ASD ISM 2066Centralised Management of Web Application Sessions
Official control statement
Web application sessions are centrally managed server side.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Web apps use a server to handle and secure user sessions instead of relying on the user's device.
What this means in practice
This control means that when you use a web application-like online banking or a shopping site-your session is managed and secured on the company's server rather than relying on just your computer or phone to keep the connection safe. This is important because if the session was managed only on your device, it might be easier for hackers to hijack your session and pretend to be you, possibly leading to unauthorised access to your accounts and sensitive information.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for software developmentSection
Web application developmentTopic
Secure web application design and development
Why it matters
Without centralised, server-side session management, attackers can more easily hijack sessions, gaining unauthorised access to web application data.
Operational notes
Manage all web app sessions centrally on the server (avoid client-stored session state), rotate session IDs on login, and monitor for anomalous session reuse.
Implementation tips
- The IT team should ensure that the web applications they develop or use are designed to handle user sessions centrally on the server. This involves configuring the server to manage session authentication and timeout settings securely, minimising the risk of session hijacking.
- The web application developer should implement server-side session management by using established frameworks or libraries that provide built-in session handling. This helps manage user log-ins, log-outs, and session data in a secure and streamlined manner.
- System administrators should monitor server logs for any unusual session activities, like repeated attempts to hijack active sessions. Set up alerts for any anomaly, which allows timely intervention to protect user data.
- Managers of web application projects should conduct regular training for staff on the importance of server-side session management. This training could include real-world examples of session hijacking and how server-side management offers protection.
- Procurement teams should evaluate web application options, ensuring they include centralised session management features. They should prioritise solutions that have strong security credentials in place, verified by reputable security certifications.
Audit / evidence tips
- AskThe web application's architecture diagram: Review where session management is highlighted and ensure it is designed to be server-sideLook atSpecific annotations that show session handling and authentication processes occur on the serverGoodShows clear indications of server-side logic with supporting documentation
- Look atTimestamps and user ID caching that match server recordsGoodIs logs showing seamless session tracking with zero irregular activities
- AskProcedure documentation on how sessions are managed: Review instructions that guide developers on implementing server-side session handlingLook atComprehensive guidelines on using secure coding practices and session timeoutsGoodIncludes step-by-step procedures and examples of utilised frameworks or libraries
- Look atWhether the content covers the importance and methods of server-side session managementGoodIs a report showing regular sessions, updated content, and attendance lists
- AskSecurity assessment reports on web applications in use: Examine if the assessment covered session management vulnerabilities and made recommendationsLook atIdentified issues and proof they have been resolvedGoodShows reassessment results post-implementation of recommendations, confirming the server-side session management is robust
Cross-framework mappings
How ISM-2066 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.28 | ISM-2066 requires web application sessions to be centrally managed server side to reduce risks such as session tampering and weak client-... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Software development
See all Guidelines for software development controls, or browse the full ASD ISM library.