ASD ISM 1485 Prevent web browsers from processing ads
What it says
Web browsers do not process web advertisements from the internet.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBlock web browsers from displaying online ads to enhance security.
This control is about stopping your web browser from showing online advertisements, which can sometimes carry harmful software or trick you into trusting malicious sites. If ads are not blocked, you might accidentally click on one that installs malware on your computer, risking your sensitive information and security.
Free. Save your status, tasks and notes.
Why it matters
Without blocking ads, users risk exposure to malicious software through deceptive adverts, increasing the likelihood of data breaches.
How to implement
IT team should install ad-blocking software on all company browsers.
They can do this by choosing a reliable ad blocker extension like uBlock Origin and deploying it across all browsers through central management systems.
System administrators should configure network settings to block ad-serving domains.
This can be done by updating the organisation's firewall or DNS settings to prevent connections to known ad servers.
Office managers should provide regular training sessions for staff on recognising malicious ads and the importance of not interacting with them.
They can organise monthly workshops or provide digital learning resources.
Procurement should ensure that any new software or browser updates support ad-blocking features.
This involves checking with software vendors for compatibility with ad-blocking tools before purchase.
Information security officers should regularly review ad-blocking effectiveness by conducting quarterly audits.
They can assess IT reports to ensure that additional or updated ad scripts are consistently blocked by the system.
Keep it running
Deploy and regularly update browser ad-blocking or filtering so adverts from the internet are not processed; verify effectiveness after browser updates.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of installed browser extensions: Request the inventory showing ad-blocking extensions installed across organisational devices.
Look at
Consistency in the deployment of the chosen ad-blocker.
Good evidence
A current inventory listing the extension installed on all relevant systems with verification dates.
- Check 2 of 5What an auditor asks for
Ask for
Network policy documentation: Request evidence of network settings configured to block ad-serving domains.
Look at
Firewall or DNS configurations to ensure ad domains are listed.
Good evidence
Documentation that outlines configured settings with up-to-date ad server lists.
- Check 3 of 5What an auditor asks for
Ask for
Training materials and attendance records: Request documentation on staff training about ad risks and reporting.
Look at
Dates, topics covered, and participant lists.
Good evidence
Records showing regular training sessions with attendance logs and feedback forms.
- Check 4 of 5What an auditor asks for
Ask for
Vendor compatibility reports: Request documents from procurement regarding ad-blocking capabilities of new software.
Look at
Assessments or confirmations from vendors.
Good evidence
Reports showing all software purchases support ad-blocking, with vendor confirmations.
- Check 5 of 5What an auditor asks for
Ask for
Quarterly audit reports on ad-blocking effectiveness: Request recent audits or assessments conducted by information security officers.
Look at
Findings or changes made based on these reports.
Good evidence
A well-documented audit trail showing adjustments and problem resolution.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML1.3, Web browsers block web ads from the internet, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.23.
ISM-1485 requires blocking browsers from processing web advertisements from the internet to reduce exposure to malicious content delivered via advertising networks. Annex A 8.23 requires managing access to external websites (web filtering) to reduce exposure to malicious content more generally across web destinations and content types. ISM-1485 is a specific technique that can be implemented via browser policy or filtering mechanisms and therefore represents a subset of the broader web access management objective in Annex A 8.23.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-AH-ML1.3.
E8-AH-ML1.3 requires that web browsers do not process web advertisements from the internet to reduce exposure to malvertising and ad-delivered exploitation. ISM-1485 states the same requirement that web browsers do not process web advertisements from the internet. Both controls have the same technical intent and endpoint/browser enforcement scope, with no material difference in depth or coverage.
This control partially meets E8-AH-ML2.1.
ISM-1485 requires one specific hardening setting: preventing browsers from processing web advertisements from the internet. E8-AH-ML2.1 requires broader browser hardening using ASD and vendor guidance, covering multiple configuration restrictions and security features beyond ad handling. Implementing ISM-1485 would typically contribute to meeting E8-AH-ML2.1, but it would not be sufficient on its own because E8-AH-ML2.1 has wider scope.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.