ASD ISM 1275 Ensure secure database queries in software
What it says
All queries to databases from software are filtered for legitimate content and correct syntax.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChecks ensure database queries from software are legitimate and correctly formatted.
This control means all software talking to databases needs to ensure data is safe and formatted correctly. This matters because if someone manages to send bad or tricky queries, it might mess with your data, make your systems crash, or even let outsiders see information they shouldn't.
Free. Save your status, tasks and notes.
Why it matters
If database queries aren't filtered and validated, SQL injection can allow unauthorised data access, alteration or deletion, causing data breaches and corruption.
How to implement
The software development team should create a checklist of safe database queries: Start by documenting the types of data interactions your software needs and the correct way these queries should be written to avoid mistakes or weaknesses.
Regularly update this checklist as new functionalities are added.
The IT security officer should review and approve query handling processes: Organise regular reviews to make sure that queries are only accepted if they meet specific, safe criteria.
This involves checking if security measures like parameterised queries are in place to prevent SQL injection attacks.
Software developers should implement training on secure coding practices: Conduct workshops or find online courses to educate team members on how to write queries securely.
This includes teaching developers about common vulnerabilities and defence tactics like input validation.
The system administrator should monitor database access logs: Regularly check the logs for any unusual query patterns that could suggest someone is trying to access the database incorrectly.
Implement alert systems to notify the team if suspicious activity is detected.
The procurement officer should ensure third-party software includes query security features: Whenever acquiring software that interacts with databases, verify with suppliers that their products include security features to check and manage database queries safely.
Keep it running
Enforce parameterised queries and server-side input validation; block unsafe SQL patterns and log rejected queries. Regularly review validation rules and test using SQL injection test cases.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Documented query handling procedures: Request a copy of the guidelines and checklists used by developers for creating and reviewing database queries.
Look at
Evidence of regular updates and sign-offs by the IT security officer.
Good evidence
Up-to-date records with clear steps and approval signatures.
- Check 2 of 5What an auditor asks for
Look at
System logs to see if there are records of query validation occurring. Look for signs that non-compliant queries were rejected and that alerts were triggered for anomalies.
Good evidence
Consistent monitoring entries and actions taken on flagged queries.
- Check 3 of 5What an auditor asks for
Ask for
Training records on secure database querying: Request documentation of past training sessions including dates, attendees, and topics covered.
Look at
Comprehensive coverage of secure coding practices.
Good evidence
Records showing ongoing education and participation by relevant staff.
- Check 4 of 5What an auditor asks for
Ask for
Evaluation reports or contracts that show database security requirements were considered in purchasing decisions.
Look at
Explicit mentions of query security features.
Good evidence
Contracts or purchase orders with security compliance clauses.
- Check 5 of 5What an auditor asks for
Ask for
To see logs that show who is accessing the database and when, focusing on the queries executed.
Look at
Unusual patterns or times of access which might indicate a problem.
Good evidence
Documented access attempts with details of successful and unsuccessful query executions.
Mappings
Closest match in ISO/IEC 27001: A.8.25, Secure development lifecycle, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.25.
ISM-1275 requires validation/filtering of database queries generated by software to ensure only legitimate, correctly formed queries are issued. Annex A 8.25 requires an organisation to establish and apply rules for a secure development lifecycle, within which secure database query handling would be defined and enforced. ISM-1275 represents one concrete SDL rule, while Annex A 8.25 covers governance and application of many secure development rules beyond database queries.
This control partially meets A.8.28.
ISM-1275 requires that all software-to-database queries are filtered/validated for legitimate content and correct syntax (i.e., query input validation to prevent malformed or malicious queries). Annex A 8.28 requires secure coding principles to be applied across software development, which includes practices such as input validation, parameterised queries, and defensive coding against injection. ISM-1275 is a specific secure coding requirement focused on database query construction and validation, whereas Annex A 8.28 is broader across all coding areas.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.