ASD ISM 1670 Prevent PDF applications from creating child processes
What it says
PDF applications are blocked from creating child processes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPDF software can't start other programs, stopping potential security threats.
This control makes sure that PDF applications on your computer can't start other programs, which is important because hackers often try to trick these applications into doing dangerous things. Without this control, malicious PDFs could open up viruses that might damage your business or steal private information.
Free. Save your status, tasks and notes.
Why it matters
If PDF apps create child processes, malware can exploit this to install malicious software, leading to data theft or operational disruptions.
How to implement
IT team should configure PDF applications to prevent them from launching other processes: They can do this by adjusting the settings within the PDF software to block any external process execution.
This usually involves changing a setting in the application's preferences or settings panel.
Managers should ensure all staff know why PDF security settings are important: Hold a brief meeting to explain that the settings help protect against malicious attacks that can occur through PDFs.
Use examples of how these attacks can impact the business to make it relatable.
Procurement should verify that any new PDF software complies with this control: When purchasing new software, ensure it supports preventing child processes.
Check the software's documentation or contact the vendor for verification.
System owners should schedule regular audits of PDF application settings: Set up a routine check, perhaps quarterly, where the IT team reviews the settings to ensure the control remains in place and is effective.
HR should include PDF security settings in onboarding training: Incorporate information on safe PDF use and the importance of settings that restrict child processes into the training for new employees.
Keep it running
Confirm application control rules block PDF apps spawning child processes; test with a sample PDF and review exceptions after PDF reader updates.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The configuration settings documentation of PDF applications: Request a report or screenshot showing these settings.
Look at
Options related to preventing child processes.
Good evidence
Shows settings that explicitly disable the launch of other processes.
- Check 2 of 5What an auditor asks for
Ask for
Staff training records related to PDF security: Request to see any records or materials used in staff training sessions.
Look at
Content that explains the risk of malicious PDFs and how settings prevent security breaches.
Good evidence
Is a dated training record mentioning PDF controls.
- Check 3 of 5What an auditor asks for
Ask for
To see procurement criteria for PDF software: Request the checklist or document used during procurement of PDF applications.
Look at
Specific points about security capabilities such as preventing child processes.
Good evidence
Is a document showing these criteria were considered.
- Check 4 of 5What an auditor asks for
Ask for
Audit reports of PDF application settings: Request past reports on the security audits for PDF software settings.
Look at
Evidence that the control settings have been checked and verified.
Good evidence
Includes a report showing regular reviews with confirmations.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of communication with software vendors: Request any emails or support tickets where vendors were asked about child process prevention features.
Look at
Responses confirming the capability.
Good evidence
Includes vendor confirmations on compatibility with the control.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.8, Block PDF software from creating child processes, which asks for the same thing.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-AH-ML2.8.
E8-AH-ML2.8 requires that PDF software is blocked from creating child processes to prevent PDFs launching other executables. ISM-1670 states the same requirement: PDF applications are blocked from creating child processes. The scope and intent align directly, so implementing one would largely satisfy the other.
This control partially meets E8-AH-ML2.9.
E8-AH-ML2.9 mandates hardening of PDF software using ASD and vendor guidance to reduce exploitation risk. ISM-1670 supports this mandate by requiring a specific mitigation (blocking PDF applications from creating child processes) that is commonly recommended to reduce attack vectors from malicious PDFs. E8-AH-ML2.9 is broader, encompassing general hardening based on guidance, while ISM-1670 provides a specific procedural control enhancing that security posture.
This control partially overlaps E8-AH-ML2.2.
E8-AH-ML2.2 requires blocking Microsoft Office from creating child processes to prevent Office-originated process spawning. ISM-1670 requires blocking PDF applications from creating child processes, applying the same preventative technique to a different high-risk application class often abused for initial execution. They overlap in the defensive approach (blocking child process creation) but differ in scope because one targets Office while the other targets PDF readers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.