ASD ISM 1862 Restrict access and conceal web server IP addresses
What it says
If using a WAF, disclosing the IP addresses of web servers under an organisation's control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAvoid revealing server IPs and limit access exclusively to WAFs and authorised networks.
This control is about keeping the actual location of your web servers a secret and making sure only the necessary security tools and trusted parties can access them. If you don't, malicious individuals could find and target your servers directly, leading to data breaches or downtime.
Free. Save your status, tasks and notes.
Why it matters
Exposed origin IPs let attackers bypass the WAF and hit web servers directly, increasing risk of compromise, data theft and outages.
How to implement
The IT team should ensure that the web servers are only accessible through a Web Application Firewall (WAF).
They can do this by configuring the firewall settings to allow traffic only from the WAF to the servers, blocking all other direct access.
System administrators should regularly update the access control list to include only authorised management networks.
This means reviewing who currently needs access to the web servers and making changes as people join or leave the organisation.
The IT security team should conduct routine tests to verify that the server IPs are not exposed.
This can involve using online tools to scan what information about your server is publicly accessible and ensuring nothing private is revealed.
Business managers should work with IT to ensure authorised networks are well-documented.
They should maintain a clear list of who has access and why, updating this documentation regularly to reflect any changes in staff or roles.
The IT manager should set up alerts on the firewall to notify them immediately of any unauthorised attempts to access the web servers.
This involves configuring the firewall to monitor all access attempts and sending alerts based on predefined rules.
Keep it running
Audit firewall/ACLs so only WAF egress IPs and authorised management networks can reach origin servers; block direct Internet access and remove leaked DNS records.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network configuration diagram: Request a diagram showing how the web servers are connected to the WAF and authorised networks.
Look at
Whether only the WAF and management networks are connected.
Good evidence
Includes only the authorised pathways without direct public access to the servers.
- Check 2 of 5What an auditor asks for
Ask for
A list of access rules on the firewall: Request a document listing all firewall rules that allow or deny traffic.
Look at
Specific rules that restrict access only to the WAF and management networks.
Good evidence
Is rules that explicitly block all other traffic sources.
- Check 3 of 5What an auditor asks for
Ask for
Records of access audits: Request the logs from recent audits monitoring who accessed the web servers.
Look at
How often these audits are conducted and any anomalies reported.
Good evidence
Includes regular, thorough audits with no unauthorised access detected.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of server IP address scans: Request reports from scans conducted to check if server IP addresses are exposed.
Look at
Scan frequency and results showing no exposure.
Good evidence
Shows regular scanning activity with no findings of exposed IPs.
- Check 5 of 5What an auditor asks for
Ask for
A list of authorised management networks: Request an updated and complete list of networks authorised to access the web servers.
Look at
The documentation for being up-to-date and accurate.
Good evidence
Has a recent date and correlates with access rules on the firewall.
Mappings
Closest match in ISO/IEC 27001: A.8.3, Restrict access to information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.3.
Annex A 8.3 requires restricting access to information and associated assets in line with an access control policy. ISM-1862 maps as a specific network access restriction: it requires origin web servers to be accessible only from the WAF and authorised management networks, reducing unauthorised access paths. Annex A 8.3 is broader because it covers access restrictions across all assets and contexts, not just WAF/origin server exposure.
This control partially meets A.8.20.
ISM-1862 requires securing web hosting behind a WAF by avoiding disclosure of origin server IP addresses and restricting inbound connectivity to the origin to only the WAF and authorised management networks. ISO/IEC 27001:2022 Annex A 8.20 relates by requiring networks and network devices to be secured, managed and controlled, which includes implementing firewalling/routing controls, filtering, and management-plane restrictions that enforce the WAF-only path to the origin. Annex A 8.20 is broader and does not explicitly call out origin concealment or the specific WAF-fronted architecture required by ISM-1862.
This control partially overlaps A.8.22.
Annex A 8.22 requires segregating network groups to control access between services and systems. ISM-1862 relates by implementing a boundary around web servers through the WAF, creating a segmentation instance specific to web application architecture.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.