Microsoft Internet Explorer 11 Security Technical Implementation Guide
Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]
Details
Version / Release: V2R3
Published: 2022-11-14
Updated At: 2023-01-25 00:42:10
Compare/View Releases
Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
Actions
Download
Filter
Findings
| Severity | Open | Not Reviewed | Not Applicable | Not a Finding |
|---|---|---|---|---|
| Overall | 0 | 0 | 0 | 0 |
| Low | 0 | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 | 0 |
| High | 0 | 0 | 0 | 0 |
Drop CKL or SCAP (XCCDF) results here.
| Vuln | Rule | Version | CCI | Severity | Title | Description | Status | Finding Details | Comments |
|---|---|---|---|---|---|---|---|---|---|
| SV-223015r428597_rule | DTBI015-IE11 | CCI-000366 | MEDIUM | The Internet Explorer warning about certificate address mismatch must be enforced. | This parameter warns users if the certificate being presented by the website is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presente | ||||
| SV-223016r428600_rule | DTBI018-IE11 | CCI-000185 | LOW | Check for publishers certificate revocation must be enforced. | Check for publisher's certificate revocation options should be enforced to ensure all PKI signed objects are validated. Satisfies: SRG-APP-000605 | ||||
| SV-223017r428603_rule | DTBI022-IE11 | CCI-001169 | MEDIUM | The Download signed ActiveX controls property must be disallowed (Internet zone). | Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especial | ||||
| SV-223018r428606_rule | DTBI023-IE11 | CCI-001169 | MEDIUM | The Download unsigned ActiveX controls property must be disallowed (Internet zone). | Unsigned code is potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. If you enable this policy setting, users can run unsigned con | ||||
| SV-223019r428609_rule | DTBI024-IE11 | CCI-001170 | MEDIUM | The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone). | ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. Thi | ||||
| SV-223020r428612_rule | DTBI031-IE11 | CCI-000381 | MEDIUM | The Java permissions must be disallowed (Internet zone). | Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options ca | ||||
| SV-223021r428615_rule | DTBI032-IE11 | CCI-001414 | MEDIUM | Accessing data sources across domains must be disallowed (Internet zone). | The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be controlled based upon the site being browsed. This policy setting a | ||||
| SV-223022r428618_rule | DTBI036-IE11 | CCI-000381 | MEDIUM | Functionality to drag and drop or copy and paste files must be disallowed (Internet zone). | Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being acces | ||||
| SV-223023r428621_rule | DTBI038-IE11 | CCI-000381 | MEDIUM | Launching programs and files in IFRAME must be disallowed (Internet zone). | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being | ||||
| SV-223024r428624_rule | DTBI039-IE11 | CCI-001414 | MEDIUM | Navigating windows and frames across different domains must be disallowed (Internet zone). | Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could us | ||||
| SV-223025r428627_rule | DTBI042-IE11 | CCI-001199 | MEDIUM | Userdata persistence must be disallowed (Internet zone). | Userdata persistence must have a level of protection based upon the site being accessed. It is possible for sites hosting malicious content to exploit this feature as part of an attack against visitors browsing the site. This policy setting allows you to | ||||
| SV-223026r428630_rule | DTBI044-IE11 | CCI-000381 | MEDIUM | Clipboard operations via script must be disallowed (Internet zone). | A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible t | ||||
| SV-223027r428633_rule | DTBI046-IE11 | CCI-001184 | MEDIUM | Logon options must be configured to prompt (Internet zone). | Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Win | ||||
| SV-223028r428636_rule | DTBI061-IE11 | CCI-000381 | MEDIUM | Java permissions must be configured with High Safety (Intranet zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions s | ||||
| SV-223029r428639_rule | DTBI062-IE11 | CCI-001662 | MEDIUM | Anti-Malware programs against ActiveX controls must be run for the Intranet zone. | This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program t | ||||
| SV-223030r428642_rule | DTBI091-IE11 | CCI-000381 | MEDIUM | Java permissions must be configured with High Safety (Trusted Sites zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions s | ||||
| SV-223031r428645_rule | DTBI092-IE11 | CCI-001662 | MEDIUM | Anti-Malware programs against ActiveX controls must be run for the Trusted Sites zone. | This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program t | ||||
| SV-223032r428648_rule | DTBI1000-IE11 | CCI-001414 | MEDIUM | Dragging of content from different domains within a window must be disallowed (Internet zone). | This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domai | ||||
| SV-223033r428651_rule | DTBI1005-IE11 | CCI-001414 | MEDIUM | Dragging of content from different domains across windows must be disallowed (Restricted Sites zone). | This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different dom | ||||
| SV-223034r428654_rule | DTBI1010-IE11 | CCI-001695 | MEDIUM | Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer). | Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX cont | ||||
| SV-223035r428657_rule | DTBI1020-IE11 | CCI-001695 | MEDIUM | Internet Explorer Processes Restrict ActiveX Install must be enforced (iexplore). | Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX cont | ||||
| SV-223036r428660_rule | DTBI1025-IE11 | CCI-001414 | MEDIUM | Dragging of content from different domains within a window must be disallowed (Restricted Sites zone). | This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domai | ||||
| SV-223037r428663_rule | DTBI1046-IE11 | CCI-001662 | MEDIUM | Anti-Malware programs against ActiveX controls must be run for the Internet zone. | This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program t | ||||
| SV-223038r428666_rule | DTBI1051-IE11 | CCI-001662 | MEDIUM | Anti-Malware programs against ActiveX controls must be run for the Restricted Sites zone. | This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program t | ||||
| SV-223039r428669_rule | DTBI1060-IE11 | CCI-001242 | MEDIUM | Prevent bypassing SmartScreen Filter warnings must be enabled. | This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the exe | ||||
| SV-223040r428672_rule | DTBI1065-IE11 | CCI-001169 | MEDIUM | Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet must be enabled. | This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the internet. If you enable this policy settin | ||||
| SV-223041r428675_rule | DTBI1070-IE11 | CCI-001170 | MEDIUM | Prevent per-user installation of ActiveX controls must be enabled. | This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis. If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. If you disable or do not configure this policy setting, Active | ||||
| SV-223042r875510_rule | DTBI1075-IE11 | CCI-002470 | MEDIUM | Prevent ignoring certificate errors option must be enabled. | This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as “expired”, “revoked”, or “name mismatch” errors) in Internet Explorer. If you enabl | ||||
| SV-223043r428681_rule | DTBI1080-IE11 | CCI-001242 | MEDIUM | Turn on SmartScreen Filter scan option for the Internet Zone must be enabled. | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen F | ||||
| SV-223044r428684_rule | DTBI1085-IE11 | CCI-001242 | MEDIUM | Turn on SmartScreen Filter scan option for the Restricted Sites Zone must be enabled. | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen F | ||||
| SV-223045r428687_rule | DTBI1090-IE11 | CCI-001170 | MEDIUM | The Initialize and script ActiveX controls not marked as safe must be disallowed (Intranet Zone). | ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. Thi | ||||
| SV-223046r428690_rule | DTBI1095-IE11 | CCI-001170 | MEDIUM | The Initialize and script ActiveX controls not marked as safe must be disallowed (Trusted Sites Zone). | ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. Thi | ||||
| SV-223048r428696_rule | DTBI1105-IE11 | CCI-000381 | MEDIUM | Run once selection for running outdated ActiveX controls must be disabled. | This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malici | ||||
| SV-223049r428699_rule | DTBI1110-IE11 | CCI-000381 | MEDIUM | Enabling outdated ActiveX controls for Internet Explorer must be blocked. | This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malici | ||||
| SV-223050r862999_rule | DTBI1115-IE11 | CCI-000381 | MEDIUM | Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Internet Zone. | This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Restricted Sites security zones. If you enable this policy set | ||||
| SV-223051r428705_rule | DTBI112-IE11 | CCI-001169 | MEDIUM | The Download signed ActiveX controls property must be disallowed (Restricted Sites zone). | ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especiall | ||||
| SV-223052r863001_rule | DTBI1120-IE11 | CCI-000381 | MEDIUM | Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Restricted Sites Zone. | This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Restricted Sites security zones. If you enable this policy set | ||||
| SV-223053r863003_rule | DTBI1125-IE11 | CCI-001169 | MEDIUM | VBScript must not be allowed to run in Internet Explorer (Internet zone). | This policy setting allows the management of whether VBScript can be run on pages from the specified zone in Internet Explorer. By selecting "Enable" in the drop-down box, VBScript can run without user intervention. By selecting "Prompt" in the drop-down | ||||
| SV-223054r428714_rule | DTBI113-IE11 | CCI-001169 | MEDIUM | The Download unsigned ActiveX controls property must be disallowed (Restricted Sites zone). | Unsigned code is potentially harmful, especially when coming from an untrusted zone. ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. They must also be digitally signed. | ||||
| SV-223055r863005_rule | DTBI1130-IE11 | CCI-001169 | MEDIUM | VBScript must not be allowed to run in Internet Explorer (Restricted Sites zone). | This policy setting allows the management of whether VBScript can be run on pages from the specified zone in Internet Explorer. By selecting "Enable" in the drop-down box, VBScript can run without user intervention. By selecting "Prompt" in the drop-down | ||||
| SV-223056r428720_rule | DTBI1135-IE11 | CCI-001312 | LOW | Internet Explorer Development Tools Must Be Disabled. | While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web | ||||
| SV-223057r428723_rule | DTBI114-IE11 | CCI-001170 | MEDIUM | The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone). | ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. | ||||
| SV-223058r428726_rule | DTBI115-IE11 | CCI-000366 | MEDIUM | ActiveX controls and plug-ins must be disallowed (Restricted Sites zone). | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed. If you enable this policy setting, controls and plug-ins can run withou | ||||
| SV-223059r428729_rule | DTBI116-IE11 | CCI-001170 | MEDIUM | ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone). | This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. ActiveX controls not marked as | ||||
| SV-223060r428732_rule | DTBI119-IE11 | CCI-000381 | MEDIUM | File downloads must be disallowed (Restricted Sites zone). | Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from sites that are considered restricted. This policy setting all | ||||
| SV-223061r428735_rule | DTBI121-IE11 | CCI-000381 | MEDIUM | Java permissions must be disallowed (Restricted Sites zone). | Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options ca | ||||
| SV-223062r428738_rule | DTBI122-IE11 | CCI-001414 | MEDIUM | Accessing data sources across domains must be disallowed (Restricted Sites zone). | The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Mi | ||||
| SV-223063r428741_rule | DTBI123-IE11 | CCI-000366 | MEDIUM | The Allow META REFRESH property must be disallowed (Restricted Sites zone). | It is possible that users will unknowingly be redirected to a site hosting malicious content. 'Allow META REFRESH' must have a level of protection based upon the site being browsed. This policy setting allows you to manage whether a user's browser can be | ||||
| SV-223064r428744_rule | DTBI126-IE11 | CCI-000381 | MEDIUM | Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone). | Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the sit | ||||
| SV-223065r428747_rule | DTBI128-IE11 | CCI-000381 | MEDIUM | Launching programs and files in IFRAME must be disallowed (Restricted Sites zone). | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being | ||||
| SV-223066r428750_rule | DTBI129-IE11 | CCI-001414 | MEDIUM | Navigating windows and frames across different domains must be disallowed (Restricted Sites zone). | Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use t | ||||
| SV-223067r428753_rule | DTBI132-IE11 | CCI-001199 | MEDIUM | Userdata persistence must be disallowed (Restricted Sites zone). | Userdata persistence must have a level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in Favorites, in an XML store, or directly within a web page saved | ||||
| SV-223068r428756_rule | DTBI133-IE11 | CCI-000381 | MEDIUM | Active scripting must be disallowed (Restricted Sites Zone). | Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether script code on pages in th | ||||
| SV-223069r428759_rule | DTBI134-IE11 | CCI-000381 | MEDIUM | Clipboard operations via script must be disallowed (Restricted Sites zone). | A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible t | ||||
| SV-223070r428762_rule | DTBI136-IE11 | CCI-001184 | MEDIUM | Logon options must be configured and enforced (Restricted Sites zone). | Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Win | ||||
| SV-223071r428765_rule | DTBI300-IE11 | CCI-000169 | MEDIUM | Configuring History setting must be set to 40 days. | This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, "General" tab, and then click Settings under Browsing H | ||||
| SV-223072r428768_rule | DTBI318-IE11 | CCI-000381 | MEDIUM | Internet Explorer must be set to disallow users to add/delete sites. | This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system. If you do not configure this policy setting, users will | ||||
| SV-223073r428771_rule | DTBI319-IE11 | CCI-000366 | MEDIUM | Internet Explorer must be configured to disallow users to change policies. | Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting prevents users from changing the Internet Expl | ||||
| SV-223074r428774_rule | DTBI320-IE11 | CCI-000366 | MEDIUM | Internet Explorer must be configured to use machine settings. | Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting enforces consistent security zone settings to | ||||
| SV-223075r428777_rule | DTBI325-IE11 | CCI-000366 | MEDIUM | Security checking features must be enforced. | This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this policy setting, the security settings check will not be pe | ||||
| SV-223076r428780_rule | DTBI350-IE11 | CCI-001170 | MEDIUM | Software must be disallowed to run or install with invalid signatures. | Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure unmodified software is downloaded and the user can | ||||
| SV-223077r428783_rule | DTBI356-IE11 | CCI-001084 | MEDIUM | The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on. | This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.Important: Some ActiveX controls | ||||
| SV-223078r428786_rule | DTBI365-IE11 | CCI-000185 | LOW | Checking for server certificate revocation must be enforced. | This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confi | ||||
| SV-223079r428789_rule | DTBI370-IE11 | CCI-001749 | MEDIUM | Checking for signatures on downloaded programs must be enforced. | This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified or tampered with) on user computers before downloading executable pro | ||||
| SV-223080r428792_rule | DTBI375-IE11 | CCI-000366 | MEDIUM | All network paths (UNCs) for Intranet sites must be disallowed. | Some UNC paths could refer to servers not managed by the organization, which means they could host malicious content; and therefore, it is safest to not include all UNC paths in the Intranet Sites zone. This policy setting controls whether URLs representi | ||||
| SV-223081r428795_rule | DTBI385-IE11 | CCI-000381 | MEDIUM | Script-initiated windows without size or position constraints must be disallowed (Internet zone). | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs | ||||
| SV-223082r428798_rule | DTBI390-IE11 | CCI-000381 | MEDIUM | Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone). | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs | ||||
| SV-223083r428801_rule | DTBI395-IE11 | CCI-000381 | MEDIUM | Scriptlets must be disallowed (Internet zone). | This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable | ||||
| SV-223084r428804_rule | DTBI415-IE11 | CCI-000381 | MEDIUM | Automatic prompting for file downloads must be disallowed (Internet zone). | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, a | ||||
| SV-223085r428807_rule | DTBI425-IE11 | CCI-000381 | MEDIUM | Java permissions must be disallowed (Local Machine zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions s | ||||
| SV-223086r428810_rule | DTBI426-IE11 | CCI-001662 | MEDIUM | Anti-Malware programs against ActiveX controls must be run for the Local Machine zone. | This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program t | ||||
| SV-223087r428813_rule | DTBI430-IE11 | CCI-000381 | MEDIUM | Java permissions must be disallowed (Locked Down Local Machine zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions s | ||||
| SV-223088r428816_rule | DTBI435-IE11 | CCI-000381 | MEDIUM | Java permissions must be disallowed (Locked Down Intranet zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions s | ||||
| SV-223089r428819_rule | DTBI440-IE11 | CCI-000381 | MEDIUM | Java permissions must be disallowed (Locked Down Trusted Sites zone). | Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options ca | ||||
| SV-223090r428822_rule | DTBI450-IE11 | CCI-000381 | MEDIUM | Java permissions must be disallowed (Locked Down Restricted Sites zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions s | ||||
| SV-223091r428825_rule | DTBI455-IE11 | CCI-000366 | MEDIUM | XAML files must be disallowed (Internet zone). | These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setti | ||||
| SV-223092r428828_rule | DTBI460-IE11 | CCI-000366 | MEDIUM | XAML files must be disallowed (Restricted Sites zone). | These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setti | ||||
| SV-223093r428831_rule | DTBI485-IE11 | CCI-001084 | MEDIUM | Protected Mode must be enforced (Internet zone). | Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be a | ||||
| SV-223094r428834_rule | DTBI490-IE11 | CCI-001084 | MEDIUM | Protected Mode must be enforced (Restricted Sites zone). | Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be a | ||||
| SV-223095r428837_rule | DTBI495-IE11 | CCI-000381 | MEDIUM | Pop-up Blocker must be enforced (Internet zone). | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. | ||||
| SV-223096r428840_rule | DTBI500-IE11 | CCI-000381 | MEDIUM | Pop-up Blocker must be enforced (Restricted Sites zone). | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. | ||||
| SV-223097r428843_rule | DTBI515-IE11 | CCI-001414 | MEDIUM | Websites in less privileged web content zones must be prevented from navigating into the Internet zone. | This policy setting allows a user to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Internet zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navi | ||||
| SV-223098r428846_rule | DTBI520-IE11 | CCI-001414 | MEDIUM | Websites in less privileged web content zones must be prevented from navigating into the Restricted Sites zone. | This policy setting allows you to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Restricted zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navig | ||||
| SV-223099r428849_rule | DTBI575-IE11 | CCI-000381 | MEDIUM | Allow binary and script behaviors must be disallowed (Restricted Sites zone). | This policy setting allows you to manage dynamic binary and script behaviors of components that encapsulate specific functionality for HTML elements, to which they were attached. If you enable this policy setting, binary and script behaviors are available | ||||
| SV-223100r428852_rule | DTBI580-IE11 | CCI-000381 | MEDIUM | Automatic prompting for file downloads must be disallowed (Restricted Sites zone). | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, a | ||||
| SV-223101r428855_rule | DTBI590-IE11 | CCI-001166 | MEDIUM | Internet Explorer Processes for MIME handling must be enforced. (Reserved) | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Exp | ||||
| SV-223102r428858_rule | DTBI592-IE11 | CCI-001166 | MEDIUM | Internet Explorer Processes for MIME handling must be enforced (Explorer). | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Exp | ||||
| SV-223103r428861_rule | DTBI594-IE11 | CCI-001166 | MEDIUM | Internet Explorer Processes for MIME handling must be enforced (iexplore). | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Exp | ||||
| SV-223104r428864_rule | DTBI595-IE11 | CCI-001166 | MEDIUM | Internet Explorer Processes for MIME sniffing must be enforced (Reserved). | MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent | ||||
| SV-223105r428867_rule | DTBI596-IE11 | CCI-001166 | MEDIUM | Internet Explorer Processes for MIME sniffing must be enforced (Explorer). | MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent | ||||
| SV-223106r428870_rule | DTBI597-IE11 | CCI-001166 | MEDIUM | Internet Explorer Processes for MIME sniffing must be enforced (iexplore). | MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent | ||||
| SV-223107r428873_rule | DTBI599-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for MK protocol must be enforced (Reserved). | The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely u | ||||
| SV-223108r428876_rule | DTBI600-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for MK protocol must be enforced (Explorer). | The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely u | ||||
| SV-223109r428879_rule | DTBI605-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for MK protocol must be enforced (iexplore). | The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely u | ||||
| SV-223110r428882_rule | DTBI610-IE11 | CCI-001084 | MEDIUM | Internet Explorer Processes for Zone Elevation must be enforced (Reserved). | Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and res | ||||
| SV-223111r428885_rule | DTBI612-IE11 | CCI-001084 | MEDIUM | Internet Explorer Processes for Zone Elevation must be enforced (Explorer). | Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and res | ||||
| SV-223112r428888_rule | DTBI614-IE11 | CCI-001084 | MEDIUM | Internet Explorer Processes for Zone Elevation must be enforced (iexplore). | Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and res | ||||
| SV-223113r428891_rule | DTBI630-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for Restrict File Download must be enforced (Reserved). | In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configur | ||||
| SV-223114r428894_rule | DTBI635-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for Restrict File Download must be enforced (Explorer). | In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configur | ||||
| SV-223115r428897_rule | DTBI640-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for Restrict File Download must be enforced (iexplore). | In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configur | ||||
| SV-223116r428900_rule | DTBI645-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved). | Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force the user to interact with a window containing malicious code | ||||
| SV-223117r428903_rule | DTBI647-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer). | Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious cod | ||||
| SV-223118r428906_rule | DTBI649-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for restricting pop-up windows must be enforced (iexplore). | Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious cod | ||||
| SV-223119r428909_rule | DTBI650-IE11 | CCI-000366 | MEDIUM | .NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Sites Zone). | This policy setting allows you to manage whether .NET Framework-reliant components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executable | ||||
| SV-223120r428912_rule | DTBI655-IE11 | CCI-000366 | MEDIUM | .NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Sites Zone). | This policy setting allows you to manage whether .NET Framework-reliant components that are signed with Authenticode can be executed from Internet Explorer. It may be possible for malicious content hosted on a website to take advantage of these components | ||||
| SV-223121r428915_rule | DTBI670-IE11 | CCI-000381 | MEDIUM | Scripting of Java applets must be disallowed (Restricted Sites zone). | This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. If you select "Prompt" in the drop-down box, users are | ||||
| SV-223122r428918_rule | DTBI690-IE11 | CCI-000381 | MEDIUM | AutoComplete feature for forms must be disallowed. | This AutoComplete feature suggests possible matches when users are filling in forms. It is possible that this feature will cache sensitive data and store it in the user's profile, where it might not be protected as rigorously as required by organizational | ||||
| SV-223123r428921_rule | DTBI715-IE11 | CCI-000381 | MEDIUM | Crash Detection management must be enforced. | The 'Turn off Crash Detection' policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. A crash report could contain sensitive information from the computer's memory. If you enable this policy setting, a c | ||||
| SV-223124r428924_rule | DTBI725-IE11 | CCI-000381 | MEDIUM | Turn on the auto-complete feature for user names and passwords on forms must be disabled. | This policy setting controls automatic completion of fields in forms on web pages. It is possible that malware could be developed which would be able to extract the cached user names and passwords from the currently logged on user, which an attacker could | ||||
| SV-223125r428927_rule | DTBI740-IE11 | CCI-001166 | MEDIUM | Managing SmartScreen Filter use must be enforced. | This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection via visiting malicious websites. This policy setting allow | ||||
| SV-223126r428930_rule | DTBI760-IE11 | CCI-000169 | MEDIUM | Browser must retain history on exit. | Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that | ||||
| SV-223127r428933_rule | DTBI770-IE11 | CCI-000169 | MEDIUM | Deleting websites that the user has visited must be disallowed. | This policy prevents users from deleting the history of websites the user has visited. If you enable this policy setting, websites the user has visited will be preserved when the user clicks "Delete". If you disable this policy setting, websites that the | ||||
| SV-223128r428936_rule | DTBI780-IE11 | CCI-000166 | MEDIUM | InPrivate Browsing must be disallowed. | InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method. The InPrivate Browsing feature in Internet Explorer makes browser | ||||
| SV-223129r428939_rule | DTBI800-IE11 | CCI-000381 | MEDIUM | Scripting of Internet Explorer WebBrowser control property must be disallowed (Internet zone). | This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser | ||||
| SV-223130r428942_rule | DTBI810-IE11 | CCI-000381 | MEDIUM | When uploading files to a server, the local directory path must be excluded (Internet zone). | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this | ||||
| SV-223131r428945_rule | DTBI815-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for Notification Bars must be enforced (Reserved). | This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this | ||||
| SV-223132r428948_rule | DTBI820-IE11 | CCI-000366 | MEDIUM | Security Warning for unsafe files must be set to prompt (Internet zone). | This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you ena | ||||
| SV-223133r428951_rule | DTBI825-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for Notification Bars must be enforced (Explorer). | This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this | ||||
| SV-223134r428954_rule | DTBI830-IE11 | CCI-001170 | MEDIUM | ActiveX controls without prompt property must be used in approved domains only (Internet zone). | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could | ||||
| SV-223135r428957_rule | DTBI835-IE11 | CCI-000381 | MEDIUM | Internet Explorer Processes for Notification Bars must be enforced (iexplore). | This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this | ||||
| SV-223136r428960_rule | DTBI840-IE11 | CCI-000381 | MEDIUM | Cross-Site Scripting Filter must be enforced (Internet zone). | The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in th | ||||
| SV-223137r428963_rule | DTBI850-IE11 | CCI-000381 | MEDIUM | Scripting of Internet Explorer WebBrowser Control must be disallowed (Restricted Sites zone). | This policy setting controls whether a page may control embedded WebBrowser Control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser | ||||
| SV-223138r428966_rule | DTBI860-IE11 | CCI-000381 | MEDIUM | When uploading files to a server, the local directory path must be excluded (Restricted Sites zone). | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this | ||||
| SV-223139r428969_rule | DTBI870-IE11 | CCI-000366 | MEDIUM | Security Warning for unsafe files must be disallowed (Restricted Sites zone). | This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you ena | ||||
| SV-223140r428972_rule | DTBI880-IE11 | CCI-001170 | MEDIUM | ActiveX controls without prompt property must be used in approved domains only (Restricted Sites zone). | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could | ||||
| SV-223141r428975_rule | DTBI890-IE11 | CCI-000381 | MEDIUM | Cross-Site Scripting Filter property must be enforced (Restricted Sites zone). | The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in th | ||||
| SV-223142r428978_rule | DTBI900-IE11 | CCI-001695 | MEDIUM | Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved). | Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX cont | ||||
| SV-223143r428981_rule | DTBI910-IE11 | CCI-000381 | MEDIUM | Status bar updates via script must be disallowed (Internet zone). | This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause them to perfo | ||||
| SV-223144r428984_rule | DTBI920-IE11 | CCI-000366 | MEDIUM | .NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet zone). | Unsigned components are more likely to contain malicious code and it is more difficult to determine the author of the application - therefore they should be avoided if possible. This policy setting allows you to manage whether .NET Framework components th | ||||
| SV-223145r428987_rule | DTBI930-IE11 | CCI-000366 | MEDIUM | .NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone). | It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Expl | ||||
| SV-223146r428990_rule | DTBI940-IE11 | CCI-000381 | MEDIUM | Scriptlets must be disallowed (Restricted Sites zone). | This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable | ||||
| SV-223147r428993_rule | DTBI950-IE11 | CCI-000381 | MEDIUM | Status bar updates via script must be disallowed (Restricted Sites zone). | A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage whether script is allowed to update the status bar within | ||||
| SV-223148r428996_rule | DTBI985-IE11 | CCI-000366 | MEDIUM | When Enhanced Protected Mode is enabled, ActiveX controls must be disallowed to run in Protected Mode. | This setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Int | ||||
| SV-223149r428999_rule | DTBI990-IE11 | CCI-001414 | MEDIUM | Dragging of content from different domains across windows must be disallowed (Internet zone). | This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different dom | ||||
| SV-250540r804978_rule | DTBI014-IE11 | CCI-002450 | MEDIUM | Turn off Encryption Support must be enabled. | This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL. TLS is a protocol for protecting communications between the browser and the target server. When | ||||
| SV-250541r799949_rule | DTBI1100-IE11 | CCI-002450 | MEDIUM | Allow Fallback to SSL 3.0 (Internet Explorer) must be disabled. | This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by blocking an insecure fallback to SSL when TLS 1.0 or greater fails. Satisfies: SRG-APP-000514, SRG-APP-000555, SRG-APP-000625, SRG-APP-000630, SRG-A | ||||
| SV-252910r870854_rule | DTBI999-IE11 | CCI-002635 | HIGH | The version of Internet Explorer running on the system must be a supported version. | Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to | ||||