Internet Explorer 9 Security Technical Implementation Guide

The Internet Explorer 9 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]

Details

Version / Release: V1R11

Published: 2014-11-21

Updated At: 2018-09-23 04:57:30

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-40549r1_rule DTBI320 MEDIUM Internet Explorer must be configured to use machine settings. Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and web sites listed in the Restricted Sites zone in the browser. This setting enforces consistent security zone settings to
    SV-40552r1_rule DTBI319 MEDIUM Internet Explorer must be configured to disallow users to change policies. Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and web sites listed in the Restricted Sites zone in the browser. This setting prevents users from changing the Internet Exp
    SV-40553r1_rule DTBI318 MEDIUM Internet Explorer must be set to disallow users to add/delete sites. This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system. If you do not configure this policy setting, users will
    SV-40555r1_rule DTBI367 LOW Internet Explorer must be configured to make Proxy settings per user. This setting controls whether or not the Internet Explorer proxy settings are configured on a per-user or per-machine basis. If you enable this policy, users cannot set user specific proxy settings. They must use the zones created for all users of the com
    SV-6278r3_rule DTBI001 MEDIUM The IE home page is not set to blank or a trusted site. By setting this parameter appropriately, a malicious web site will not be automatically loaded into a browser which may contain mobile code.System AdministratorDCMC-1
    SV-43159r4_rule DTBI014 MEDIUM The IE TLS parameter must be set correctly. This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser. TLS is a protocol for protecting communication between the browser and the target server. When the browser attempts to set up a protected communicati
    SV-43156r1_rule DTBI015 MEDIUM The IE warning about certificate address mismatch must be enforced. This parameter warns users if the certificate being presented by the web site is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being present
    SV-40558r1_rule DTBI022 MEDIUM The Download signed ActiveX controls property must be disallowed (Internet zone). Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especial
    SV-40559r1_rule DTBI023 MEDIUM The Download unsigned ActiveX controls property must be disallowed (Internet zone). Unsigned code is potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. If you enable this policy setting, users can run unsigned con
    SV-40561r1_rule DTBI024 MEDIUM The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone). ActiveX controls that are not marked safe scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This se
    SV-40563r1_rule DTBI030 MEDIUM Font downloads must be disallowed (Internet zone). Download of fonts can sometimes contain malicious code. It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the font. This policy setting allows you to manage whether page
    SV-40565r2_rule DTBI031 MEDIUM The Java Permissions must be disallowed (Internet zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40567r1_rule DTBI032 MEDIUM Accessing data sources across domains must be disallowed (Internet zone). The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be controlled based upon the site being browsed. This policy setting a
    SV-40568r1_rule DTBI036 MEDIUM Functionality to drag and drop or copy and paste files must be disallowed (Internet zone). Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and Drop or copy and paste files must have a level of protection based upon the site being acces
    SV-40572r1_rule DTBI038 MEDIUM Launching programs and files in IFRAME must be disallowed (Internet zone). This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being
    SV-40573r1_rule DTBI039 MEDIUM Navigating windows and frames across different domains must be disallowed (Internet zone). Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a web site hosting malicious content could u
    SV-40577r1_rule DTBI042 MEDIUM Userdata persistence must be disallowed (Internet zone). Userdata persistence must have level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a web page saved to
    SV-40578r1_rule DTBI044 MEDIUM Clipboard operations via script must be disallowed (Internet zone). A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible
    SV-40580r1_rule DTBI046 MEDIUM Logon options must be configured to prompt (Internet zone). Users could submit credentials to servers operated by malicious people who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows
    SV-40582r2_rule DTBI061 MEDIUM Java Permissions must be configured with High Safety (Intranet zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40583r2_rule DTBI091 MEDIUM The Java Permissions must be set with High Safety (Trusted Sites zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40586r1_rule DTBI112 MEDIUM The Download signed ActiveX controls property must be disallowed (Restricted Site zone). ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especial
    SV-40587r1_rule DTBI113 MEDIUM The Download unsigned ActiveX controls property must be disallowed (Restricted Site zone). Unsigned code is potentially harmful, especially when coming from an untrusted zone. ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites and they must be digitally signed.System Administrat
    SV-40588r1_rule DTBI114 MEDIUM The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Site zone). ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.System Admini
    SV-40590r1_rule DTBI115 MEDIUM ActiveX controls and plug-ins must be disallowed (Restricted Sites zone). This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed. If you enable this policy setting, controls and plug-ins can run withou
    SV-40591r1_rule DTBI116 MEDIUM ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone). This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. ActiveX controls not marked a
    SV-40602r1_rule DTBI119 MEDIUM File downloads must be disallowed (Restricted Site zone). Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from sites that are considered restricted. This policy setting al
    SV-40603r1_rule DTBI120 MEDIUM Font downloads must be disallowed (Restricted Site zone). It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the font. Download of fonts can sometimes contain malicious code. Files should not be downloaded from restricted site
    SV-40604r1_rule DTBI122 MEDIUM Accessing data sources across domains must be disallowed (Restricted Sites zone). The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the M
    SV-40606r1_rule DTBI123 MEDIUM The Allow META REFRESH property must be disallowed (Restricted Sites zone). It is possible that users will unknowingly be redirected to a site hosting malicious content. Allow META REFRESH must have level of protection based upon the site being browsed. This policy setting allows you to manage whether a user's browser can be redi
    SV-40608r1_rule DTBI126 MEDIUM Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone). Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the sit
    SV-40609r1_rule DTBI127 MEDIUM Installation of desktop items must be disallowed (Restricted Sites zone). Active Desktop items could contain links to unauthorized websites or other undesirable content. It is prudent to prevent users from installing desktop items from this security zone. Installation of items must have a level of protection based upon the site
    SV-40612r1_rule DTBI128 MEDIUM Launching programs and files in IFRAME must be disallowed (Restricted Sites zone). This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being
    SV-40614r1_rule DTBI129 MEDIUM Navigating windows and frames across different domains must be disallowed (Restricted Sites zone). Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a web site hosting malicious content could use
    SV-40616r1_rule DTBI132 MEDIUM Userdata persistence must be disallowed (Restricted Sites zone). Userdata persistence must have level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a web page saved to
    SV-40617r1_rule DTBI133 MEDIUM Active scripting must be disallowed (Restricted Sites Zone). Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether script code on pages in
    SV-40618r1_rule DTBI134 MEDIUM Clipboard operations via script must be disallowed (Restricted Sites zone). A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible
    SV-40619r1_rule DTBI136 MEDIUM Logon options must be configured and enforced (Restricted Sites zone). Users could submit credentials to servers operated by malicious people who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows
    SV-40620r2_rule DTBI121 MEDIUM Java Permissions must be disallowed (Restricted Sites zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40529r1_rule DTBI697 LOW Ability for users to enable or disable add-ons must be enforced. Users often choose to install add-ons that are not permitted by an organization's security policy. Such add-ons can pose a significant security and privacy risk to your network. This policy setting allows you to manage whether users have the ability to a
    SV-40530r1_rule DTBI305 MEDIUM Automatic configuration of Internet Explorer must be disallowed. This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. This setting specifies that Internet Explorer use the configuration settings provided in a file by the system adminis
    SV-40531r1_rule DTBI315 MEDIUM Participation in the Customer Experience Improvement Program must be disallowed. This setting controls whether users can participate in the Microsoft Customer Experience Improvement Program to help improve Microsoft applications. When users choose to participate in the Customer Experience Improvement Program (CEIP), applications autom
    SV-40547r1_rule DTBI325 MEDIUM Security checking features must be enforced. This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this policy setting, the security settings check will not be pe
    SV-40626r1_rule DTBI340 MEDIUM Active content from CDs must be disallowed to run on user machines. This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run. If you enable this policy setting, active content on a CD will run without a prompt. If you disable this policy setting, activ
    SV-40627r2_rule DTBI350 MEDIUM Software must be disallowed to run or install with invalid signatures. Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure unmodified software is downloaded and the user can
    SV-40628r2_rule DTBI355 MEDIUM Third-party browser extensions must be disallowed. This policy setting allows you to manage whether Internet Explorer will launch COM add-ons, known as browser helper objects such as toolbars. Browser helper objects may contain flaws such as buffer overruns which impact Internet Explorer's performance or
    SV-40629r1_rule DTBI365 MEDIUM Checking for server certificate revocation must be enforced. This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confi
    SV-40630r1_rule DTBI370 MEDIUM Checking for signatures on downloaded programs must be enforced. This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified or tampered with) on user computers before downloading executable pro
    SV-40632r1_rule DTBI375 MEDIUM All network paths (UNCs) for Intranet sites must be disallowed. Some UNC paths could refer to servers not managed by the organization which means they could host malicious content and therefore, it is safest to not include all UNC paths in the Intranet Sites zone. This policy setting controls whether URLs representin
    SV-40633r1_rule DTBI385 MEDIUM Script-initiated windows without size or position constraints must be disallowed (Internet zone). This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs
    SV-40634r1_rule DTBI390 MEDIUM Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone). This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs
    SV-40635r1_rule DTBI395 MEDIUM Scriptlets must be disallowed (Internet zone). This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable
    SV-40636r1_rule DTBI415 MEDIUM Automatic prompting for file downloads must be disallowed (Internet zone). This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, t
    SV-40637r2_rule DTBI425 MEDIUM Java permissions must be disallowed (Local Machine zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40638r2_rule DTBI430 MEDIUM Java permissions must be disallowed (Locked Down Local Machine zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40639r2_rule DTBI435 MEDIUM Java permissions must be disallowed (Locked Down Intranet zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40640r2_rule DTBI440 MEDIUM Java permissions must be disallowed (Locked Down Trusted Sites zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40641r2_rule DTBI445 MEDIUM Java permissions must be disallowed (Locked Down Internet zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40642r2_rule DTBI450 MEDIUM Java permissions must be disallowed (Locked Down Restricted Sites zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be
    SV-40643r1_rule DTBI455 MEDIUM Loose XAML files must be disallowed (Internet zone). These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setti
    SV-40644r1_rule DTBI460 MEDIUM Loose XAML files must be disallowed (Restricted Sites zone). These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setti
    SV-40645r1_rule DTBI465 MEDIUM MIME sniffing must be disallowed (Internet zone). This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. If you enable this policy setting, th
    SV-40647r1_rule DTBI470 MEDIUM MIME sniffing must be disallowed (Restricted Sites zone). This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. If you enable this policy setting, th
    SV-40648r1_rule DTBI475 MEDIUM First-Run Opt-In ability must be disallowed (Internet zone). This policy setting controls the First Run response that users see on a zone-by-zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control. This feature determines if the
    SV-40649r1_rule DTBI480 MEDIUM First-Run Opt-In ability must be disallowed (Restricted Sites zone). This policy setting controls the First Run response that users see on a zone-by-zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control. This feature determines if the
    SV-40652r1_rule DTBI490 MEDIUM Protected Mode must be enforced (Restricted Sites zone). Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be
    SV-40654r1_rule DTBI495 MEDIUM Pop-up Blocker must be enforced (Internet zone). This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.
    SV-40655r1_rule DTBI500 MEDIUM Pop-up Blocker must be enforced (Restricted Sites zone). This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.
    SV-40656r1_rule DTBI515 MEDIUM Web sites in less privileged web content zones must be disallowed to navigate into the Internet zone. This policy setting allows you to manage whether web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. If you enable this policy setting, web sites from less privileged zones can open new windows in, or navigate into
    SV-40657r1_rule DTBI520 MEDIUM Web sites in less privileged web content zones must be disallowed to navigate into the Restricted Site zone. This policy setting allows you to manage whether web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. If you enable this policy setting, web sites from less privileged zones can open new windows in, or navigate into
    SV-40659r1_rule DTBI575 MEDIUM Allow binary and script behaviors must be disallowed (Restricted Sites zone). This policy setting allows you to manage dynamic binary and script behaviors; components that encapsulate specific functionality for HTML elements to which they were attached. If you enable this policy setting, binary and script behaviors are available. I
    SV-40661r1_rule DTBI580 MEDIUM Automatic prompting for file downloads must be disallowed (Restricted Sites zone). This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, t
    SV-40662r1_rule DTBI590 MEDIUM Internet Explorer Processes for MIME handling must be enforced (Reserved). Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Exp
    SV-40663r2_rule DTBI595 MEDIUM Internet Explorer Processes for MIME sniffing must be enforced (Reserved). MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will preven
    SV-40665r1_rule DTBI600 MEDIUM Internet Explorer Processes for MK protocol must be enforced (Explorer). The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely u
    SV-40667r1_rule DTBI605 MEDIUM Internet Explorer Processes for MK protocol must be enforced (IExplore). The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely u
    SV-40671r1_rule DTBI610 MEDIUM Internet Explorer Processes for Zone Elevation must be enforced (Reserved). Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and res
    SV-40672r1_rule DTBI630 MEDIUM Internet Explorer Processes for Restrict File Download must be enforced (Reserved). In certain circumstances, web sites can initiate file download prompts without interaction from users. This technique can allow web sites to put unauthorized files on user's hard drives if they click the wrong button and accept the download. If you config
    SV-40673r1_rule DTBI635 MEDIUM Internet Explorer Processes for Restrict File Download must be enforced (Explorer). In certain circumstances, web sites can initiate file download prompts without interaction from users. This technique can allow web sites to put unauthorized files on user's hard drives if they click the wrong button and accept the download. If you config
    SV-40674r1_rule DTBI640 MEDIUM Internet Explorer Processes for Restrict File Download must be enforced (IExplore). In certain circumstances, web sites can initiate file download prompts without interaction from users. This technique can allow web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you config
    SV-40676r1_rule DTBI645 MEDIUM Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved). Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable web sites will resize windows to either hide other windows or force the user to interact with a window containing malicious cod
    SV-40677r1_rule DTBI650 MEDIUM .NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Site Zone). This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables refere
    SV-40678r1_rule DTBI655 MEDIUM .NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Site Zone). This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced
    SV-40679r2_rule DTBI670 MEDIUM Scripting of Java applets must be disallowed (Restricted Sites zone). This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. If you select Prompt in the drop-down box, users are qu
    SV-40680r1_rule DTBI675 MEDIUM The URL to be displayed for checking updates to Internet Explorer and Internet Tools must be about:blank. This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer. If you enable this policy setting, users will not be able to change the URL to be displayed for checking updates to Int
    SV-40681r1_rule DTBI680 MEDIUM The update check interval must be configured and set to 30 days. Although Microsoft thoroughly tests all patches and service packs before they are published, organizations should carefully control all of the software that is installed on their managed computers. This setting specifies the update check interval, automat
    SV-40682r1_rule DTBI592 MEDIUM Internet Explorer Processes for MIME handling must be enforced (Explorer). Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Exp
    SV-40685r1_rule DTBI594 MEDIUM Internet Explorer Processes for MIME handling must be enforced (IExplore). Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Exp
    SV-40686r1_rule DTBI599 MEDIUM Internet Explorer Processes for MK protocol must be enforced (Reserved). The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely u
    SV-40687r1_rule DTBI612 MEDIUM Internet Explorer Processes for Zone Elevation must be enforced (Explorer). Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and res
    SV-40688r1_rule DTBI614 MEDIUM Internet Explorer Processes for Zone Elevation must be enforced (IExplore). Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and res
    SV-40689r1_rule DTBI647 MEDIUM  Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer). Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable web sites will resize windows to either hide other windows or force a user to interact with a window that contains malicious co
    SV-40690r1_rule DTBI649 MEDIUM Internet Explorer Processes for restricting pop-up windows must be enforced (IExplore). Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable web sites will resize windows to either hide other windows or force a user to interact with a window that contains malicious co
    SV-40691r1_rule DTBI690 MEDIUM AutoComplete feature for forms must be disallowed. This AutoComplete feature suggests possible matches when users are filling in forms. If you enable this setting, the user is not suggested matches when filling forms. The user cannot change it. If you disable this setting, the user is suggested possible m
    SV-40692r1_rule DTBI695 MEDIUM External branding feature of Internet Explorer must be disallowed . Prevents branding of Internet programs, such as customization of Internet Explorer and Outlook Express logos and title bars, by another party. If you enable this policy, it prevents customization of the browser by another party, such as an Internet servic
    SV-40693r1_rule DTBI715 MEDIUM Crash Detection must be enforced. The Turn off Crash Detection policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP
    SV-40694r1_rule DTBI725 MEDIUM AutoComplete feature for user names and passwords on forms must be disallowed. It is possible this feature will cache sensitive data and store it in the user's profile where it might not be protected as rigorously as required by organizational policy. This policy setting controls automatic completion of fields in forms on web pages.
    SV-40695r1_rule DTBI596 MEDIUM Internet Explorer Processes for MIME sniffing must be enforced (Explorer). MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will preven
    SV-40700r1_rule DTBI597 MEDIUM Internet Explorer Processes for MIME sniffing must be enforced (IExplore). MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will preven
    SV-40701r2_rule DTBI010 MEDIUM First Run Customize settings must be enabled as home page. This policy setting prevents performance of the First Run Customize settings ability and provides central management controls of what web page will be provided to the user when they launch Internet Explorer for the first time after installation of Interne
    SV-40702r1_rule DTBI300 MEDIUM Configuring History setting must be set to 40 days. This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, General tab, and then click Settings under Browsing His
    SV-40704r1_rule DTBI740 MEDIUM Managing SmartScreen Filter use must be enforced. This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection via visiting malicious web sites. This policy setting allo
    SV-40706r1_rule DTBI750 LOW Updates to web site lists from Microsoft must be disallowed. This policy controls the web site compatibility lists provided by Microsoft. If you enable this policy setting, the compatibility web site lists provided by Microsoft will be used during browser navigation. If a user visits a site on the compatibility lis
    SV-40707r1_rule DTBI760 MEDIUM Browser must retain history on exit. Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious web sites and files that
    SV-40708r1_rule DTBI770 MEDIUM Deleting web sites that the user has visited must be disallowed. This policy prevents users from deleting the history of web sites the user has visited. If you enable this policy setting, web sites the user has visited will be preserved when the user clicks Delete. If you disable this policy setting, web sites that the
    SV-40711r1_rule DTBI780 MEDIUM InPrivate Browsing must be disallowed. InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method. The InPrivate Browsing feature in Internet Explorer makes browser
    SV-40712r1_rule DTBI800 MEDIUM Scripting of Internet Explorer web browser control property must be disallowed (Internet zone). This policy setting controls whether a page may control embedded WebBrowser Controls via script. Scripted code hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, script access to the WebBrows
    SV-40729r1_rule DTBI810 MEDIUM When uploading files to a server, the local directory path must be excluded (Internet zone). This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this
    SV-40732r1_rule DTBI820 MEDIUM Launching programs and unsafe files property must be set to prompt (Internet zone). This policy setting controls whether or not the “Open File – Security Warning” prompt is shown when launching executables or other unsafe files. If you do not configure this policy setting, users can configure the prompt behavior. By default, execut
    SV-40734r1_rule DTBI830 MEDIUM ActiveX controls without prompt property must be used in approved domains only (Internet zone). This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on web sites other than the web site that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls cou
    SV-40735r1_rule DTBI840 MEDIUM Cross-Site Scripting (XSS) Filter must be enforced (Internet zone). The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into web site
    SV-40736r1_rule DTBI850 MEDIUM Scripting of Internet Explorer Web Browser Control must be disallowed (Restricted Sites zone). This policy setting controls whether a page may control embedded WebBrowser Controls via script. Scripted code hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, script access to the WebBrows
    SV-40737r1_rule DTBI860 MEDIUM When uploading files to a server, the local directory path must be excluded (Restricted Sites zone). This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this
    SV-40738r1_rule DTBI870 MEDIUM Launching programs and unsafe files property must be set to prompt (Restricted Site zone). This policy setting controls whether or not the “Open File – Security Warning” prompt is shown when launching executables or other unsafe files. If you do not configure this policy setting, users can configure the prompt behavior. By default, execut
    SV-40739r1_rule DTBI880 MEDIUM ActiveX controls without prompt property must be used in approved domains only (Restricted Site zone). This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on web sites other than the web site that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls cou
    SV-40740r1_rule DTBI890 MEDIUM Cross-Site Scripting (XSS) Filter property must be enforced (Restricted Site zone). The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into web site
    SV-40741r1_rule DTBI900 MEDIUM Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved). Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX co
    SV-40742r1_rule DTBI910 MEDIUM Status bar updates via script must be disallowed (Internet zone). This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause them to perfo
    SV-40743r1_rule DTBI920 MEDIUM .NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet Zone). Unsigned components may have a greater chance of including malicious code and it is more difficult to determine the author of the application, therefore they should be avoided if possible. This policy setting allows you to manage whether .NET Framework co
    SV-40744r1_rule DTBI930 MEDIUM .NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet Zone). It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Expl
    SV-40745r1_rule DTBI940 MEDIUM Scriptlets must be disallowed (Restricted Site zone). This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable
    SV-40747r1_rule DTBI950 MEDIUM Status bar updates via script must be disallowed (Restricted Site zone). A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage whether script is allowed to update the status bar within
    SV-40748r1_rule DTBI1010 MEDIUM Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer). Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX co
    SV-40750r1_rule DTBI1020 MEDIUM Internet Explorer Processes Restrict ActiveX Install must be enforced (IExplore). Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX co
    SV-40754r1_rule DTBI745 MEDIUM Add-on performance notifications must be disallowed. This policy setting prevents Internet Explorer from displaying a notification when the average time it takes to load all the user's enabled add-ons exceeds the threshold. The notification informs the user that add-ons are slowing their browsing and displ
    SV-40757r1_rule DTBI755 MEDIUM Browser Geolocation functionality must be disallowed. This setting has a small impact on user privacy because users may unknowingly allow their browser to share location data with web sites that they visit. The value of enabling this setting is diminished due to the fact that malicious web sites can learn a
    SV-40759r1_rule DTBI765 MEDIUM Suggested Sites functionality must be disallowed. This policy setting controls the Suggested Sites feature, which recommends sites based on the user's browsing activity. Suggested Sites reports a user's browsing history to Microsoft to store and monitor user page activity to suggest sites the user might
    SV-40762r1_rule DTBI775 MEDIUM Automatic checking for Internet Explorer updates must be disallowed. This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they becom
    SV-40764r1_rule DTBI805 MEDIUM ActiveX opt-in prompt must be disallowed. This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents Web sites from loading any COM object without prior approval. If a page attempts to load a COM object that Internet Explorer has not used before, an Informa
    SV-40766r1_rule DTBI815 MEDIUM Internet Explorer Processes for notification bars must be enforced (Reserved). This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable th
    SV-40768r1_rule DTBI825 MEDIUM Internet Explorer Processes for notification bars must be enforced (Explorer). This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable th
    SV-40770r1_rule DTBI835 MEDIUM Internet Explorer Processes for notification bars must be enforced (IExplore). This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this
    SV-43163r2_rule DTBI018 MEDIUM Check for publishers certificate revocation must be enforced. Check for publisher's certificate revocation options should be enforced to ensure all PKI signed objects are validated.System AdministratorECSC-1