ASD ISM 2059 Restrict and scan file uploads for security
What it says
File uploads or input are restricted to specific file types, with malicious content scanning occurring prior to file access, file execution or file storage.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure only certain file types are accepted and scanned for viruses before being accessed, executed, or stored.
This control is about making sure that when files are uploaded to your system, only certain types are allowed, and they must be scanned to ensure they're safe. It's important because harmful files could infect your system, leading to data loss or a security breach which could damage your business and reputation.
Free. Save your status, tasks and notes.
Why it matters
Unrestricted file uploads can allow malicious files to be stored or executed, leading to malware infection, data loss, and service disruption.
How to implement
The IT team should create a list of acceptable file types for uploads.
They can do this by consulting with the business manager to identify which file types are necessary for day-to-day operations.
System owners need to implement a file scanning solution to check files for viruses before they're accessed.
This can be done by integrating antivirus software that automatically scans each uploaded file.
Business managers should establish a policy that educates employees on acceptable file types.
They can organise short training sessions or create a simple guide to outline this information.
The IT team should test the file upload process to ensure that only the specified file types are accepted.
They can simulate uploads of different file types and verify that the system rejects disallowed ones.
Security officers must ensure that scanned files are logged and monitored for any suspicious activity.
They can set up an alert system that notifies them of any unusual activities related to file uploads.
Keep it running
Maintain a strict allow-list of permitted upload types and ensure anti-malware scanning runs before any file is stored, accessed or executed.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The file type restriction policy: Request the document detailing which file types are allowed for upload.
Look at
The file types listed and check for approvals from system owners.
Good evidence
Will include a list approved by relevant authorities and dates of last updates.
- Check 2 of 5What an auditor asks for
Ask for
Antivirus scan logs: Request recent logs from the antivirus software showing files scanned over a specific period.
Look at
The types of files scanned and the results of these scans.
Good evidence
Logs showing that allowed file types are scanned and any detected issues are resolved immediately.
- Check 3 of 5What an auditor asks for
Ask for
Employee training records: Request records showing staff have been trained on file upload policies.
Look at
Details on training dates, content covered, and names of attendees.
Good evidence
Includes recent training sessions attended by all relevant staff.
- Check 4 of 5What an auditor asks for
Ask for
Test records of the file upload process: Request documentation or results of tests conducted to ensure only allowed file types are accepted.
Look at
How the tests were conducted and what results were achieved.
Good evidence
Records of successful tests that demonstrate only specified types are allowed.
- Check 5 of 5What an auditor asks for
Ask for
File monitoring reports: Request reports that show monitoring of file uploads and any associated alerts.
Look at
Alert instances and responses to them.
Good evidence
Includes instances of alerts and actions taken to address any issues.
Mappings
Closest match in ISO/IEC 27001: A.8.26, Defining security requirements for applications, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.26.
ISM-2059 requires organisations to restrict file types and conduct malware scanning. Annex A 8.26 supports this by necessitating the identification of security requirements, which include those related to file uploads. ISM-2059 is a concrete control, while Annex A 8.26 sets a foundation for these requirements.
This control partially meets A.8.28.
ISM-2059 mandates file type restriction and scanning for malicious content. Annex A 8.28 supports this through secure coding practices that include file type validation and malware scanning, ensuring uploads are securely handled across various application features.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.