ASD ISM 2066 Centralised management of web application sessions
What it says
Web application sessions are centrally managed server side.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWeb apps use a server to handle and secure user sessions instead of relying on the user's device.
This control means that when you use a web application-like online banking or a shopping site-your session is managed and secured on the company's server rather than relying on just your computer or phone to keep the connection safe. This is important because if the session was managed only on your device, it might be easier for hackers to hijack your session and pretend to be you, possibly leading to unauthorised access to your accounts and sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without centralised, server-side session management, attackers can more easily hijack sessions, gaining unauthorised access to web application data.
How to implement
The IT team should ensure that the web applications they develop or use are designed to handle user sessions centrally on the server.
This involves configuring the server to manage session authentication and timeout settings securely, minimising the risk of session hijacking.
The web application developer should implement server-side session management by using established frameworks or libraries that provide built-in session handling.
This helps manage user log-ins, log-outs, and session data in a secure and streamlined manner.
System administrators should monitor server logs for any unusual session activities, like repeated attempts to hijack active sessions.
Set up alerts for any anomaly, which allows timely intervention to protect user data.
Managers of web application projects should conduct regular training for staff on the importance of server-side session management.
This training could include real-world examples of session hijacking and how server-side management offers protection.
Procurement teams should evaluate web application options, ensuring they include centralised session management features.
They should prioritise solutions that have strong security credentials in place, verified by reputable security certifications.
Keep it running
Manage all web app sessions centrally on the server (avoid client-stored session state), rotate session IDs on login, and monitor for anomalous session reuse.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The web application's architecture diagram: Review where session management is highlighted and ensure it is designed to be server-side.
Look at
Specific annotations that show session handling and authentication processes occur on the server.
Good evidence
Shows clear indications of server-side logic with supporting documentation.
- Check 2 of 5What an auditor asks for
Look at
Timestamps and user ID caching that match server records.
Good evidence
Is logs showing seamless session tracking with zero irregular activities.
- Check 3 of 5What an auditor asks for
Ask for
Procedure documentation on how sessions are managed: Review instructions that guide developers on implementing server-side session handling.
Look at
Comprehensive guidelines on using secure coding practices and session timeouts.
Good evidence
Includes step-by-step procedures and examples of utilised frameworks or libraries.
- Check 4 of 5What an auditor asks for
Look at
Whether the content covers the importance and methods of server-side session management.
Good evidence
Is a report showing regular sessions, updated content, and attendance lists.
- Check 5 of 5What an auditor asks for
Ask for
Security assessment reports on web applications in use: Examine if the assessment covered session management vulnerabilities and made recommendations.
Look at
Identified issues and proof they have been resolved.
Good evidence
Shows reassessment results post-implementation of recommendations, confirming the server-side session management is robust.
Mappings
Closest match in ISO/IEC 27001: A.8.28, Secure coding practices in software development, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.28.
ISM-2066 requires web application sessions to be centrally managed server side to reduce risks such as session tampering and weak client-side session storage. Annex A 8.28 requires secure coding principles to be applied, which commonly includes secure session management design and implementation patterns. ISM-2066 is a concrete secure session management outcome, while Annex A 8.28 is broader and covers many other secure coding concerns beyond sessions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.