel can access each type of server.
The IT security team should perform regular security testing on both types of servers.
This involves using scanning tools to check for vulnerabilities in each server type and isolating any issues found without affecting the other server.
Procurement officers should work with IT to invest in robust monitoring tools.
These tools should be set up to alert staff about any suspicious activity indicating that one type of server is trying to access the other unauthorizedly.
Keep it running
Regularly audit server connections to ensure strict separation and configure firewalls to limit inter-server communication.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Network diagrams: Request a detailed network map showing the separation of databases and web servers.
Look at
Clear indications of different segments or zones for the servers.
Good evidence
Diagrams showing distinct segments with clear labels and separation.
- Check 2 of 5What an auditor asks for
Ask for
Access control policies: Request the official documents outlining who has access to what servers.
Look at
The role descriptions and permissions associated with database and web server access.
Good evidence
Policies showing different access rights and roles for each server type.
- Check 3 of 5What an auditor asks for
Ask for
Security testing reports: Request the latest vulnerability scan results for both server types.
Look at
The scan dates and action plans for any identified issues.
Good evidence
Regularly updated reports showing resolved issues and follow-up actions.
- Check 4 of 5What an auditor asks for
Ask for
Monitoring logs: Request logs from monitoring tools that track access and traffic between servers.
Look at
The timestamps, flagged activities, and response records.
Good evidence
Logs showing no unauthorised access attempts with prompt responses to any unusual activity.
- Check 5 of 5What an auditor asks for
Ask for
Incident response documentation: Request records of any incidents where server separation might have failed.
Look at
The description of the incidents, responses, and lessons learned.
Good evidence
Detailed reports showing swift incident management and preventive measures implemented afterward.
Mappings
Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.22.
Annex A 8.22 requires segregating groups of information services and systems within networks to limit lateral movement and unauthorised access between them. ISM-1269 relates by requiring functional separation between database servers and web servers, which is a common tier-segmentation objective that is typically enforced via network zoning/segmentation. ISM-1269 is more application-architecture specific, whereas Annex A 8.22 covers segregation for any service/user/system grouping, not only web/database tiers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.