ASD ISM 1479 Minimise server-to-server communication
What it says
Servers minimise communications with other servers at the network and file system level.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishServers should reduce interaction with each other to enhance security.
Servers should interact with each other as little as possible to keep your business safer. This is important because unnecessary communication between servers can be an entry point for cyber criminals to attack and spread malicious software, risking your data and operations.
Free. Save your status, tasks and notes.
Why it matters
Excessive server-to-server and file share communication can spread malware rapidly, risking data integrity and disrupting services.
How to implement
IT team should evaluate current server communications: To minimise these interactions, they should map out how often servers talk to each other and identify which communications are essential.
This can be done using network monitoring tools that show connections between servers.
System owners should authorise only necessary connections: They should work with the IT team to determine which server interactions are vital for business operations.
This involves reviewing each server's role and ensuring only required interactions are allowed.
IT team should configure firewall rules: To enforce limited communication, they should set up firewall rules to block all unnecessary traffic between servers.
This requires entering specific permissions that define which servers can talk to each other and on what terms.
Managers should set up regular reviews of server communication: A periodic check, perhaps monthly, should be conducted to ensure server interactions remain necessary and minimal.
This involves checking logs and making adjustments based on changes in the business or updates in threats.
IT team should document changes and reasons: Any change to server communications should be documented clearly, stating the necessity and security implications.
This ensures accountability and clarity for future reviews or audits.
Keep it running
Review and restrict server-to-server network and file share paths; enforce allow-lists in firewalls/ACLs and remove unused ports/shares.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network diagram highlighting server connections: Request a visual map that shows how servers are currently connected.
Look at
The paths and connections marked as necessary for operations.
Good evidence
Shows only essential paths highlighted and minimal connections between servers.
- Check 2 of 5What an auditor asks for
Ask for
Server communication logs: Request logs showing which servers have communicated with each other over the past month.
Look at
The frequency and the number of connections to see if communications are as minimal as stated.
Good evidence
Shows regular activity within known essential connections and fewer unexpected interactions.
- Check 3 of 5What an auditor asks for
Ask for
Change records of server interaction settings: Request documentation of any changes made to server communication rules.
Look at
Details explaining each change and the reason it was needed.
Good evidence
Is a log indicating thoughtful, reviewed changes with appropriate security justification.
- Check 4 of 5What an auditor asks for
Ask for
Firewall rule configuration: Request evidence of the current firewall settings that limit server-to-server interactions.
Look at
The specific rules allowing or denying communication between specific servers.
Good evidence
Shows strict, intentional rules matching business needs.
- Check 5 of 5What an auditor asks for
Ask for
The last review meeting notes on server communications: Request evidence of the most recent review of server interactions conducted by the IT team or management.
Look at
Notes on discussions and decisions made to adjust or maintain communication settings.
Good evidence
Will be a concise record of the discussion outlining any changes needed.
Mappings
Closest match in ISO/IEC 27001: A.8.21, Security of network services, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.21.
ISM-1479 requires servers to minimise communications with other servers at the network and file system level. Annex A 8.21 requires security mechanisms and requirements for network services to be identified, implemented and monitored, which can include restricting which server-to-server services (e.g. RPC, SMB, database ports) are permitted. Annex A 8.21 is broader because it addresses all network service security and service levels, whereas ISM-1479 is specifically about reducing the extent of inter-server communications rather than securing the services that remain.
This control partially overlaps A.8.22.
ISM-1479 requires servers to minimise communications with other servers at both the network layer and file system level to reduce lateral movement and unnecessary trust paths. Annex A 8.22 requires network segregation of services, users and systems, which is a common way to technically enforce reduced server-to-server reachability. Annex A 8.22 is broader (segregation across the whole organisation's network) and does not specifically address file system-level server-to-server interactions, while ISM-1479 focuses specifically on reducing inter-server communication paths.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.