Skip to content
Software development
ASD ISMISM-1424

ASD ISM 1424 Ensure web security through response headers

What it says

Content-Security-Policy, Hypertext Transfer Protocol Strict Transport Security and X-Frame-Options are specified by web server software via security policy in response headers.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Web servers use security headers to protect web applications from attacks.

Web security response headers are like safety instructions your web server gives out to help protect your website from attacks. If these instructions aren't given, your website might be more vulnerable to hackers who could steal data or damage your online presence.

Why it matters

If CSP, HSTS and X-Frame-Options headers are missing, users are more exposed to XSS, clickjacking and HTTPS downgrade/MITM attacks.

How to implement

  1. IT team should configure the web server to add essential security headers.

    Use security policy settings to include Content-Security-Policy, which limits which resources a site can load, ensuring they're safe.

  2. Web developers should collaborate with IT to set up Hypertext Transfer Protocol Strict Transport Security (HSTS) headers.

    This ensures that all communication with your site happens using a secure connection.

  3. System administrators need to implement X-Frame-Options headers on the web server.

    This stops your website from being displayed in a frame on other sites, which can prevent clickjacking attacks.

  4. IT security personnel should regularly review and update security policies.

    Conduct tests on the server's response headers to verify they are active and correctly configured.

  5. Management should support regular training for the IT team on the latest web security best practices.

    Encourage participation in relevant Australian Cyber Security Centre (ACSC) webinars and workshops.

Keep it running

Audit response headers (CSP, HSTS, X-Frame-Options) in CI/CD and via scanning; alert on header absence or unexpected changes after deployments.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The server configuration files: Request access to the files that define the web server's settings.

    Look at

    The settings for security headers like Content-Security-Policy and HSTS.

    Good evidence

    Configuration should list these headers clearly and accurately.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Security audit reports: Request recent reports covering web server security checks.

    Look at

    Sections that discuss response headers.

    Good evidence

    Will show findings that the headers are properly configured and include notes on any improvements made.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Copies of the organisation's web security policies.

    Look at

    Sections on response headers. A thorough policy will specify which headers are needed and why.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Records of web server testing: Request logs from recent testing of web server security measures.

    Look at

    Entries validating the correct functioning of security headers.

    Good evidence

    Will note successful tests of all header configurations.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Evidence of IT staff training: Request documentation of recent training sessions on web security.

    Look at

    Attendance records and training topics.

    Good evidence

    Session should include up-to-date practices on implementing and managing response headers.

Mappings

Closest match in ISO/IEC 27001: A.8.26, Defining security requirements for applications, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.26Defining security requirements for applicationsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.