ASD ISM 1486 Restrict Java processing in web browsers
What it says
Web browsers do not process Java from the internet.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure web browsers are set to block Java from running online.
This control means you need to set up your web browsers so that they don't run Java from websites. It's important because Java can be a way for hackers to sneak into your computer and steal information or cause damage. By stopping browsers from processing Java, you reduce the risk of getting a virus or being hacked while surfing the web.
Free. Save your status, tasks and notes.
Why it matters
Allowing Java in browsers exposes systems to drive-by download attacks, risking data breaches or malware infections.
How to implement
IT team should disable Java in web browsers: Go into the settings of each browser used in your organisation and turn off any options that allow Java to run.
This can usually be done under the security or plugin settings in the browser's options menu.
System administrators should ensure regular updates: Regularly check the settings to ensure Java remains disabled after browser updates, as sometimes updates can reset settings.
Keep a checklist of steps to follow after each update.
Train employees about Java risks: HR or IT should organise a short training session explaining why Java is blocked in browsers and the potential risks it poses.
Use examples of past security breaches that happened due to Java vulnerabilities to make it clear why this is necessary.
Managers should review IT policies: Make sure any policies about internet use and browser settings explicitly mention the ban on Java.
Update the policy documents and get them signed off by relevant authorities to ensure clarity and compliance.
Keep it running
Verify browser policy keeps Java disabled and remove/uninstall any Java browser plug-ins. Recheck after browser updates.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Browser configuration screenshots: Request screenshots of the security settings from different web browsers used in your organisation.
Look at
The sections under plugins or security where Java settings are visible.
Good evidence
Shows Java plugins disabled and blocked by default.
- Check 2 of 5What an auditor asks for
Ask for
System update logs: Request documentation showing that browser settings were checked post-updates.
Look at
The logs for entries detailing any reconfiguration actions if updates reset settings.
Good evidence
Includes a recent log with action details and timestamps.
- Check 3 of 5What an auditor asks for
Ask for
Training attendance records: Request evidence of training sessions held for employees about Java risks.
Look at
Sign-in sheets or digital records of attendance.
Good evidence
Includes records with dates, attendee lists, and training content outlines.
- Check 4 of 5What an auditor asks for
Ask for
Internet use policy documents: Request the latest version of internet use and security policy documents. Examine these documents for clear statements about the restriction of Java in browsers.
Good evidence
Shows specific clauses mentioning Java controls, signed by management.
- Check 5 of 5What an auditor asks for
Ask for
Software purchase records: Request recent procurement documents for new software purchases. Check these documents for vendor compliance with Java restrictions.
Good evidence
Includes vendor confirmations in writing that Java is not necessary for their products.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML1.2, Web browsers must not execute Java content from the internet, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-1486 requires that web browsers do not process Java from the internet as a measure to reduce web-borne code execution risk. ISO/IEC 27001:2022 Annex A 8.7 is broader, requiring organisations to implement protection against malware supported by awareness, which commonly includes hardening browsers and disabling risky active content such as Java. ISM-1486 is one specific technical control that can contribute to meeting the wider malware protection objective in Annex A 8.7.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-AH-ML1.2.
E8-AH-ML1.2 requires that web browsers do not process Java content sourced from the internet. ISM-1486 states the same requirement, explicitly mandating that web browsers do not process Java from the internet. The scope and intent align directly, so implementing ISM-1486 would largely satisfy E8-AH-ML1.2.
This control partially meets E8-AH-ML2.1.
ISM-1486 requires that web browsers do not process Java from the internet. E8-AH-ML2.1 is broader because it requires hardening web browsers using ASD and vendor guidance across many settings and features, which would typically include disabling/blocking Java where applicable. ISM-1486 is a single, specific hardening requirement within the wider browser-hardening baseline described by E8-AH-ML2.1.
This control depends on E8-AH-ML1.4.
ISM-1486 requires that web browsers do not process Java from the internet. E8-AH-ML1.4 supports this by ensuring web browser security settings cannot be changed by users, helping maintain the Java-blocking configuration once applied. E8-AH-ML1.4 does not itself mandate blocking Java; it focuses on preventing user-driven configuration drift.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.