Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

Microsoft Internet Explorer 11 Security Technical Implementation Guide

  • Version/Release: V2R5
  • Published: 2023-12-01
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
b
The Internet Explorer warning about certificate address mismatch must be enforced.
CM-6 - Medium - CCI-000366 - V-223015 - SV-223015r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI015-IE11
Vuln IDs
  • V-223015
  • V-46475
Rule IDs
  • SV-223015r879887_rule
  • SV-59339
This parameter warns users if the certificate being presented by the website is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presented by the web server. This setting aids to prevent spoofing attacks.
Checks: C-24688r428595_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page 'Turn on certificate address mismatch warning' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "WarnOnBadCertRecving" is REG_DWORD = 1, this is not a finding.

Fix: F-24676r428596_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page 'Turn on certificate address mismatch warning' to 'Enabled'.

a
Check for publishers certificate revocation must be enforced.
IA-5 - Low - CCI-000185 - V-223016 - SV-223016r879612_rule
RMF Control
IA-5
Severity
Low
CCI
CCI-000185
Version
DTBI018-IE11
Vuln IDs
  • V-223016
  • V-46477
Rule IDs
  • SV-223016r879612_rule
  • SV-59341
Check for publisher's certificate revocation options should be enforced to ensure all PKI signed objects are validated. Satisfies: SRG-APP-000605
Checks: C-24689r428598_chk

If the system is on the SIPRNet, this requirement is NA. Open Internet Explorer. From the menu bar, select "Tools". From the "Tools" drop-down menu, select "Internet Options". From the "Internet Options" window, select the "Advanced" tab, from the "Advanced" tab window, scroll down to the "Security" category, and verify the "Check for publisher's certificate revocation" box is selected. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Criteria If the value "State" is "REG_DWORD = 23C00", this is not a finding.

Fix: F-24677r428599_fix

If the system is on the SIPRNet, this requirement is NA. Open Internet Explorer. From the menu bar, select "Tools". From the "Tools" drop-down menu, select "Internet Options". From the "Internet Options" window, select the "Advanced" tab from the "Advanced" tab window, scroll down to the "Security" category, and select the "Check for publisher's certificate revocation" box. Note: Manual entry in the registry key: HKCU\Software\Microsoft\Windows\Current Version\WinTrust\Trust Providers\Software Publishing for the value "State", set to "REG_DWORD = 23C00", may first be required.

b
The Download signed ActiveX controls property must be disallowed (Internet zone).
SC-18 - Medium - CCI-001169 - V-223017 - SV-223017r879629_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001169
Version
DTBI022-IE11
Vuln IDs
  • V-223017
  • V-46481
Rule IDs
  • SV-223017r879629_rule
  • SV-59345
Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by untrusted publishers. Code signed by trusted publishers is silently downloaded. If you disable the policy setting, signed controls cannot be downloaded.
Checks: C-24690r428601_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download signed ActiveX controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1001" is REG_DWORD = 3, this is not a finding.

Fix: F-24678r428602_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download signed ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.

b
The Download unsigned ActiveX controls property must be disallowed (Internet zone).
SC-18 - Medium - CCI-001169 - V-223018 - SV-223018r879629_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001169
Version
DTBI023-IE11
Vuln IDs
  • V-223018
  • V-46483
Rule IDs
  • SV-223018r879629_rule
  • SV-59347
Unsigned code is potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. If you enable this policy setting, users can run unsigned controls without user intervention. If you select "Prompt" in the drop-down box, users are queried to choose whether to allow the unsigned control to run. If you disable this policy setting, users cannot run unsigned controls. If you do not configure this policy setting, users cannot run unsigned controls.
Checks: C-24691r428604_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download unsigned ActiveX controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1004" is REG_DWORD = 3, this is not a finding.

Fix: F-24679r428605_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download unsigned ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.

b
The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone).
SC-18 - Medium - CCI-001170 - V-223019 - SV-223019r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI024-IE11
Vuln IDs
  • V-223019
  • V-46501
Rule IDs
  • SV-223019r879630_rule
  • SV-59365
ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.
Checks: C-24692r428607_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Initialize and script ActiveX controls not marked as safe' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1201" is REG_DWORD = 3, this is not a finding.

Fix: F-24680r428608_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Initialize and script ActiveX controls not marked as safe' to 'Enabled', and select 'Disable' from the drop-down box.

b
The Java permissions must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223020 - SV-223020r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI031-IE11
Vuln IDs
  • V-223020
  • V-46507
Rule IDs
  • SV-223020r879587_rule
  • SV-59371
Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Checks: C-24693r428610_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.

Fix: F-24681r428611_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

b
Accessing data sources across domains must be disallowed (Internet zone).
AC-4 - Medium - CCI-001414 - V-223021 - SV-223021r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI032-IE11
Vuln IDs
  • V-223021
  • V-46509
Rule IDs
  • SV-223021r879534_rule
  • SV-59373
The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be controlled based upon the site being browsed. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
Checks: C-24694r428613_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Access data sources across domains' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1406" is REG_DWORD = 3, this is not a finding.

Fix: F-24682r428614_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Access data sources across domains' to 'Enabled', and select 'Disable' from the drop-down box.

b
Functionality to drag and drop or copy and paste files must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223022 - SV-223022r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI036-IE11
Vuln IDs
  • V-223022
  • V-46511
Rule IDs
  • SV-223022r879587_rule
  • SV-59375
Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed.
Checks: C-24695r428616_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow drag and drop or copy and paste files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value for "1802" is REG_DWORD = 3, this is not a finding.

Fix: F-24683r428617_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow drag and drop or copy and paste files' to 'Enabled', and select 'Disable' from the drop-down box.

b
Launching programs and files in IFRAME must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223023 - SV-223023r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI038-IE11
Vuln IDs
  • V-223023
  • V-46513
Rule IDs
  • SV-223023r879587_rule
  • SV-59377
This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.
Checks: C-24696r428619_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Launching applications and files in an IFRAME' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1804" is REG_DWORD = 3, this is not a finding.

Fix: F-24684r428620_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Launching applications and files in an IFRAME' to 'Enabled', and select 'Disable' from the drop-down box.

b
Navigating windows and frames across different domains must be disallowed (Internet zone).
AC-4 - Medium - CCI-001414 - V-223024 - SV-223024r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI039-IE11
Vuln IDs
  • V-223024
  • V-46515
Rule IDs
  • SV-223024r879534_rule
  • SV-59379
Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use this feature in a manner similar to cross-site scripting (XSS). This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.
Checks: C-24697r428622_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Navigate windows and frames across different domains' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3 Criteria: If the value "1607" is REG_DWORD = 3, this is not a finding.

Fix: F-24685r428623_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Navigate windows and frames across different domains' to 'Enabled', and select 'Disable' from the drop-down box.

b
Userdata persistence must be disallowed (Internet zone).
SC-28 - Medium - CCI-001199 - V-223025 - SV-223025r879642_rule
RMF Control
SC-28
Severity
Medium
CCI
CCI-001199
Version
DTBI042-IE11
Vuln IDs
  • V-223025
  • V-46517
Rule IDs
  • SV-223025r879642_rule
  • SV-59381
Userdata persistence must have a level of protection based upon the site being accessed. It is possible for sites hosting malicious content to exploit this feature as part of an attack against visitors browsing the site. This policy setting allows you to manage the preservation of information in the browser's history, in Favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured.
Checks: C-24698r428625_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Userdata persistence' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1606" is REG_DWORD = 3, this is not a finding.

Fix: F-24686r428626_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Userdata persistence' to 'Enabled', and select 'Disable' from the drop-down box.

b
Clipboard operations via script must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223026 - SV-223026r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI044-IE11
Vuln IDs
  • V-223026
  • V-46521
Rule IDs
  • SV-223026r879587_rule
  • SV-59385
A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have a level of protection based upon the site being accessed.
Checks: C-24699r428628_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow cut, copy or paste operations from the clipboard via script' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1407" is REG_DWORD = 3, this is not a finding.

Fix: F-24687r428629_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow cut, copy or paste operations from the clipboard via script' to 'Enabled', and select 'Disable' from the drop-down box.

b
Logon options must be configured to prompt (Internet zone).
SC-23 - Medium - CCI-001184 - V-223027 - SV-223027r879636_rule
RMF Control
SC-23
Severity
Medium
CCI
CCI-001184
Version
DTBI046-IE11
Vuln IDs
  • V-223027
  • V-46523
Rule IDs
  • SV-223027r879636_rule
  • SV-59387
Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to the websites. This policy setting allows management of settings for logon options. If you enable this policy setting, you can choose from varying logon options. “Anonymous logon” disables HTTP authentication and uses the guest account only for the Common Internet File System (CIFS) protocol. “Prompt for user name and password” queries users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon only in Intranet zone” queries users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon with current user name and password” attempts logon using Windows NT Challenge Response. If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for login. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. If you disable this policy setting, logon is set to “Automatic logon only in Intranet zone”. If you do not configure this policy setting, logon is set to “Automatic logon only in Intranet zone”. The most secure option is to configure this setting to “Enabled”; “Anonymous logon”, but configuring this setting to “Enabled”; “Prompt for user name and password”, provides a reasonable balance between security and usability.
Checks: C-24700r428631_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Logon options' must be 'Enabled', and 'Prompt for user name and password' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1A00" is REG_DWORD = 65536 (decimal), this is not a finding.

Fix: F-24688r428632_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Logon options' to 'Enabled', and select 'Prompt for user name and password' from the drop-down box.

b
Java permissions must be configured with High Safety (Intranet zone).
CM-7 - Medium - CCI-000381 - V-223028 - SV-223028r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI061-IE11
Vuln IDs
  • V-223028
  • V-46525
Rule IDs
  • SV-223028r879587_rule
  • SV-59389
Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Checks: C-24701r428634_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> 'Java permissions' must be 'Enabled', and 'High Safety' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Criteria: If the value "1C00" is REG_DWORD = 65536, (Decimal), this is not a finding.

Fix: F-24689r428635_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> 'Java permissions' to 'Enabled', and select 'High Safety' from the drop-down box.

b
Anti-Malware programs against ActiveX controls must be run for the Intranet zone.
SC-18 - Medium - CCI-001662 - V-223029 - SV-223029r879628_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001662
Version
DTBI062-IE11
Vuln IDs
  • V-223029
  • V-46999
Rule IDs
  • SV-223029r879628_rule
  • SV-59865
This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Checks: C-24702r428637_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Intranet Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.

Fix: F-24690r428638_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Intranet Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

b
Java permissions must be configured with High Safety (Trusted Sites zone).
CM-7 - Medium - CCI-000381 - V-223030 - SV-223030r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI091-IE11
Vuln IDs
  • V-223030
  • V-46543
Rule IDs
  • SV-223030r879587_rule
  • SV-59407
Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety
Checks: C-24703r428640_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> 'Java permissions' must be 'Enabled', and 'High Safety' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Criteria: If the value "1C00" is REG_DWORD = 65536, (Decimal), this is not a finding.

Fix: F-24691r428641_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> 'Java permissions' to 'Enabled', and select 'High Safety' from the drop-down box.

b
Anti-Malware programs against ActiveX controls must be run for the Trusted Sites zone.
SC-18 - Medium - CCI-001662 - V-223031 - SV-223031r879628_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001662
Version
DTBI092-IE11
Vuln IDs
  • V-223031
  • V-47009
Rule IDs
  • SV-223031r879628_rule
  • SV-59875
This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Checks: C-24704r428643_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Trusted Sites Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.

Fix: F-24692r428644_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Trusted Sites Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

b
Dragging of content from different domains within a window must be disallowed (Internet zone).
AC-4 - Medium - CCI-001414 - V-223032 - SV-223032r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI1000-IE11
Vuln IDs
  • V-223032
  • V-46545
Rule IDs
  • SV-223032r879534_rule
  • SV-59409
This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog box. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog box.
Checks: C-24705r428646_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains within a window' must be 'Enabled', and 'Disabled' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2708" is REG_DWORD = 3, this is not a finding.

Fix: F-24693r428647_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains within a window' to 'Enabled', and select 'Disabled' from the drop-down box.

b
Dragging of content from different domains across windows must be disallowed (Restricted Sites zone).
AC-4 - Medium - CCI-001414 - V-223033 - SV-223033r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI1005-IE11
Vuln IDs
  • V-223033
  • V-46547
Rule IDs
  • SV-223033r879534_rule
  • SV-59411
This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you enable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog box.
Checks: C-24706r428649_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains across windows' must be 'Enabled', and 'Disabled' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2709" is REG_DWORD = 3, this is not a finding.

Fix: F-24694r428650_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains across windows' to 'Enabled', and select 'Disabled' from the drop-down box.

b
Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer).
SC-18 - Medium - CCI-001695 - V-223034 - SV-223034r879573_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001695
Version
DTBI1010-IE11
Vuln IDs
  • V-223034
  • V-46549
Rule IDs
  • SV-223034r879573_rule
  • SV-59413
Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.
Checks: C-24707r428652_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24695r428653_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes Restrict ActiveX Install must be enforced (iexplore).
SC-18 - Medium - CCI-001695 - V-223035 - SV-223035r879573_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001695
Version
DTBI1020-IE11
Vuln IDs
  • V-223035
  • V-46553
Rule IDs
  • SV-223035r879573_rule
  • SV-59417
Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.
Checks: C-24708r428655_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24696r428656_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.

b
Dragging of content from different domains within a window must be disallowed (Restricted Sites zone).
AC-4 - Medium - CCI-001414 - V-223036 - SV-223036r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI1025-IE11
Vuln IDs
  • V-223036
  • V-46555
Rule IDs
  • SV-223036r879534_rule
  • SV-59419
This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog box. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog box.
Checks: C-24709r428658_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains within a window' must be 'Enabled', and 'Disabled' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2708" is REG_DWORD = 3, this is not a finding.

Fix: F-24697r428659_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains within a window' to 'Enabled', and select 'Disabled' from the drop-down box.

b
Anti-Malware programs against ActiveX controls must be run for the Internet zone.
SC-18 - Medium - CCI-001662 - V-223037 - SV-223037r879628_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001662
Version
DTBI1046-IE11
Vuln IDs
  • V-223037
  • V-46997
Rule IDs
  • SV-223037r879628_rule
  • SV-59863
This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Checks: C-24710r428661_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Internet Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.

Fix: F-24698r428662_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Internet Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

b
Anti-Malware programs against ActiveX controls must be run for the Restricted Sites zone.
SC-18 - Medium - CCI-001662 - V-223038 - SV-223038r879628_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001662
Version
DTBI1051-IE11
Vuln IDs
  • V-223038
  • V-47005
Rule IDs
  • SV-223038r879628_rule
  • SV-59871
This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Checks: C-24711r428664_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.

Fix: F-24699r428665_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

b
Prevent bypassing SmartScreen Filter warnings must be enabled.
SI-3 - Medium - CCI-001242 - V-223039 - SV-223039r879664_rule
RMF Control
SI-3
Severity
Medium
CCI
CCI-001242
Version
DTBI1060-IE11
Vuln IDs
  • V-223039
  • V-64711
Rule IDs
  • SV-223039r879664_rule
  • SV-79201
This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious. If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.
Checks: C-24712r428667_chk

If the system is on the SIPRNet, this requirement is NA. The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings” must be ”Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter. Criteria: If the value "PreventOverride" is REG_DWORD = 1, this is not a finding.

Fix: F-24700r428668_fix

If the system is on the SIPRNet, this requirement is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings” to ”Enabled”.

b
Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet must be enabled.
SC-18 - Medium - CCI-001169 - V-223040 - SV-223040r879629_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001169
Version
DTBI1065-IE11
Vuln IDs
  • V-223040
  • V-64713
Rule IDs
  • SV-223040r879629_rule
  • SV-79203
This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the internet. If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.
Checks: C-24713r428670_chk

If the system is on the SIPRNet, this requirement is NA. The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet” must be ”Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter. Criteria: If the value "PreventOverrideAppRepUnknown" is REG_DWORD = 1, this is not a finding.

Fix: F-24701r428671_fix

If the system is on the SIPRNet, this requirement is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet” to ”Enabled”.

b
Prevent per-user installation of ActiveX controls must be enabled.
SC-18 - Medium - CCI-001170 - V-223041 - SV-223041r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI1070-IE11
Vuln IDs
  • V-223041
  • V-64715
Rule IDs
  • SV-223041r879630_rule
  • SV-79205
This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis. If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. If you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis.
Checks: C-24714r428673_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent per-user installation of ActiveX controls” must be ”Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX. Criteria: If the value "BlockNonAdminActiveXInstall" is REG_DWORD = 1, this is not a finding.

Fix: F-24702r428674_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent per-user installation of ActiveX controls” to ”Enabled”.

b
Prevent ignoring certificate errors option must be enabled.
IA-2 - Medium - CCI-001954 - V-223042 - SV-223042r942482_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-001954
Version
DTBI1075-IE11
Vuln IDs
  • V-223042
  • V-64717
Rule IDs
  • SV-223042r942482_rule
  • SV-79207
This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as “expired”, “revoked”, or “name mismatch” errors) in Internet Explorer. If you enable this policy setting, the user cannot continue browsing. If you disable or do not configure this policy setting, the user can choose to ignore certificate errors and continue browsing.
Checks: C-24715r428676_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> ”Prevent ignoring certificate errors” must be ”Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings. Criteria: If the value "PreventIgnoreCertErrors" is REG_DWORD = 1, this is not a finding.

Fix: F-24703r428677_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> ”Prevent ignoring certificate errors” to ”Enabled”.

b
Turn on SmartScreen Filter scan option for the Internet Zone must be enabled.
SI-3 - Medium - CCI-001242 - V-223043 - SV-223043r879664_rule
RMF Control
SI-3
Severity
Medium
CCI
CCI-001242
Version
DTBI1080-IE11
Vuln IDs
  • V-223043
  • V-64719
Rule IDs
  • SV-223043r879664_rule
  • SV-79209
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
Checks: C-24716r428679_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> ”Turn on SmartScreen Filter scan” must be ”Enabled” and ”Enable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3. Criteria: If the value "2301" is REG_DWORD = 0, this is not a finding.

Fix: F-24704r428680_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> ”Turn on SmartScreen Filter scan” to ”Enabled”, and select ”Enable” from the drop-down box.

b
Turn on SmartScreen Filter scan option for the Restricted Sites Zone must be enabled.
SI-3 - Medium - CCI-001242 - V-223044 - SV-223044r879664_rule
RMF Control
SI-3
Severity
Medium
CCI
CCI-001242
Version
DTBI1085-IE11
Vuln IDs
  • V-223044
  • V-64721
Rule IDs
  • SV-223044r879664_rule
  • SV-79211
This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
Checks: C-24717r428682_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> ”Turn on SmartScreen Filter scan” must be ”Enabled” and ”Enable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4. Criteria: If the value "2301" is REG_DWORD = 0, this is not a finding.

Fix: F-24705r428683_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> ”Turn on SmartScreen Filter scan” to ”Enabled”, and select ”Enable” from the drop-down box.

b
The Initialize and script ActiveX controls not marked as safe must be disallowed (Intranet Zone).
SC-18 - Medium - CCI-001170 - V-223045 - SV-223045r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI1090-IE11
Vuln IDs
  • V-223045
  • V-64723
Rule IDs
  • SV-223045r879630_rule
  • SV-79213
ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.
Checks: C-24718r428685_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Intranet Zone >> ”Initialize and script ActiveX controls not marked as safe” must be ”Enabled” and ”Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1. Criteria: If the value "1201" is REG_DWORD = 3, this is not a finding.

Fix: F-24706r428686_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Intranet Zone >> ”Initialize and script ActiveX controls not marked as safe” to ”Enabled”, and select ”Disable” from the drop-down box.

b
The Initialize and script ActiveX controls not marked as safe must be disallowed (Trusted Sites Zone).
SC-18 - Medium - CCI-001170 - V-223046 - SV-223046r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI1095-IE11
Vuln IDs
  • V-223046
  • V-64725
Rule IDs
  • SV-223046r879630_rule
  • SV-79215
ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.
Checks: C-24719r428688_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Trusted Sites Zone >> ”Initialize and script ActiveX controls not marked as safe” must be ”Enabled” and ”Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2. Criteria: If the value "1201" is REG_DWORD = 3, this is not a finding.

Fix: F-24707r428689_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Trusted Sites Zone >> ”Initialize and script ActiveX controls not marked as safe” to ”Enabled”, and select ”Disable” from the drop-down box.

b
Run once selection for running outdated ActiveX controls must be disabled.
CM-7 - Medium - CCI-000381 - V-223048 - SV-223048r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI1105-IE11
Vuln IDs
  • V-223048
  • V-72757
Rule IDs
  • SV-223048r879587_rule
  • SV-87395
This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malicious or compromised webpages can target security flaws in out-of-date ActiveX controls.
Checks: C-24721r428694_chk

In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, verify "Remove the Run this time button for outdated ActiveX controls in IE" is set to “Enabled”. Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext If the value "RunThisTimeEnabled" is REG_DWORD = 0, this is not a finding.

Fix: F-24709r428695_fix

In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, set "Remove the Run this time button for outdated ActiveX controls in IE" to "Enabled".

b
Enabling outdated ActiveX controls for Internet Explorer must be blocked.
CM-7 - Medium - CCI-000381 - V-223049 - SV-223049r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI1110-IE11
Vuln IDs
  • V-223049
  • V-72759
Rule IDs
  • SV-223049r879587_rule
  • SV-87397
This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malicious or compromised webpages can target security flaws in out-of-date ActiveX controls.
Checks: C-24722r428697_chk

In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, verify "Turn off blocking of outdated ActiveX controls for Internet Explorer" is set to “Disabled”. Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext If the value "VersionCheckEnabled" is REG_DWORD = 1, this is not a finding.

Fix: F-24710r428698_fix

In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, set "Turn off blocking of outdated ActiveX controls for Internet Explorer" to "Disabled".

b
Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Internet Zone.
CM-7 - Medium - CCI-000381 - V-223050 - SV-223050r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI1115-IE11
Vuln IDs
  • V-223050
  • V-72761
Rule IDs
  • SV-223050r879587_rule
  • SV-87399
This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Restricted Sites security zones. If you enable this policy setting, users will not be able to run the TDC ActiveX control from all sites in the specified zone.
Checks: C-24723r862998_chk

In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone, verify "Allow only approved domains to use the TDC ActiveX control" is “Enabled”. In the Options window, verify the “Only allow approved domains to use the TDC ActiveX control" drop-down box is set to “Enable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "120c" is REG_DWORD = “3”, this is not a finding.

Fix: F-24711r428701_fix

In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Pane >> Security Page >> Internet Zone, set the "Allow only approved domains to use the TDC ActiveX control" to “Enabled”. In the Options window, select "Enable" from the “Only allow approved domains to use the TDC ActiveX control" drop-down box.

b
The Download signed ActiveX controls property must be disallowed (Restricted Sites zone).
SC-18 - Medium - CCI-001169 - V-223051 - SV-223051r879629_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001169
Version
DTBI112-IE11
Vuln IDs
  • V-223051
  • V-46573
Rule IDs
  • SV-223051r879629_rule
  • SV-59437
ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone.
Checks: C-24724r428703_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download signed ActiveX controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1001" is REG_DWORD = 3, this is not a finding.

Fix: F-24712r428704_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download signed ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.

b
Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Restricted Sites Zone.
CM-7 - Medium - CCI-000381 - V-223052 - SV-223052r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI1120-IE11
Vuln IDs
  • V-223052
  • V-72763
Rule IDs
  • SV-223052r879587_rule
  • SV-87401
This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Restricted Sites security zones. If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone.
Checks: C-24725r863000_chk

In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone, verify "Allow only approved domains to use the TDC ActiveX control" is “Enabled”. In the Options window, verify the “Only allow approved domains to use the TDC ActiveX control" drop-down box is set to “Enable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "120c" is REG_DWORD = “3”, this is not a finding.

Fix: F-24713r428707_fix

In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone, set the "Allow only approved domains to use the TDC ActiveX control" to “Enabled”. In the Options windows, select "Enable" from the “Only allow approved domains to use the TDC ActiveX control" drop-down box.

b
VBScript must not be allowed to run in Internet Explorer (Internet zone).
SC-18 - Medium - CCI-001169 - V-223053 - SV-223053r879629_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001169
Version
DTBI1125-IE11
Vuln IDs
  • V-223053
  • V-75169
Rule IDs
  • SV-223053r879629_rule
  • SV-89849
This policy setting allows the management of whether VBScript can be run on pages from the specified zone in Internet Explorer. By selecting "Enable" in the drop-down box, VBScript can run without user intervention. By selecting "Prompt" in the drop-down box, users are asked to choose whether to allow VBScript to run. By selecting "Disable" in the drop-down box, VBScript is prevented from running. If this policy setting is not configured or disabled, VBScript will run without user intervention.
Checks: C-24726r863002_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> "Allow VBScript to run in Internet Explorer" must be "Enabled", and "Disable" must be selected from the drop-down box. Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 If the value for "140C" is not REG_DWORD = 3, this is a finding.

Fix: F-24714r428710_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> "Allow VBScript to run in Internet Explorer" to "Enabled" and select "Disable" from the drop-down box.

b
The Download unsigned ActiveX controls property must be disallowed (Restricted Sites zone).
SC-18 - Medium - CCI-001169 - V-223054 - SV-223054r879629_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001169
Version
DTBI113-IE11
Vuln IDs
  • V-223054
  • V-46575
Rule IDs
  • SV-223054r879629_rule
  • SV-59439
Unsigned code is potentially harmful, especially when coming from an untrusted zone. ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. They must also be digitally signed.
Checks: C-24727r428712_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download unsigned ActiveX controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1004" is REG_DWORD = 3, this is not a finding.

Fix: F-24715r428713_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download unsigned ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.

b
VBScript must not be allowed to run in Internet Explorer (Restricted Sites zone).
SC-18 - Medium - CCI-001169 - V-223055 - SV-223055r879629_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001169
Version
DTBI1130-IE11
Vuln IDs
  • V-223055
  • V-75171
Rule IDs
  • SV-223055r879629_rule
  • SV-89851
This policy setting allows the management of whether VBScript can be run on pages from the specified zone in Internet Explorer. By selecting "Enable" in the drop-down box, VBScript can run without user intervention. By selecting "Prompt" in the drop-down box, users are asked to choose whether to allow VBScript to run. By selecting "Disable" in the drop-down box, VBScript is prevented from running. If this policy setting is not configured or disabled, VBScript will run without user intervention.
Checks: C-24728r863004_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> "Allow VBScript to run in Internet Explorer" must be "Enabled", and "Disable" must be selected from the drop-down box. Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 If the value for "140C" is not REG_DWORD = 3, this is a finding.

Fix: F-24716r428716_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> "Allow VBScript to run in Internet Explorer" to "Enabled" and select "Disable" from the drop-down box.

a
Internet Explorer Development Tools Must Be Disabled.
SI-11 - Low - CCI-001312 - V-223056 - SV-223056r879655_rule
RMF Control
SI-11
Severity
Low
CCI
CCI-001312
Version
DTBI1135-IE11
Vuln IDs
  • V-223056
  • V-97527
Rule IDs
  • SV-223056r879655_rule
  • SV-106631
While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web application related data via the browser. Page elements, source code, javascript, API calls, application data, etc. may all be viewed and potentially manipulated. Manipulation could be useful for troubleshooting legitimate issues, and this may be performed in a development environment. Manipulation could also be malicious and must be addressed.
Checks: C-24729r428718_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Toolbars >> “Turn off Developer Tools” must be “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKEY_LOCAL_Machine\SOFTWARE\Policies\Microsoft\Internet Explorer\IEDevTools Criteria: If the value "Disabled" is REG_DWORD = 1, this is not a finding.

Fix: F-24717r428719_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Toolbars >> “Turn off Developer Tools” to “Enabled”.

b
The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone).
SC-18 - Medium - CCI-001170 - V-223057 - SV-223057r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI114-IE11
Vuln IDs
  • V-223057
  • V-46577
Rule IDs
  • SV-223057r879630_rule
  • SV-59441
ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.
Checks: C-24730r428721_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Initialize and script ActiveX controls not marked as safe' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1201" is REG_DWORD = 3, this is not a finding.

Fix: F-24718r428722_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Initialize and script ActiveX controls not marked as safe' to 'Enabled', and select 'Disable' from the drop-down box.

b
ActiveX controls and plug-ins must be disallowed (Restricted Sites zone).
CM-6 - Medium - CCI-000366 - V-223058 - SV-223058r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI115-IE11
Vuln IDs
  • V-223058
  • V-46579
Rule IDs
  • SV-223058r879887_rule
  • SV-59443
This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed. If you enable this policy setting, controls and plug-ins can run without user intervention. If you disable this policy setting, controls and plug-ins are prevented from running.
Checks: C-24731r428724_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run ActiveX controls and plugins' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1200" is REG_DWORD = 3, this is not a finding.

Fix: F-24719r428725_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run ActiveX controls and plugins' to 'Enabled', and select 'Disable' from the drop-down box.

b
ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone).
SC-18 - Medium - CCI-001170 - V-223059 - SV-223059r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI116-IE11
Vuln IDs
  • V-223059
  • V-46581
Rule IDs
  • SV-223059r879630_rule
  • SV-59445
This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. ActiveX controls not marked as safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.
Checks: C-24732r428727_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Script ActiveX controls marked safe for scripting' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1405" is REG_DWORD = 3, this is not a finding.

Fix: F-24720r428728_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Script ActiveX controls marked safe for scripting' to 'Enabled', and select 'Disable' from the drop-down box.

b
File downloads must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223060 - SV-223060r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI119-IE11
Vuln IDs
  • V-223060
  • V-46583
Rule IDs
  • SV-223060r879587_rule
  • SV-59447
Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from sites that are considered restricted. This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.
Checks: C-24733r428730_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow file downloads' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1803" is REG_DWORD = 3, this is not a finding.

Fix: F-24721r428731_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow file downloads' to 'Enabled', and select 'Disable' from the drop-down box.

b
Java permissions must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223061 - SV-223061r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI121-IE11
Vuln IDs
  • V-223061
  • V-46587
Rule IDs
  • SV-223061r879587_rule
  • SV-59451
Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Checks: C-24734r428733_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.

Fix: F-24722r428734_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

b
Accessing data sources across domains must be disallowed (Restricted Sites zone).
AC-4 - Medium - CCI-001414 - V-223062 - SV-223062r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI122-IE11
Vuln IDs
  • V-223062
  • V-46589
Rule IDs
  • SV-223062r879534_rule
  • SV-59453
The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
Checks: C-24735r428736_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Access data sources across domains' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1406" is REG_DWORD = 3, this is not a finding.

Fix: F-24723r428737_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Access data sources across domains' to 'Enabled', and select 'Disable' from the drop-down box.

b
The Allow META REFRESH property must be disallowed (Restricted Sites zone).
CM-6 - Medium - CCI-000366 - V-223063 - SV-223063r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI123-IE11
Vuln IDs
  • V-223063
  • V-46591
Rule IDs
  • SV-223063r879887_rule
  • SV-59455
It is possible that users will unknowingly be redirected to a site hosting malicious content. 'Allow META REFRESH' must have a level of protection based upon the site being browsed. This policy setting allows you to manage whether a user's browser can be redirected to another web page if the author of the web page uses the Meta Refresh setting to redirect browsers to another web page.
Checks: C-24736r428739_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow META REFRESH' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1608" is REG_DWORD = 3, this is not a finding.

Fix: F-24724r428740_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow META REFRESH' to 'Enabled', and select 'Disable' from the drop-down box.

b
Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223064 - SV-223064r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI126-IE11
Vuln IDs
  • V-223064
  • V-46593
Rule IDs
  • SV-223064r879587_rule
  • SV-59457
Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed.
Checks: C-24737r428742_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow drag and drop or copy and paste files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1802" is REG_DWORD=3, this is not a finding.

Fix: F-24725r428743_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow drag and drop or copy and paste files' to 'Enabled', and select 'Disable' from the drop-down box.

b
Launching programs and files in IFRAME must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223065 - SV-223065r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI128-IE11
Vuln IDs
  • V-223065
  • V-46597
Rule IDs
  • SV-223065r879587_rule
  • SV-59461
This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.
Checks: C-24738r428745_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Launching applications and files in an IFRAME' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1804" is REG_DWORD = 3, this is not a finding.

Fix: F-24726r428746_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Launching applications and files in an IFRAME' to 'Enabled', and select 'Disable' from the drop-down box.

b
Navigating windows and frames across different domains must be disallowed (Restricted Sites zone).
AC-4 - Medium - CCI-001414 - V-223066 - SV-223066r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI129-IE11
Vuln IDs
  • V-223066
  • V-46599
Rule IDs
  • SV-223066r879534_rule
  • SV-59463
Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use this feature in a manner similar to cross-site scripting (XSS). This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.
Checks: C-24739r428748_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Navigate windows and frames across different domains' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1607" is REG_DWORD = 3, this is not a finding.

Fix: F-24727r428749_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Navigate windows and frames across different domains' to 'Enabled', and select 'Disable' from the drop-down box.

b
Userdata persistence must be disallowed (Restricted Sites zone).
SC-28 - Medium - CCI-001199 - V-223067 - SV-223067r879642_rule
RMF Control
SC-28
Severity
Medium
CCI
CCI-001199
Version
DTBI132-IE11
Vuln IDs
  • V-223067
  • V-46601
Rule IDs
  • SV-223067r879642_rule
  • SV-59465
Userdata persistence must have a level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in Favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured.
Checks: C-24740r428751_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Userdata persistence' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1606" is REG_DWORD = 3, this is not a finding.

Fix: F-24728r428752_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Userdata persistence' to 'Enabled', and select 'Disable' from the drop-down box

b
Active scripting must be disallowed (Restricted Sites Zone).
CM-7 - Medium - CCI-000381 - V-223068 - SV-223068r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI133-IE11
Vuln IDs
  • V-223068
  • V-46603
Rule IDs
  • SV-223068r879587_rule
  • SV-59467
Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether script code on pages in the zone are run.
Checks: C-24741r428754_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow active scripting' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1400" is REG_DWORD = 3, this is not a finding.

Fix: F-24729r428755_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow active scripting' to 'Enabled', and select 'Disable' from the drop-down box.

b
Clipboard operations via script must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223069 - SV-223069r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI134-IE11
Vuln IDs
  • V-223069
  • V-46605
Rule IDs
  • SV-223069r879587_rule
  • SV-59469
A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have a level of protection based upon the site being accessed.
Checks: C-24742r428757_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow cut, copy or paste operations from the clipboard via script' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1407" is REG_DWORD = 3, this is not a finding.

Fix: F-24730r428758_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow cut, copy or paste operations from the clipboard via script' to 'Enabled', and select 'Disable' from the drop-down box.

b
Logon options must be configured and enforced (Restricted Sites zone).
SC-23 - Medium - CCI-001184 - V-223070 - SV-223070r879636_rule
RMF Control
SC-23
Severity
Medium
CCI
CCI-001184
Version
DTBI136-IE11
Vuln IDs
  • V-223070
  • V-46607
Rule IDs
  • SV-223070r879636_rule
  • SV-59471
Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to the websites. This policy setting allows management of settings for logon options. If you enable this policy setting, you can choose from varying logon options. “Anonymous logon” disables HTTP authentication and uses the guest account only for the Common Internet File System (CIFS) protocol. “Prompt for user name and password” queries users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon only in Intranet zone” queries users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon with current user name and password” attempts logon using Windows NT Challenge Response. If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for login. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. If you disable this policy setting, logon is set to “Automatic logon only in Intranet zone”. If you do not configure this policy setting, logon is set to “Automatic logon only in Intranet zone”. The most secure option is to configure this setting to “Enabled”; “Anonymous logon”. This will prevent users from submitting credentials to servers in this security zone.
Checks: C-24743r428760_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Logon options' must be 'Enabled', and 'Anonymous logon' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1A00" is REG_DWORD = 196608 (decimal), this is not a finding.

Fix: F-24731r428761_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Logon options' to 'Enabled', and select 'Anonymous logon' from the drop-down box.

b
Configuring History setting must be set to 40 days.
AU-12 - Medium - CCI-000169 - V-223071 - SV-223071r879559_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000169
Version
DTBI300-IE11
Vuln IDs
  • V-223071
  • V-46609
Rule IDs
  • SV-223071r879559_rule
  • SV-59473
This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, "General" tab, and then click Settings under Browsing History. If you enable this policy setting, a user cannot set the number of days that Internet Explorer keeps track of the pages viewed in the History List. The number of days that Internet Explorer keeps track of the pages viewed in the History List must be specified. Users will not be able to delete browsing history. If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History List. Users can delete browsing history.
Checks: C-24744r428763_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Disable Configuring History' must be 'Enabled', and '40' entered in 'Days to keep pages in History'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: If the value "History" is REG_DWORD = 1, this is not a finding. AND Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History Criteria: If the value "DaysToKeep" is REG_DWORD = 40 (decimal), this is not a finding.

Fix: F-24732r428764_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Disable Configuring History' to 'Enabled', and enter '40' in 'Days to keep pages in History'.

b
Internet Explorer must be set to disallow users to add/delete sites.
CM-7 - Medium - CCI-000381 - V-223072 - SV-223072r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI318-IE11
Vuln IDs
  • V-223072
  • V-46615
Rule IDs
  • SV-223072r879587_rule
  • SV-59479
This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system. If you do not configure this policy setting, users will be able to add or remove sites from the Trusted Sites and Restricted Sites zones at will and change settings in the Local Intranet zone. This configuration could allow sites that host malicious mobile code to be added to these zones, and users could execute the code.
Checks: C-24745r428766_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to add/delete sites' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "Security_zones_map_edit" is REG_DWORD = 1, this is not a finding.

Fix: F-24733r428767_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to add/delete sites' to 'Enabled'.

b
Internet Explorer must be configured to disallow users to change policies.
CM-6 - Medium - CCI-000366 - V-223073 - SV-223073r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI319-IE11
Vuln IDs
  • V-223073
  • V-46617
Rule IDs
  • SV-223073r879887_rule
  • SV-59481
Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting prevents users from changing the Internet Explorer policies on the machine. Policy changes should be made by administrators only, so this setting should be enabled. If you enable this policy setting, you disable the "Custom level" button and "Security" level for this zone slider on the Security tab in the Internet Options dialog box. If this policy setting is disabled or not configured, users will be able to change the settings for security zones. It prevents users from changing security zone policy settings that are established by the administrator.
Checks: C-24746r428769_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to change policies' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "Security_options_edit" is REG_DWORD = 1, this is not a finding.

Fix: F-24734r428770_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to change policies' to 'Enabled'.

b
Internet Explorer must be configured to use machine settings.
CM-6 - Medium - CCI-000366 - V-223074 - SV-223074r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI320-IE11
Vuln IDs
  • V-223074
  • V-46619
Rule IDs
  • SV-223074r879887_rule
  • SV-59483
Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting enforces consistent security zone settings to all users of the computer. Security zones control browser behavior at various websites and it is desirable to maintain a consistent policy for all users of a machine. This policy setting affects how security zone changes apply to different users. If you enable this policy setting, changes that one user makes to a security zone will apply to all users of that computer. If this policy setting is disabled or not configured, users of the same computer are allowed to establish their own security zone settings.
Checks: C-24747r428772_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Use only machine settings' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "Security_HKLM_only" is REG_DWORD = 1, this is not a finding.

Fix: F-24735r428773_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Use only machine settings' to 'Enabled'.

b
Security checking features must be enforced.
CM-6 - Medium - CCI-000366 - V-223075 - SV-223075r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI325-IE11
Vuln IDs
  • V-223075
  • V-46621
Rule IDs
  • SV-223075r879887_rule
  • SV-59485
This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this policy setting, the security settings check will not be performed. If you disable or do not configure this policy setting, the security settings check will be performed.
Checks: C-24748r428775_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off the Security Settings Check feature' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Security Criteria: If the value "DisableSecuritySettingsCheck" is REG_DWORD = 0, this is not a finding.

Fix: F-24736r428776_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off the Security Settings Check feature' to 'Disabled'.

b
Software must be disallowed to run or install with invalid signatures.
SC-18 - Medium - CCI-001170 - V-223076 - SV-223076r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI350-IE11
Vuln IDs
  • V-223076
  • V-46625
Rule IDs
  • SV-223076r879630_rule
  • SV-59489
Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure unmodified software is downloaded and the user can positively identify the signer to determine whether you trust them enough to run their software.
Checks: C-24749r428778_chk

Note: Some legitimate software and controls may have an invalid signature. You should carefully test such software in isolation before it is allowed to be used on an organization's network. The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Allow software to run or install even if the signature is invalid' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: If the value "RunInvalidSignatures" is REG_DWORD = 0, this is not a finding.

Fix: F-24737r428779_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Allow software to run or install even if the signature is invalid' to 'Disabled'.

b
The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on.
SC-3 - Medium - CCI-001084 - V-223077 - SV-223077r879643_rule
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
DTBI356-IE11
Vuln IDs
  • V-223077
  • V-46995
Rule IDs
  • SV-223077r879643_rule
  • SV-59861
This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.Important: Some ActiveX controls and toolbars may not be available when 64-bit processes are used. If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default.
Checks: C-24750r428781_chk

Note: If McAfee ENS Web Control is being used, this is Not Applicable. The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Advanced Page 'Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "Isolation64Bit" is REG_DWORD = 1, this is not a finding.

Fix: F-24738r428782_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Advanced Page 'Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows' to 'Enabled'.

a
Checking for server certificate revocation must be enforced.
IA-5 - Low - CCI-000185 - V-223078 - SV-223078r879612_rule
RMF Control
IA-5
Severity
Low
CCI
CCI-000185
Version
DTBI365-IE11
Vuln IDs
  • V-223078
  • V-46629
Rule IDs
  • SV-223078r879612_rule
  • SV-59493
This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure. If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked. If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. Satisfies: SRG-APP-000605
Checks: C-24751r428784_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for server certificate revocation' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "CertificateRevocation" is REG_DWORD = 1, this is not a finding.

Fix: F-24739r428785_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for server certificate revocation' to 'Enabled'.

b
Checking for signatures on downloaded programs must be enforced.
CM-5 - Medium - CCI-001749 - V-223079 - SV-223079r942483_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001749
Version
DTBI370-IE11
Vuln IDs
  • V-223079
  • V-46633
Rule IDs
  • SV-223079r942483_rule
  • SV-59497
This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified or tampered with) on user computers before downloading executable programs. If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to the user computers. If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to the user computers. If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to the user computers.
Checks: C-24752r428787_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for signatures on downloaded programs' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: If the value "CheckExeSignatures" is REG_SZ = yes, this is not a finding.

Fix: F-24740r428788_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for signatures on downloaded programs' to 'Enabled'.

b
All network paths (UNCs) for Intranet sites must be disallowed.
CM-6 - Medium - CCI-000366 - V-223080 - SV-223080r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI375-IE11
Vuln IDs
  • V-223080
  • V-46635
Rule IDs
  • SV-223080r879887_rule
  • SV-59499
Some UNC paths could refer to servers not managed by the organization, which means they could host malicious content; and therefore, it is safest to not include all UNC paths in the Intranet Sites zone. This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there). If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.
Checks: C-24753r428790_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> 'Intranet Sites: Include all network paths (UNCs)' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Criteria: If the value "UNCAsIntranet" is REG_DWORD = 0, this is not a finding.

Fix: F-24741r428791_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> 'Intranet Sites: Include all network paths (UNCs)' to 'Disabled'.

b
Script-initiated windows without size or position constraints must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223081 - SV-223081r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI385-IE11
Vuln IDs
  • V-223081
  • V-46637
Rule IDs
  • SV-223081r879587_rule
  • SV-59501
This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.
Checks: C-24754r428793_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow script-initiated windows without size or position constraints' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2102" is REG_DWORD = 3, this is not a finding.

Fix: F-24742r428794_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow script-initiated windows without size or position constraints' to 'Enabled', and select 'Disable' from the drop-down box.

b
Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223082 - SV-223082r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI390-IE11
Vuln IDs
  • V-223082
  • V-46639
Rule IDs
  • SV-223082r879587_rule
  • SV-59503
This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.
Checks: C-24755r428796_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow script-initiated windows without size or position constraints' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2102" is REG_DWORD = 3, this is not a finding.

Fix: F-24743r428797_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow script-initiated windows without size or position constraints' to 'Enabled', and select 'Disable' from the drop-down box.

b
Scriptlets must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223083 - SV-223083r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI395-IE11
Vuln IDs
  • V-223083
  • V-46641
Rule IDs
  • SV-223083r879587_rule
  • SV-59505
This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.
Checks: C-24756r428799_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow Scriptlets' must be 'Enabled', and 'Disable' from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1209" is REG_DWORD = 3, this is not a finding.

Fix: F-24744r428800_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow Scriptlets' to 'Enabled', and select 'Disable' from the drop-down box.

b
Automatic prompting for file downloads must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223084 - SV-223084r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI415-IE11
Vuln IDs
  • V-223084
  • V-46643
Rule IDs
  • SV-223084r879587_rule
  • SV-59507
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, and those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the information bar instead of the file download dialog. Users can then click the information bar to allow the file download prompt.
Checks: C-24757r428802_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Automatic prompting for file downloads' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2200" is REG_DWORD = 3, this is not a finding.

Fix: F-24745r428803_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Automatic prompting for file downloads' to 'Enabled', and select 'Disable' from the drop-down box.

b
Java permissions must be disallowed (Local Machine zone).
CM-7 - Medium - CCI-000381 - V-223085 - SV-223085r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI425-IE11
Vuln IDs
  • V-223085
  • V-46645
Rule IDs
  • SV-223085r879587_rule
  • SV-59509
Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Checks: C-24758r428805_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.

Fix: F-24746r428806_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

b
Anti-Malware programs against ActiveX controls must be run for the Local Machine zone.
SC-18 - Medium - CCI-001662 - V-223086 - SV-223086r879628_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001662
Version
DTBI426-IE11
Vuln IDs
  • V-223086
  • V-47003
Rule IDs
  • SV-223086r879628_rule
  • SV-59869
This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Checks: C-24759r428808_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page ->Local Machine Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.

Fix: F-24747r428809_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Local Machine Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

b
Java permissions must be disallowed (Locked Down Local Machine zone).
CM-7 - Medium - CCI-000381 - V-223087 - SV-223087r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI430-IE11
Vuln IDs
  • V-223087
  • V-46647
Rule IDs
  • SV-223087r879587_rule
  • SV-59511
Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Checks: C-24760r428811_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.

Fix: F-24748r428812_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

b
Java permissions must be disallowed (Locked Down Intranet zone).
CM-7 - Medium - CCI-000381 - V-223088 - SV-223088r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI435-IE11
Vuln IDs
  • V-223088
  • V-46649
Rule IDs
  • SV-223088r879587_rule
  • SV-59513
Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Checks: C-24761r428814_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 Criteria: If the value" 1C00" is REG_DWORD = 0, this is not a finding.

Fix: F-24749r428815_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

b
Java permissions must be disallowed (Locked Down Trusted Sites zone).
CM-7 - Medium - CCI-000381 - V-223089 - SV-223089r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI440-IE11
Vuln IDs
  • V-223089
  • V-46653
Rule IDs
  • SV-223089r879587_rule
  • SV-59517
Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Checks: C-24762r428817_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.

Fix: F-24750r428818_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

b
Java permissions must be disallowed (Locked Down Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223090 - SV-223090r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI450-IE11
Vuln IDs
  • V-223090
  • V-46663
Rule IDs
  • SV-223090r879587_rule
  • SV-59527
Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Checks: C-24763r428820_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.

Fix: F-24751r428821_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

b
XAML files must be disallowed (Internet zone).
CM-6 - Medium - CCI-000366 - V-223091 - SV-223091r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI455-IE11
Vuln IDs
  • V-223091
  • V-46665
Rule IDs
  • SV-223091r879887_rule
  • SV-59529
These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the drop-down box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the drop-down box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.
Checks: C-24764r428823_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow loading of XAML files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2402" is REG_DWORD = 3, this is not a finding.

Fix: F-24752r428824_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow loading of XAML files' to 'Enabled', and select 'Disable' from the drop-down box.

b
XAML files must be disallowed (Restricted Sites zone).
CM-6 - Medium - CCI-000366 - V-223092 - SV-223092r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI460-IE11
Vuln IDs
  • V-223092
  • V-46669
Rule IDs
  • SV-223092r879887_rule
  • SV-59533
These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the drop-down box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the drop-down box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.
Checks: C-24765r428826_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow loading of XAML files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2402" is REG_DWORD = 3, this is not a finding.

Fix: F-24753r428827_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow loading of XAML files' to 'Enabled', and select 'Disable' from the drop-down box.

b
Protected Mode must be enforced (Internet zone).
SC-3 - Medium - CCI-001084 - V-223093 - SV-223093r879643_rule
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
DTBI485-IE11
Vuln IDs
  • V-223093
  • V-46681
Rule IDs
  • SV-223093r879643_rule
  • SV-59545
Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off Protected Mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on Protected Mode. If you do not configure this policy, users will be able to turn on or off Protected Mode.
Checks: C-24766r428829_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Protected Mode' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2500" is REG_DWORD = 0, this is not a finding.

Fix: F-24754r428830_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Protected Mode' to 'Enabled', and select 'Enable' from the drop-down box.

b
Protected Mode must be enforced (Restricted Sites zone).
SC-3 - Medium - CCI-001084 - V-223094 - SV-223094r879643_rule
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
DTBI490-IE11
Vuln IDs
  • V-223094
  • V-46685
Rule IDs
  • SV-223094r879643_rule
  • SV-59549
Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off Protected Mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on Protected Mode. If you do not configure this policy, users will be able to turn on or off Protected Mode.
Checks: C-24767r428832_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Protected Mode' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2500" is REG_DWORD = 0, this is not a finding.

Fix: F-24755r428833_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Protected Mode' to 'Enabled' and select 'Enable', from the drop-down box.

b
Pop-up Blocker must be enforced (Internet zone).
CM-7 - Medium - CCI-000381 - V-223095 - SV-223095r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI495-IE11
Vuln IDs
  • V-223095
  • V-46689
Rule IDs
  • SV-223095r879587_rule
  • SV-59553
This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.
Checks: C-24768r428835_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Use Pop-up Blocker' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1809" is REG_DWORD = 0, this is not a finding.

Fix: F-24756r428836_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Use Pop-up Blocker' to 'Enabled', and select 'Enable' from the drop-down box.

b
Pop-up Blocker must be enforced (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223096 - SV-223096r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI500-IE11
Vuln IDs
  • V-223096
  • V-46691
Rule IDs
  • SV-223096r879587_rule
  • SV-59555
This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.
Checks: C-24769r428838_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Use Pop-up Blocker' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1809" is REG_DWORD = 0, this is not a finding.

Fix: F-24757r428839_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Use Pop-up Blocker' to 'Enabled', and select 'Enable' from the drop-down box.

b
Websites in less privileged web content zones must be prevented from navigating into the Internet zone.
AC-4 - Medium - CCI-001414 - V-223097 - SV-223097r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI515-IE11
Vuln IDs
  • V-223097
  • V-46693
Rule IDs
  • SV-223097r879534_rule
  • SV-59557
This policy setting allows a user to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Internet zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If "Prompt" is selected in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If this policy setting is disabled, the potentially risky navigation is prevented. The Internet Explorer security feature will be on in this zone as set by the Protection from Zone Elevation feature control. If this policy setting is not configured, websites from less privileged zones can open new windows in, or navigate into, this zone.
Checks: C-24770r428841_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2101" is REG_DWORD = 3, this is not a finding.

Fix: F-24758r428842_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' to 'Enabled', and select 'Disable' from the drop-down box.

b
Websites in less privileged web content zones must be prevented from navigating into the Restricted Sites zone.
AC-4 - Medium - CCI-001414 - V-223098 - SV-223098r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI520-IE11
Vuln IDs
  • V-223098
  • V-46695
Rule IDs
  • SV-223098r879534_rule
  • SV-59559
This policy setting allows you to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Restricted zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If Prompt is selected in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If this policy setting is disabled, the potentially risky navigation is prevented. The Internet Explorer security feature will be on in this zone as set by the Protection from Zone Elevation feature control. If this policy setting is not configured, websites from less privileged zones can open new windows in, or navigate into, this zone.
Checks: C-24771r428844_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2101" is REG_DWORD = 3, this is not a finding.

Fix: F-24759r428845_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' to 'Enabled', and select 'Disable' from the drop-down box.

b
Allow binary and script behaviors must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223099 - SV-223099r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI575-IE11
Vuln IDs
  • V-223099
  • V-46701
Rule IDs
  • SV-223099r879587_rule
  • SV-59565
This policy setting allows you to manage dynamic binary and script behaviors of components that encapsulate specific functionality for HTML elements, to which they were attached. If you enable this policy setting, binary and script behaviors are available. If you select "Administrator approved" in the drop-down box, only the behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available. If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. If you do not configure this policy setting, binary and script behaviors are available.
Checks: C-24772r428847_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow binary and script behaviors' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2000" is REG_DWORD = 3, this is not a finding.

Fix: F-24760r428848_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow binary and script behaviors' to 'Enabled', and select 'Disable' from the drop-down box.

b
Automatic prompting for file downloads must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223100 - SV-223100r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI580-IE11
Vuln IDs
  • V-223100
  • V-46705
Rule IDs
  • SV-223100r879587_rule
  • SV-59569
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, and those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the information bar instead of the file download dialog. Users can then click the information bar to allow the file download prompt.
Checks: C-24773r428850_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Automatic prompting for file downloads' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2200" is REG_DWORD = 3, this is not a finding.

Fix: F-24761r428851_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Automatic prompting for file downloads' to 'Enabled', and select 'Disable' from the drop-down box.

b
Internet Explorer Processes for MIME handling must be enforced. (Reserved)
SC-18 - Medium - CCI-001166 - V-223101 - SV-223101r879627_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001166
Version
DTBI590-IE11
Vuln IDs
  • V-223101
  • V-46709
Rule IDs
  • SV-223101r879627_rule
  • SV-59573
Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network.
Checks: C-24774r428853_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.

Fix: F-24762r428854_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for MIME handling must be enforced (Explorer).
SC-18 - Medium - CCI-001166 - V-223102 - SV-223102r879627_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001166
Version
DTBI592-IE11
Vuln IDs
  • V-223102
  • V-46711
Rule IDs
  • SV-223102r879627_rule
  • SV-59575
Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to the organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide.
Checks: C-24775r428856_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24763r428857_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for MIME handling must be enforced (iexplore).
SC-18 - Medium - CCI-001166 - V-223103 - SV-223103r879627_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001166
Version
DTBI594-IE11
Vuln IDs
  • V-223103
  • V-46713
Rule IDs
  • SV-223103r879627_rule
  • SV-59577
Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide.
Checks: C-24776r428859_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24764r428860_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for MIME sniffing must be enforced (Reserved).
SC-18 - Medium - CCI-001166 - V-223104 - SV-223104r879627_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001166
Version
DTBI595-IE11
Vuln IDs
  • V-223104
  • V-46715
Rule IDs
  • SV-223104r879627_rule
  • SV-59579
MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends you configure this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.
Checks: C-24777r428862_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.

Fix: F-24765r428863_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for MIME sniffing must be enforced (Explorer).
SC-18 - Medium - CCI-001166 - V-223105 - SV-223105r879627_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001166
Version
DTBI596-IE11
Vuln IDs
  • V-223105
  • V-46717
Rule IDs
  • SV-223105r879627_rule
  • SV-59581
MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.
Checks: C-24778r428865_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24766r428866_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for MIME sniffing must be enforced (iexplore).
SC-18 - Medium - CCI-001166 - V-223106 - SV-223106r879627_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001166
Version
DTBI597-IE11
Vuln IDs
  • V-223106
  • V-46719
Rule IDs
  • SV-223106r879627_rule
  • SV-59583
MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.
Checks: C-24779r428868_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24767r428869_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for MK protocol must be enforced (Reserved).
CM-7 - Medium - CCI-000381 - V-223107 - SV-223107r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI599-IE11
Vuln IDs
  • V-223107
  • V-46721
Rule IDs
  • SV-223107r879587_rule
  • SV-59585
The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends configuring this setting to "Enabled" to block the MK protocol unless it is specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.
Checks: C-24780r428871_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.

Fix: F-24768r428872_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for MK protocol must be enforced (Explorer).
CM-7 - Medium - CCI-000381 - V-223108 - SV-223108r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI600-IE11
Vuln IDs
  • V-223108
  • V-46723
Rule IDs
  • SV-223108r879587_rule
  • SV-59587
The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends you configure this setting to "Enabled" to block the MK protocol unless it is specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.
Checks: C-24781r428874_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24769r428875_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for MK protocol must be enforced (iexplore).
CM-7 - Medium - CCI-000381 - V-223109 - SV-223109r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI605-IE11
Vuln IDs
  • V-223109
  • V-46725
Rule IDs
  • SV-223109r879587_rule
  • SV-59589
The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends you configure this setting to "Enabled" to block the MK protocol unless specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.
Checks: C-24782r428877_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24770r428878_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for Zone Elevation must be enforced (Reserved).
SC-3 - Medium - CCI-001084 - V-223110 - SV-223110r879643_rule
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
DTBI610-IE11
Vuln IDs
  • V-223110
  • V-46727
Rule IDs
  • SV-223110r879643_rule
  • SV-59591
Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as "Enabled" in all environments.
Checks: C-24783r428880_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.

Fix: F-24771r428881_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for Zone Elevation must be enforced (Explorer).
SC-3 - Medium - CCI-001084 - V-223111 - SV-223111r879643_rule
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
DTBI612-IE11
Vuln IDs
  • V-223111
  • V-46729
Rule IDs
  • SV-223111r879643_rule
  • SV-59593
Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends configuring this setting as "Enabled" in all environments.
Checks: C-24784r428883_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24772r428884_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for Zone Elevation must be enforced (iexplore).
SC-3 - Medium - CCI-001084 - V-223112 - SV-223112r879643_rule
RMF Control
SC-3
Severity
Medium
CCI
CCI-001084
Version
DTBI614-IE11
Vuln IDs
  • V-223112
  • V-46731
Rule IDs
  • SV-223112r879643_rule
  • SV-59595
Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as "Enabled" in all environments.
Checks: C-24785r428886_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24773r428887_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for Restrict File Download must be enforced (Reserved).
CM-7 - Medium - CCI-000381 - V-223113 - SV-223113r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI630-IE11
Vuln IDs
  • V-223113
  • V-46733
Rule IDs
  • SV-223113r879587_rule
  • SV-59597
In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.
Checks: C-24786r428889_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.

Fix: F-24774r428890_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for Restrict File Download must be enforced (Explorer).
CM-7 - Medium - CCI-000381 - V-223114 - SV-223114r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI635-IE11
Vuln IDs
  • V-223114
  • V-46779
Rule IDs
  • SV-223114r879587_rule
  • SV-59645
In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.
Checks: C-24787r428892_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24775r428893_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for Restrict File Download must be enforced (iexplore).
CM-7 - Medium - CCI-000381 - V-223115 - SV-223115r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI640-IE11
Vuln IDs
  • V-223115
  • V-46781
Rule IDs
  • SV-223115r879587_rule
  • SV-59647
In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.
Checks: C-24788r428895_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24776r428896_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved).
CM-7 - Medium - CCI-000381 - V-223116 - SV-223116r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI645-IE11
Vuln IDs
  • V-223116
  • V-46787
Rule IDs
  • SV-223116r879587_rule
  • SV-59653
Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force the user to interact with a window containing malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows, and create windows that hide other windows. Recommend configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.
Checks: C-24789r428898_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.

Fix: F-24777r428899_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer).
CM-7 - Medium - CCI-000381 - V-223117 - SV-223117r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI647-IE11
Vuln IDs
  • V-223117
  • V-46789
Rule IDs
  • SV-223117r879587_rule
  • SV-59655
Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and create windows that hide other windows. This guide recommends configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.
Checks: C-24790r428901_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value "explorer.exe is REG_SZ = 1, this is not a finding.

Fix: F-24778r428902_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.

b
Internet Explorer Processes for restricting pop-up windows must be enforced (iexplore).
CM-7 - Medium - CCI-000381 - V-223118 - SV-223118r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI649-IE11
Vuln IDs
  • V-223118
  • V-46791
Rule IDs
  • SV-223118r879587_rule
  • SV-59657
Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and create windows that hide other windows. This guide recommends configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.
Checks: C-24791r428904_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24779r428905_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.

b
.NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Sites Zone).
CM-6 - Medium - CCI-000366 - V-223119 - SV-223119r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI650-IE11
Vuln IDs
  • V-223119
  • V-46797
Rule IDs
  • SV-223119r879887_rule
  • SV-59663
This policy setting allows you to manage whether .NET Framework-reliant components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
Checks: C-24792r428907_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components not signed with Authenticode' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2004" is REG_DWORD = 3, this is not a finding.

Fix: F-24780r428908_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components not signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.

b
.NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Sites Zone).
CM-6 - Medium - CCI-000366 - V-223120 - SV-223120r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI655-IE11
Vuln IDs
  • V-223120
  • V-46799
Rule IDs
  • SV-223120r879887_rule
  • SV-59665
This policy setting allows you to manage whether .NET Framework-reliant components that are signed with Authenticode can be executed from Internet Explorer. It may be possible for malicious content hosted on a website to take advantage of these components. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will execute signed managed components.
Checks: C-24793r428910_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components signed with Authenticode' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2001" is REG_DWORD = 3, this is not a finding.

Fix: F-24781r428911_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.

b
Scripting of Java applets must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223121 - SV-223121r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI670-IE11
Vuln IDs
  • V-223121
  • V-46801
Rule IDs
  • SV-223121r879587_rule
  • SV-59667
This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. If you select "Prompt" in the drop-down box, users are queried to choose whether to allow scripts to access applets. If you disable this policy setting, scripts are prevented from accessing applets. If you do not configure this policy setting, scripts can access applets automatically without user intervention.
Checks: C-24794r428913_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Scripting of Java applets' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1402" is REG_DWORD = 3, this is not a finding.

Fix: F-24782r428914_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Scripting of Java applets' to 'Enabled', and select 'Disable' from the drop-down box.

b
AutoComplete feature for forms must be disallowed.
CM-7 - Medium - CCI-000381 - V-223122 - SV-223122r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI690-IE11
Vuln IDs
  • V-223122
  • V-46807
Rule IDs
  • SV-223122r879587_rule
  • SV-59673
This AutoComplete feature suggests possible matches when users are filling in forms. It is possible that this feature will cache sensitive data and store it in the user's profile, where it might not be protected as rigorously as required by organizational policy. If you enable this setting, the user is not presented with suggested matches when filling in forms. If you disable this setting, the user is presented with suggested possible matches when filling forms. If you do not configure this setting, the user has the freedom to turn on the auto-complete feature for forms. To display this option, the user opens the Internet Options dialog box, clicks the "Contents" tab, and clicks the "Settings" button.
Checks: C-24795r428916_chk

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Disable AutoComplete for forms' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "Use FormSuggest" is REG_SZ = no, this is not a finding.

Fix: F-24783r428917_fix

Set the policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Disable AutoComplete for forms' to 'Enabled'.

b
Crash Detection management must be enforced.
CM-7 - Medium - CCI-000381 - V-223123 - SV-223123r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI715-IE11
Vuln IDs
  • V-223123
  • V-46811
Rule IDs
  • SV-223123r879587_rule
  • SV-59677
The 'Turn off Crash Detection' policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. A crash report could contain sensitive information from the computer's memory. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP Professional Service Pack 1 and earlier, where Windows Error Reporting will be invoked. If you disable this policy setting, the crash detection feature in add-on management will be functional.
Checks: C-24796r428919_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off Crash Detection' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key:HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria: If the value "NoCrashDetection" is REG_DWORD = 1, this is not a finding.

Fix: F-24784r428920_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off Crash Detection' to 'Enabled'.

b
Turn on the auto-complete feature for user names and passwords on forms must be disabled.
CM-7 - Medium - CCI-000381 - V-223124 - SV-223124r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI725-IE11
Vuln IDs
  • V-223124
  • V-46815
Rule IDs
  • SV-223124r879587_rule
  • SV-59681
This policy setting controls automatic completion of fields in forms on web pages. It is possible that malware could be developed which would be able to extract the cached user names and passwords from the currently logged on user, which an attacker could then use to compromise that user's online accounts. If you enable this setting, the user cannot change the 'User name and passwords on forms' or 'prompt me to save passwords'. The Auto Complete feature for" User names and passwords on forms" will be turned on. If you disable this setting, the user cannot change the 'User name and passwords on forms' or 'prompt me to save passwords'. The Auto Complete feature for "User names and passwords on forms" is turned off. The user also cannot opt to be prompted to save passwords. If you do not configure this setting, the user has the freedom of turning on Auto Complete for "User name and passwords on forms", and the option of prompting to save passwords.
Checks: C-24797r428922_chk

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn on the auto-complete feature for user names and passwords on forms' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "FormSuggest Passwords" is REG_SZ = 'no', this is not a finding. AND Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "FormSuggest PW Ask" is REG_SZ = 'no', this is not a finding.

Fix: F-24785r428923_fix

Set the policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn on the auto-complete feature for user names and passwords on forms' to 'Disabled'.

b
Managing SmartScreen Filter use must be enforced.
SC-18 - Medium - CCI-001166 - V-223125 - SV-223125r879627_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001166
Version
DTBI740-IE11
Vuln IDs
  • V-223125
  • V-46819
Rule IDs
  • SV-223125r879627_rule
  • SV-59685
This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection via visiting malicious websites. This policy setting allows users to enable the SmartScreen Filter, which will warn if the website being visited is known for fraudulent attempts to gather personal information through 'phishing' or is known to host malware. If you enable this setting the user will not be prompted to enable the SmartScreen Filter. It must be specified which mode the SmartScreen Filter uses: On or Off. If the feature is On, all website addresses not contained on the filters allow list, will be sent automatically to Microsoft without prompting the user. If this feature is set to Off, the feature will not run. If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience.
Checks: C-24798r428925_chk

If the system is on the SIPRNet, this requirement is NA. The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> "Prevent Managing SmartScreen Filter" must be "Enabled", and "On" selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter Criteria: If the value "EnabledV9" is "REG_DWORD = 1", this is not a finding.

Fix: F-24786r428926_fix

If the system is on the SIPRNet, this requirement is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> "Prevent Managing SmartScreen Filter" to "Enabled", and select "On" from the drop-down box.

b
Browser must retain history on exit.
AU-12 - Medium - CCI-000169 - V-223126 - SV-223126r879559_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000169
Version
DTBI760-IE11
Vuln IDs
  • V-223126
  • V-46829
Rule IDs
  • SV-223126r879559_rule
  • SV-59695
Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.
Checks: C-24799r428928_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Allow deleting browsing history on exit' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: If the value "ClearBrowsingHistoryOnExit" is REG_DWORD = 0, this is not a finding.

Fix: F-24787r428929_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Allow deleting browsing history on exit' to 'Disabled'.

b
Deleting websites that the user has visited must be disallowed.
AU-12 - Medium - CCI-000169 - V-223127 - SV-223127r879559_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000169
Version
DTBI770-IE11
Vuln IDs
  • V-223127
  • V-46841
Rule IDs
  • SV-223127r879559_rule
  • SV-59707
This policy prevents users from deleting the history of websites the user has visited. If you enable this policy setting, websites the user has visited will be preserved when the user clicks "Delete". If you disable this policy setting, websites that the user has visited will be deleted when the user clicks "Delete". If you do not configure this policy setting, the user will be able to select whether to delete or preserve websites the user visited when the user clicks "Delete".
Checks: C-24800r428931_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Prevent Deleting Web sites that the User has Visited' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: If the value "CleanHistory" is REG_DWORD = 0, this is not a finding.

Fix: F-24788r428932_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Prevent Deleting Web sites that the User has Visited' to 'Enabled'.

b
InPrivate Browsing must be disallowed.
AU-10 - Medium - CCI-000166 - V-223128 - SV-223128r879554_rule
RMF Control
AU-10
Severity
Medium
CCI
CCI-000166
Version
DTBI780-IE11
Vuln IDs
  • V-223128
  • V-46847
Rule IDs
  • SV-223128r879554_rule
  • SV-59713
InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method. The InPrivate Browsing feature in Internet Explorer makes browser privacy easy by not storing history, cookies, temporary Internet files, or other data. If you enable this policy setting, InPrivate Browsing will be disabled. If you disable this policy setting, InPrivate Browsing will be available for use. If you do not configure this setting, InPrivate Browsing can be turned on or off through the registry.
Checks: C-24801r428934_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Privacy -> 'Turn off InPrivate Browsing' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: If the value "EnableInPrivateBrowsing" is REG_DWORD = 0, this is not a finding.

Fix: F-24789r428935_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Privacy -> 'Turn off InPrivate Browsing' to 'Enabled'.

b
Scripting of Internet Explorer WebBrowser control property must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223129 - SV-223129r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI800-IE11
Vuln IDs
  • V-223129
  • V-46849
Rule IDs
  • SV-223129r879587_rule
  • SV-59715
This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser control is allowed. If you disable this policy setting, script access to the WebBrowser control is not allowed. If you do not configure this policy setting, script access to the WebBrowser control can be enabled or disabled by the user. By default, script access to the WebBrowser control is only allowed in the Local Machine and Intranet Zones.
Checks: C-24802r428937_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1206" is REG_DWORD = 3, this is not a finding.

Fix: F-24790r428938_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' to 'Enabled', and select 'Disable' from the drop-down box.

b
When uploading files to a server, the local directory path must be excluded (Internet zone).
CM-7 - Medium - CCI-000381 - V-223130 - SV-223130r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI810-IE11
Vuln IDs
  • V-223130
  • V-46853
Rule IDs
  • SV-223130r879587_rule
  • SV-59719
This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.
Checks: C-24803r428940_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Include local path when user is uploading files to a server' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "160A" is REG_DWORD = 3, this is not a finding.

Fix: F-24791r428941_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Include local path when user is uploading files to a server' to 'Enabled', and select 'Disable' from the drop-down box.

b
Internet Explorer Processes for Notification Bars must be enforced (Reserved).
CM-7 - Medium - CCI-000381 - V-223131 - SV-223131r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI815-IE11
Vuln IDs
  • V-223131
  • V-46857
Rule IDs
  • SV-223131r879587_rule
  • SV-59723
This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes.
Checks: C-24804r428943_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.

Fix: F-24792r428944_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.

b
Security Warning for unsafe files must be set to prompt (Internet zone).
CM-6 - Medium - CCI-000366 - V-223132 - SV-223132r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI820-IE11
Vuln IDs
  • V-223132
  • V-46859
Rule IDs
  • SV-223132r879887_rule
  • SV-59725
This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to "Enable", these files open without a security warning. If you set the drop-down box to " Prompt", a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files.
Checks: C-24805r428946_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Show security warning for potentially unsafe files' must be 'Enabled', and 'Prompt' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1806" is REG_DWORD = 1, this is not a finding.

Fix: F-24793r428947_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Show security warning for potentially unsafe files' to 'Enabled', and select 'Prompt' from the drop-down box.

b
Internet Explorer Processes for Notification Bars must be enforced (Explorer).
CM-7 - Medium - CCI-000381 - V-223133 - SV-223133r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI825-IE11
Vuln IDs
  • V-223133
  • V-46861
Rule IDs
  • SV-223133r879587_rule
  • SV-59727
This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes.
Checks: C-24806r428949_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24794r428950_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.

b
ActiveX controls without prompt property must be used in approved domains only (Internet zone).
SC-18 - Medium - CCI-001170 - V-223134 - SV-223134r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI830-IE11
Vuln IDs
  • V-223134
  • V-46865
Rule IDs
  • SV-223134r879630_rule
  • SV-59729
This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Websites should be moved into another zone if permissions need to be changed.
Checks: C-24807r428952_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> ' Allow only approved domains to use ActiveX controls without prompt' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "120b" is REG_DWORD = 3, this is not a finding.

Fix: F-24795r428953_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow only approved domains to use ActiveX controls without prompt' to 'Enabled', and select 'Enable' from the drop-down box.

b
Internet Explorer Processes for Notification Bars must be enforced (iexplore).
CM-7 - Medium - CCI-000381 - V-223135 - SV-223135r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI835-IE11
Vuln IDs
  • V-223135
  • V-46869
Rule IDs
  • SV-223135r879587_rule
  • SV-59735
This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes.
Checks: C-24808r428955_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.

Fix: F-24796r428956_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.

b
Cross-Site Scripting Filter must be enforced (Internet zone).
CM-7 - Medium - CCI-000381 - V-223136 - SV-223136r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI840-IE11
Vuln IDs
  • V-223136
  • V-46879
Rule IDs
  • SV-223136r879587_rule
  • SV-59745
The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.
Checks: C-24809r428958_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Cross-Site Scripting Filter' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1409" is REG_DWORD = 0, this is not a finding.

Fix: F-24797r428959_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Cross-Site Scripting Filter' to 'Enabled', and select 'Enable' from the drop-down box.

b
Scripting of Internet Explorer WebBrowser Control must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223137 - SV-223137r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI850-IE11
Vuln IDs
  • V-223137
  • V-46883
Rule IDs
  • SV-223137r879587_rule
  • SV-59749
This policy setting controls whether a page may control embedded WebBrowser Control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser Control is allowed. If you disable this policy setting, script access to the WebBrowser Control is not allowed. If you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet Zones.
Checks: C-24810r428961_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1206" is REG_DWORD = 3, this is not a finding.

Fix: F-24798r428962_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' to 'Enabled', and select 'Disable' from the drop-down box.

b
When uploading files to a server, the local directory path must be excluded (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223138 - SV-223138r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI860-IE11
Vuln IDs
  • V-223138
  • V-46885
Rule IDs
  • SV-223138r879587_rule
  • SV-59751
This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.
Checks: C-24811r428964_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Include local path when user is uploading files to a server' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "160A" is REG_DWORD = 3, this is not a finding.

Fix: F-24799r428965_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Include local path when user is uploading files to a server' to 'Enabled', and select 'Disable' from the drop-down box.

b
Security Warning for unsafe files must be disallowed (Restricted Sites zone).
CM-6 - Medium - CCI-000366 - V-223139 - SV-223139r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI870-IE11
Vuln IDs
  • V-223139
  • V-46889
Rule IDs
  • SV-223139r879887_rule
  • SV-59755
This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to "Enable", these files open without a security warning. If you set the drop-down box to "Prompt", a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files.
Checks: C-24812r428967_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Show security warning for potentially unsafe files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1806" is REG_DWORD = 3, this is not a finding.

Fix: F-24800r428968_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Show security warning for potentially unsafe files' to 'Enabled', and select 'Disable' from the drop-down box.

b
ActiveX controls without prompt property must be used in approved domains only (Restricted Sites zone).
SC-18 - Medium - CCI-001170 - V-223140 - SV-223140r879630_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001170
Version
DTBI880-IE11
Vuln IDs
  • V-223140
  • V-46893
Rule IDs
  • SV-223140r879630_rule
  • SV-59759
This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Websites should be moved into another zone if permissions need to be changed.
Checks: C-24813r428970_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow only approved domains to use ActiveX controls without prompt' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "120b" is REG_DWORD = 3, this is not a finding.

Fix: F-24801r428971_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow only approved domains to use ActiveX controls without prompt' to 'Enabled', and select 'Enable' from the drop-down box.

b
Cross-Site Scripting Filter property must be enforced (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223141 - SV-223141r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI890-IE11
Vuln IDs
  • V-223141
  • V-46895
Rule IDs
  • SV-223141r879587_rule
  • SV-59761
The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.
Checks: C-24814r428973_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Cross-Site Scripting Filter' must be 'Enabled', and 'Enable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1409" is REG_DWORD = 0, this is not a finding.

Fix: F-24802r428974_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Cross-Site Scripting Filter' to 'Enabled', and select 'Enable' from the drop-down box.

b
Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved).
SC-18 - Medium - CCI-001695 - V-223142 - SV-223142r879573_rule
RMF Control
SC-18
Severity
Medium
CCI
CCI-001695
Version
DTBI900-IE11
Vuln IDs
  • V-223142
  • V-46897
Rule IDs
  • SV-223142r879573_rule
  • SV-59763
Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.
Checks: C-24815r428976_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: If the value "(Reserved)" is REG_SZ = 1, this is not a finding.

Fix: F-24803r428977_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.

b
Status bar updates via script must be disallowed (Internet zone).
CM-7 - Medium - CCI-000381 - V-223143 - SV-223143r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI910-IE11
Vuln IDs
  • V-223143
  • V-46903
Rule IDs
  • SV-223143r879587_rule
  • SV-59769
This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause them to perform an undesirable action. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled.
Checks: C-24816r428979_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Allow updates to status bar via script' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2103" is REG_DWORD = 3, this is not a finding.

Fix: F-24804r428980_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Allow updates to status bar via script' to 'Enabled', and select 'Disable' from the drop-down box.

b
.NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet zone).
CM-6 - Medium - CCI-000366 - V-223144 - SV-223144r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI920-IE11
Vuln IDs
  • V-223144
  • V-46907
Rule IDs
  • SV-223144r879887_rule
  • SV-59773
Unsigned components are more likely to contain malicious code and it is more difficult to determine the author of the application - therefore they should be avoided if possible. This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.
Checks: C-24817r428982_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components not signed with Authenticode' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2004" is REG_DWORD = 3, this is not a finding.

Fix: F-24805r428983_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components not signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.

b
.NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone).
CM-6 - Medium - CCI-000366 - V-223145 - SV-223145r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI930-IE11
Vuln IDs
  • V-223145
  • V-46921
Rule IDs
  • SV-223145r879887_rule
  • SV-59787
It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will not execute signed managed components.
Checks: C-24818r428985_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components signed with Authenticode' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2001" is REG_DWORD = 3, this is not a finding.

Fix: F-24806r428986_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.

b
Scriptlets must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223146 - SV-223146r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI940-IE11
Vuln IDs
  • V-223146
  • V-46927
Rule IDs
  • SV-223146r879587_rule
  • SV-59793
This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.
Checks: C-24819r428988_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow Scriptlets' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1209" is REG_DWORD = 3, this is not a finding.

Fix: F-24807r428989_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow Scriptlets' to 'Enabled', and select 'Disable' from the drop-down box.

b
Status bar updates via script must be disallowed (Restricted Sites zone).
CM-7 - Medium - CCI-000381 - V-223147 - SV-223147r879587_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
DTBI950-IE11
Vuln IDs
  • V-223147
  • V-46939
Rule IDs
  • SV-223147r879587_rule
  • SV-59805
A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled.
Checks: C-24820r428991_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow updates to status bar via script' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2103" is REG_DWORD = 3, this is not a finding.

Fix: F-24808r428992_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow updates to status bar via script' to 'Enabled', and select 'Disable' from the drop-down box.

b
When Enhanced Protected Mode is enabled, ActiveX controls must be disallowed to run in Protected Mode.
CM-6 - Medium - CCI-000366 - V-223148 - SV-223148r879887_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
DTBI985-IE11
Vuln IDs
  • V-223148
  • V-46975
Rule IDs
  • SV-223148r879887_rule
  • SV-59841
This setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Internet Explorer notifies the user and gives the option to run the website in regular Protected Mode. This policy setting disables this notification and forces all websites to run in Enhanced Protected Mode. Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. If you enable this policy setting, Internet Explorer will not give the user the option to disable Enhanced Protected Mode. All Protected Mode websites will run in Enhanced Protected Mode. If you disable or do not configure this policy setting, Internet Explorer notifies users and provides an option to run websites with incompatible ActiveX controls in regular Protected Mode.
Checks: C-24821r428994_chk

Note: If McAfee ENS Web Control is being used, this is Not Applicable. The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page 'Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "DisableEPMCompat" is REG_DWORD = 1, this is not a finding.

Fix: F-24809r428995_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page 'Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled' to 'Enabled'.

b
Dragging of content from different domains across windows must be disallowed (Internet zone).
AC-4 - Medium - CCI-001414 - V-223149 - SV-223149r879534_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-001414
Version
DTBI990-IE11
Vuln IDs
  • V-223149
  • V-46981
Rule IDs
  • SV-223149r879534_rule
  • SV-59847
This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog box.
Checks: C-24822r428997_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains across windows' must be 'Enabled', and 'Disabled' selected from the drop-down box. Procedure: Use the windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2709" is REG_DWORD = 3, this is not a finding.

Fix: F-24810r428998_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains across windows' to 'Enabled', and select 'Disabled' from the drop-down box.

b
Turn off Encryption Support must be enabled.
SC-13 - Medium - CCI-002450 - V-250540 - SV-250540r942484_rule
RMF Control
SC-13
Severity
Medium
CCI
CCI-002450
Version
DTBI014-IE11
Vuln IDs
  • V-250540
  • V-46473
Rule IDs
  • SV-250540r942484_rule
  • SV-59337
This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL. TLS is a protocol for protecting communications between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other's list of supported protocols and versions and pick the most preferred match. Satisfies: SRG-APP-000514, SRG-APP-000555, SRG-APP-000625, SRG-APP-000630, SRG-APP-000635
Checks: C-53975r804976_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Advanced Page >> "Turn off Encryption Support" must be "Enabled". Verify the only option selected is "Only use TLS 1.2" from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!SecureProtocols. Criteria: If the value for "SecureProtocols" is not REG_DWORD = "2048", this is a finding.

Fix: F-53929r804977_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Advanced Page >> "Turn off Encryption Support" to "Enabled". Select only "Only use TLS 1.2" from the drop-down box.

b
Allow Fallback to SSL 3.0 (Internet Explorer) must be disabled.
SC-13 - Medium - CCI-002450 - V-250541 - SV-250541r942485_rule
RMF Control
SC-13
Severity
Medium
CCI
CCI-002450
Version
DTBI1100-IE11
Vuln IDs
  • V-250541
  • V-64729
Rule IDs
  • SV-250541r942485_rule
  • SV-79219
This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by blocking an insecure fallback to SSL when TLS 1.0 or greater fails. Satisfies: SRG-APP-000514, SRG-APP-000555, SRG-APP-000625, SRG-APP-000630, SRG-APP-000635
Checks: C-53976r799947_chk

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> "Allow fallback to SSL 3.0 (Internet Explorer)" must be "Enabled", and "No Sites" selected from the drop-down box. If "Allow fallback to SSL 3.0 (Internet Explorer)" is not "Enabled" or any other drop-down option is selected, this is a finding. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings. Criteria: If the value "EnableSSL3Fallback" is REG_DWORD=0, this is not a finding.

Fix: F-53930r799948_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> "Allow fallback to SSL 3.0 (Internet Explorer)" to "Enabled", and select "No Sites" from the drop-down box.

c
The version of Internet Explorer running on the system must be a supported version.
SI-2 - High - CCI-002605 - V-252910 - SV-252910r942486_rule
RMF Control
SI-2
Severity
High
CCI
CCI-002605
Version
DTBI999-IE11
Vuln IDs
  • V-252910
Rule IDs
  • SV-252910r942486_rule
Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may depend on the Information Assurance Vulnerability Management (IAVM) process.
Checks: C-56363r891306_chk

Internet Explorer 11 is no longer supported on Windows 10 General Availability Channel. If Internet Explorer 11 is installed and enabled on Windows 10 General Availability Channel, this is a finding. If Internet Explorer 11 is installed and enabled on an unsupported OS, this is a finding.

Fix: F-56313r891307_fix

For Windows 10 General Availability Channel, remove or disable the Internet Explorer 11 application. To disable Internet Explorer 11 as a standalone browser, set the policy value for "Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Disable Internet Explorer 11 as a standalone browser" to "Enabled" with the option value set to "Never" or "Once per user".