ASD ISM 1490 Implement application control on internet-facing servers
What it says
Application control is implemented on internet-facing servers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure application security by using controls on servers exposed to the internet.
This control is about making sure that only safe and approved applications can run on servers that can be accessed from the internet. It matters because if unsafe software gets onto these servers, hackers could exploit it to steal data, damage your systems, or disrupt your services.
Free. Save your status, tasks and notes.
Why it matters
Without application control on internet-facing servers, unauthorised binaries and scripts can execute, enabling compromise, data exfiltration, or service disruption.
How to implement
The IT team should create a list of approved applications that are allowed to run on servers facing the internet.
They can do this by evaluating the software currently used and determining which ones are essential and secure.
System owners need to work with the IT team to ensure these approved applications are installed on their internet-facing servers.
This means checking current installations and removing unauthorised ones.
The IT team should set up application control software that monitors and restricts what applications can run on the servers.
They can configure this software to automatically block unauthorised applications.
Managers should train staff on the importance of using only approved applications, explaining how unauthorised software could lead to security breaches or service interruptions.
The IT security officer should schedule regular reviews of the application control measures in place.
This involves checking logs to ensure only approved applications are running and adjusting the approved list as needed.
Keep it running
Maintain enforced allowlists on internet-facing servers; review and approve new binaries, test rules after patching, and monitor application-control logs for blocked or unexpected executions.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The list of approved applications for internet-facing servers.
Look at
The criteria used to select these applications.
Good evidence
List is detailed, up-to-date, and includes security assessments for each application.
- Check 2 of 4What an auditor asks for
Good evidence
Setup will show active monitoring and blocking capabilities.
- Check 3 of 4What an auditor asks for
Ask for
Training records for staff regarding application use.
Look at
What topics were covered and how often training occurs. Good evidence includes regular sessions with specific emphasis on application control policies.
Good evidence
Result is logs showing unauthorised applications being effectively blocked.
- Check 4 of 4What an auditor asks for
Ask for
Evidence of recent reviews of application controls.
Look at
Reports indicating who conducted the review and any changes made to the approved list.
Good evidence
Report includes detailed findings and identified improvements.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.1, Application control is implemented on internet-facing servers, which asks for the same thing.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-AC-ML2.1.
E8-AC-ML2.1 requires application control to be implemented on internet-facing servers so only approved applications can execute. ISM-1490 states the same requirement for internet-facing servers and is effectively a direct ISM expression of the Essential Eight control. Both focus on preventing unauthorised code execution on exposed servers through application control.
This control partially overlaps E8-AC-ML1.1.
ISM-1490 requires application control to be implemented on internet-facing servers to reduce the attack surface on externally exposed services. E8-AC-ML1.1 applies application control to workstations, which uses the same security technique but for a different asset class. The controls overlap on restricting application execution, but the primary is server-and-exposure focused whereas the candidate is endpoint focused.
This control partially overlaps E8-AC-ML3.1.
ISM-1490 requires application control to be implemented on internet-facing servers. E8-AC-ML3.1 requires application control on non-internet-facing servers, which is the same control mechanism but applied to a different server exposure category. They overlap on the use of application control for servers, but differ materially in scope because ISM-1490 is specifically about internet-facing servers while E8-AC-ML3.1 is explicitly not.
This control supports E8-AC-ML2.2.
ISM-1490 requires implementing application control on internet-facing servers. E8-AC-ML2.2 refines how application control is applied by excluding user profiles and temporary folders, which affects the effectiveness and operational design of application control rules. E8-AC-ML2.2 supports ISM-1490 by providing a specific scoping approach for rulesets, but ISM-1490 does not mandate this particular location-based treatment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.