Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Microsoft IE Version 7

V4R14 · · · Released 25 Jul 2014 · 122 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

Sort by
b
Internet Explorer is not configured to require consistent security zone settings to all users.
Medium - V-3427 - SV-28784r1_rule
RMF Control
Severity
M
CCI
Version
DTBI320
Vuln IDs
  • V-3427
Rule IDs
  • SV-28784r1_rule
This setting enforces consistent security zone settings to all users of the computer. Security Zones control browser behavior at various web sites and it is desirable to maintain a consistent policy for all users of a machine.HKSystem AdministratorECSC-1
Checks: C-1745r1_chk

If the following registry value doesn’t exist or is not configured as specified this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ Value Name: Security_HKLM_only Type: REG_DWORD Value: 1

Fix: F-5909r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Security Zones: Use only machine settings” to “Enabled”.

b
Internet Explorer is configured to Allow Users to Change Policies.
Medium - V-3428 - SV-28782r1_rule
RMF Control
Severity
M
CCI
Version
DTBI319
Vuln IDs
  • V-3428
Rule IDs
  • SV-28782r1_rule
This setting prevents users from changing the Internet Explorer policies on the machine. Policy changes should be made by Administrators only, so this setting should be Enabled.HKSystem AdministratorECSC-1
Checks: C-1746r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ Value Name: Security_Options_Edit Type: REG_DWORD Value: 1

Fix: F-5910r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Security Zones: Do Not Allow Users to Change Policies” to “Enabled”.

b
Internet Explorer is configured to Allow Users to Add/Delete Sites.
Medium - V-3429 - SV-28780r1_rule
RMF Control
Severity
M
CCI
Version
DTBI318
Vuln IDs
  • V-3429
Rule IDs
  • SV-28780r1_rule
This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system.HKSystem AdministratorECSC-1
Checks: C-1748r1_chk

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ Value Name: Security_Zones_Map_Edit Type: REG_DWORD Value: 1

Fix: F-5911r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Security Zones: Do Not Allow Users to Add/Delete Sites” to “Enabled”.

a
Internet Explorer is not configured to disable making Proxy Settings Per Machine.
Low - V-3430 - SV-3430r1_rule
RMF Control
Severity
L
CCI
Version
DTBI367
Vuln IDs
  • V-3430
Rule IDs
  • SV-3430r1_rule
This setting controls whether or not the Internet Explorer proxy settings are configured on a per-user or per-machine basis.System AdministratorECSC-1
Checks: C-1749r1_chk

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Make proxy settings per-machine (rather than per user)” to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ Criteria: If the value ProxySettingsPerUser is REG_DWORD = 1, this is not a finding.

Fix: F-5912r1_fix

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Make proxy settings per-machine (rather than per user)” to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ Criteria: Set the value ProxySettingsPerUser to REG_DWORD = 1.

b
The IE home page is not set to blank or a trusted site.
Medium - V-6228 - SV-6278r3_rule
RMF Control
Severity
M
CCI
Version
DTBI001
Vuln IDs
  • V-6228
Rule IDs
  • SV-6278r3_rule
By setting this parameter appropriately, a malicious web site will not be automatically loaded into a browser which may contain mobile code.System AdministratorDCMC-1
Checks: C-170r2_chk

Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Microsoft\Internet Explorer\Main Criteria: If the value Start Page is about:blank or a trusted site this is not a finding.

Fix: F-131r2_fix

Change Start Page value to about:blank or a trusted site.

b
The IE SSL/TLS parameter must be set correctly.
Medium - V-6238 - SV-43157r2_rule
RMF Control
Severity
M
CCI
Version
DTBI014
Vuln IDs
  • V-6238
Rule IDs
  • SV-43157r2_rule
This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser. TLS and SSL are protocols for protecting communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other’s list of supported protocols and versions and pick the most preferred match. System AdministratorECSC-1
Checks: C-41145r5_chk

Open Internet Explorer. From the menu bar, select Tools. From the Tools drop-down menu, select Internet Options. From the Internet Options window, select the Advanced tab, from the Advanced tab window scroll down to the Security category. Verify a check mark is placed in 'Use SSL 3.0' and 'Use TLS 1.0' check boxes. Check marks can also be placed in 'Use TLS 1.1' and/or 'Use TLS 1.2'. If so, this is acceptable and not a finding. Verify there is not a check placed in the check box for 'Use SSL 2.0'. If 'Use SSL 2.0' is checked, then this is a finding.

Fix: F-36693r5_fix

Open Internet Explorer. From the menu bar, select Tools. From the Tools drop-down menu, select Internet Options. From the Internet Options window, select the Advanced tab, from the Advanced tab window scroll down to the Security category. Place a check mark in 'Use SSL 3.0' and 'Use TLS 1.0' check boxes. Check marks can also be placed in 'Use TLS 1.1' and/or 'Use TLS 1.2'. Uncheck 'Use SSL 2.0' option.

b
The IE warning about certificate address mismatch must be enforced.
Medium - V-6239 - SV-43154r1_rule
RMF Control
Severity
M
CCI
Version
DTBI015
Vuln IDs
  • V-6239
Rule IDs
  • SV-43154r1_rule
This parameter warns users if the certificate being presented by the web site is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presented by the web server. This setting aids to prevent spoofing attacks.System AdministratorECSC-1
Checks: C-41142r2_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page "Turn on Warn about Certificate Address Mismatch" must be "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value WarnOnBadCertRecving is REG_DWORD = 1, this is not a finding.

Fix: F-36690r2_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page "Turn on Warn about Certificate Address Mismatch" to "Enabled".

b
Download signed ActiveX controls for internet zone is not disabled.
Medium - V-6243 - SV-16439r1_rule
RMF Control
Severity
M
CCI
Version
DTBI022
Vuln IDs
  • V-6243
Rule IDs
  • SV-16439r1_rule
This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded. If you disable the policy setting, signed controls cannot be downloaded. If you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.System AdministratorDCMC-1
Checks: C-14666r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Download signed ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1001 is REG_DWORD = 3, this is not a finding.

Fix: F-15227r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Download signed ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1001 to REG_DWORD = 3.

b
Download unsigned ActiveX controls for internet zone is not disabled.
Medium - V-6244 - SV-16441r1_rule
RMF Control
Severity
M
CCI
Version
DTBI023
Vuln IDs
  • V-6244
Rule IDs
  • SV-16441r1_rule
Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites and they must be digitally signed. System AdministratorDCMC-1
Checks: C-14671r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Download unsigned ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1004 is REG_DWORD = 3, this is not a finding.

Fix: F-15229r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Download unsigned ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1004 to REG_DWORD = 3.

b
Initialize and script ActiveX controls not marked as safe for internet zone is not disabled.
Medium - V-6245 - SV-16443r1_rule
RMF Control
Severity
M
CCI
Version
DTBI024
Vuln IDs
  • V-6245
Rule IDs
  • SV-16443r1_rule
This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. System AdministratorDCMC-1
Checks: C-14676r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Initialize and script ActiveX controls not marked as safe" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1201 is REG_DWORD = 3, this is not a finding.

Fix: F-15231r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Initialize and script ActiveX controls not marked as safe" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1201 to REG_DWORD = 3.

b
Allow font downloads for internet zone is not disabled.
Medium - V-6248 - SV-16435r1_rule
RMF Control
Severity
M
CCI
Version
DTBI030
Vuln IDs
  • V-6248
Rule IDs
  • SV-16435r1_rule
Download of fonts can sometimes contain malicious code. System AdministratorDCMC-1
Checks: C-14648r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow font downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1604 is REG_DWORD = 3, this is not a finding.

Fix: F-15223r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow font downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1604 to REG_DWORD = 3.

b
Java permissions for internet zone are not disabled.
Medium - V-6249 - SV-16447r1_rule
RMF Control
Severity
M
CCI
Version
DTBI031
Vuln IDs
  • V-6249
Rule IDs
  • SV-16447r1_rule
Java must have level of protections based upon the site being browsed.System AdministratorDCMC-1
Checks: C-14686r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.

Fix: F-15235r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1C00 to REG_DWORD = 0.

b
Access data sources across domains are not disabled.
Medium - V-6250 - SV-16283r1_rule
RMF Control
Severity
M
CCI
Version
DTBI032
Vuln IDs
  • V-6250
Rule IDs
  • SV-16283r1_rule
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone. If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.System AdministratorDCMC-1
Checks: C-14469r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Access data sources across domains" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1406 is REG_DWORD = 3, this is not a finding.

Fix: F-15112r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Access data sources across domains" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria:Set the value 1406 to REG_DWORD = 3.

b
The Allow drag and drop or copy and paste files for internet zone are not disabled.
Medium - V-6253 - SV-16433r1_rule
RMF Control
Severity
M
CCI
Version
DTBI036
Vuln IDs
  • V-6253
Rule IDs
  • SV-16433r1_rule
Drag and Drop of files must have level of protection based upon the site being accessed.System AdministratorECSC-1
Checks: C-14646r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow drag and drop or copy and paste files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value for 1802 is REG_DWORD = 3, this is not a finding.

Fix: F-15221r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow drag and drop or copy and paste files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1802 to REG_DWORD = 3.

b
Allow installation of desktop items for internet zone is not disabled.
Medium - V-6254 - SV-16437r1_rule
RMF Control
Severity
M
CCI
Version
DTBI037
Vuln IDs
  • V-6254
Rule IDs
  • SV-16437r1_rule
Installation of items must have level of protection based upon the site being accessed.System AdministratorDCMC-1
Checks: C-14650r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow installation of desktop items" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1800 is REG_DWORD = 3, this is not a finding.

Fix: F-15225r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow installation of desktop items" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1800 to REG_DWORD = 3.

b
Launching applications and files in an IFRAME for internet zone is not disabled.
Medium - V-6255 - SV-16449r1_rule
RMF Control
Severity
M
CCI
Version
DTBI038
Vuln IDs
  • V-6255
Rule IDs
  • SV-16449r1_rule
Launching of programs in IFRAME must have level of protection based upon the site being accessed.System AdministratorDCMC-1
Checks: C-14688r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Launching applications and files in an IFRAME" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1804 is REG_DWORD = 3, this is not a finding.

Fix: F-15237r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Launching applications and files in an IFRAME" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1804 to REG_DWORD = 3.

b
Navigate sub-frames across different domains for internet zone are not disabled.
Medium - V-6256 - SV-16453r1_rule
RMF Control
Severity
M
CCI
Version
DTBI039
Vuln IDs
  • V-6256
Rule IDs
  • SV-16453r1_rule
Frames that navigate across different domains are a security concern because the user may think they are accessing pages on one site while they are actually accessing pages on another site.System AdministratorECSC-1
Checks: C-14692r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Navigate sub-frames across different domains" will be set to “Enabled" and then select "Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1607 is REG_DWORD = 3, this is not a finding.

Fix: F-15241r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Navigate sub-frames across different domains" will be set to "Enabled“ and then select "Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1607 to REG_DWORD = 3.

b
Software channel permissions for internet zone are not disabled.
Medium - V-6257 - SV-16455r1_rule
RMF Control
Severity
M
CCI
Version
DTBI040
Vuln IDs
  • V-6257
Rule IDs
  • SV-16455r1_rule
Software Channel permissions must have level of protection based upon the site being accessed.System AdministratorDCMC-1
Checks: C-14694r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Software channel permissions" will be set to “Enabled” and "High Safety" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1E05 is REG_DWORD = 65536, (Decimal), this is not a finding.

Fix: F-5716r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Software channel permissions" will be set to “Enabled” and "High Safety" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1E05 to REG_DWORD = 65536, (Decimal).

b
Userdata persistence for internet zone is not disabled.
Medium - V-6259 - SV-16457r1_rule
RMF Control
Severity
M
CCI
Version
DTBI042
Vuln IDs
  • V-6259
Rule IDs
  • SV-16457r1_rule
Userdata persistence must have level of protection based upon the site being accessed.System AdministratorECSC-1
Checks: C-14696r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Userdata persistence" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1606 is REG_DWORD = 3, this is not a finding.

Fix: F-15244r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Userdata persistence" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1606 to REG_DWORD = 3.

b
Allow cut, copy or paste operations from the clipboard via script are not disabled for internet zone.
Medium - V-6260 - SV-16431r1_rule
RMF Control
Severity
M
CCI
Version
DTBI044
Vuln IDs
  • V-6260
Rule IDs
  • SV-16431r1_rule
This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation. If you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations. If you disable this policy setting, a script cannot perform a clipboard operation. If you do not configure this policy setting, a script can perform a clipboard operation. System AdministratorECSC-1
Checks: C-14644r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow cut, copy or paste operations from the clipboard via script" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1407 is REG_DWORD = 3, this is not a finding.

Fix: F-15219r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow cut, copy or paste operations from the clipboard via script" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1407 to REG_DWORD = 3.

b
Logon options for internet zone are not enabled.
Medium - V-6262 - SV-16451r1_rule
RMF Control
Severity
M
CCI
Version
DTBI046
Vuln IDs
  • V-6262
Rule IDs
  • SV-16451r1_rule
Care must be taken with user credentials and how automatic logons are performed and how default Windows credentials are passed to web sites.System AdministratorECSC-1
Checks: C-14690r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Logon options" will be set to “Enabled” and "Prompt for user name and password" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1A00 is REG_DWORD = 65536 (decimal), this is not a finding.

Fix: F-15239r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Logon options" will be set to “Enabled” and "Prompt for user name and password" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1A00 to REG_DWORD = 65536 (decimal).

b
Java permissions for local intranet zone are not disabled.
Medium - V-6267 - SV-16445r1_rule
RMF Control
Severity
M
CCI
Version
DTBI061
Vuln IDs
  • V-6267
Rule IDs
  • SV-16445r1_rule
Java must have level of protection based upon the site being browsed. System AdministratorDCMC-1
Checks: C-14684r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> "Java permissions" will be set to “Enabled” and "High Safety" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Criteria: If the value 1C00 is REG_DWORD = 65536, (Decimal), this is not a finding.

Fix: F-15233r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> "Java permissions" will be set to “Enabled” and "High Safety" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Criteria: Set the value 1C00 to REG_DWORD = 65536, (Decimal).

b
Java permissions for trusted sites zone are not disabled.
Medium - V-6281 - SV-16446r1_rule
RMF Control
Severity
M
CCI
Version
DTBI091
Vuln IDs
  • V-6281
Rule IDs
  • SV-16446r1_rule
Java must have level of protection based upon the site being browsed.System AdministratorDCMC-1
Checks: C-14685r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> "Java permissions" will be set to “Enabled” and "High Safety" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Criteria: If the value 1C00 is REG_DWORD = 65536, (Decimal), this is not a finding.

Fix: F-15234r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> "Java permissions" will be set to “Enabled” and "High Safety" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Criteria: Set the value 1C00 to REG_DWORD = 65536, (Decimal).

b
Download signed ActiveX controls for restricted sites zone is not disabled.
Medium - V-6289 - SV-16440r1_rule
RMF Control
Severity
M
CCI
Version
DTBI112
Vuln IDs
  • V-6289
Rule IDs
  • SV-16440r1_rule
ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites.System AdministratorDCMC-1
Checks: C-14668r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Download signed ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1001 is REG_DWORD = 3, this is not a finding.

Fix: F-15228r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Download signed ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1001 to REG_DWORD = 3.

b
Download unsigned ActiveX controls for restricted sites zone is not disabled.
Medium - V-6290 - SV-16442r1_rule
RMF Control
Severity
M
CCI
Version
DTBI113
Vuln IDs
  • V-6290
Rule IDs
  • SV-16442r1_rule
ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites and they must be digitally signed.System AdministratorDCMC-1
Checks: C-14673r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Download unsigned ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1004 is REG_DWORD = 3, this is not a finding.

Fix: F-15230r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Download unsigned ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1004 to REG_DWORD = 3.

b
Initialize and script ActiveX controls not marked as safe for restricted sites zone is not disabled.
Medium - V-6291 - SV-16444r1_rule
RMF Control
Severity
M
CCI
Version
DTBI114
Vuln IDs
  • V-6291
Rule IDs
  • SV-16444r1_rule
ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.System AdministratorDCMC-1
Checks: C-14680r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Initialize and script ActiveX controls not marked as safe" will be set to “Enabled” and "Disable" selected from down drop box. Procedures: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1201 is REG_DWORD = 3, this is not a finding.

Fix: F-15232r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Initialize and script ActiveX controls not marked as safe" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1201 to REG_DWORD = 3.

b
Run ActiveX controls and plugins are not disabled..
Medium - V-6292 - SV-16464r1_rule
RMF Control
Severity
M
CCI
Version
DTBI115
Vuln IDs
  • V-6292
Rule IDs
  • SV-16464r1_rule
ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.System AdministratorDCMC-1
Checks: C-14703r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run ActiveX controls and plugins" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1200 is REG_DWORD = 3, this is not a finding.

Fix: F-15251r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run ActiveX controls and plugins" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1200 to REG_DWORD = 3.

b
Script ActiveX controls marked safe for scripting is not disabled.
Medium - V-6293 - SV-16465r1_rule
RMF Control
Severity
M
CCI
Version
DTBI116
Vuln IDs
  • V-6293
Rule IDs
  • SV-16465r1_rule
ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.System AdministratorDCMC-1
Checks: C-14704r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Script ActiveX controls marked safe for scripting" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1405 is REG_DWORD = 3, this is not a finding.

Fix: F-15252r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Script ActiveX controls marked safe for scripting" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1405 to REG_DWORD = 3.

b
Allow file downloads are not disabled.
Medium - V-6294 - SV-16462r1_rule
RMF Control
Severity
M
CCI
Version
DTBI119
Vuln IDs
  • V-6294
Rule IDs
  • SV-16462r1_rule
Files should not be able to be downloaded from sites that are considered restricted.System AdministratorDCMC-1
Checks: C-14701r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow file downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1803 is REG_DWORD = 3, this is not a finding.

Fix: F-15249r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow file downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1803 to REG_DWORD = 3.

b
Allow font downloads for restricted sites zone is not disabled.
Medium - V-6295 - SV-16436r1_rule
RMF Control
Severity
M
CCI
Version
DTBI120
Vuln IDs
  • V-6295
Rule IDs
  • SV-16436r1_rule
Download of fonts can sometimes contain malicious code. Files should not be downloaded from restricted sites.System AdministratorDCMC-1
Checks: C-14649r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow font downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1604 is REG_DWORD = 3, this is not a finding.

Fix: F-15224r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow font downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1604 to REG_DWORD = 3.

b
Access data sources across domains restricted sites zones are not disabled.
Medium - V-6297 - SV-16430r1_rule
RMF Control
Severity
M
CCI
Version
DTBI122
Vuln IDs
  • V-6297
Rule IDs
  • SV-16430r1_rule
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone. If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.System AdministratorDCMC-1
Checks: C-14643r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Access data sources across domains" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1406 is REG_DWORD = 3, this is not a finding.

Fix: F-15218r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Access data sources across domains" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1406 to REG_DWORD = 3.

b
Allow META REFRESH is not disabled.
Medium - V-6298 - SV-16463r1_rule
RMF Control
Severity
M
CCI
Version
DTBI123
Vuln IDs
  • V-6298
Rule IDs
  • SV-16463r1_rule
Allow META REFRESH must have level of protection based upon the site being browsed.System AdministratorDCMC-1
Checks: C-14702r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow META REFRESH" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1608 is REG_DWORD = 3, this is not a finding.

Fix: F-15250r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow META REFRESH" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1608 to REG_DWORD = 3.

b
Allow drag and drop or copy and paste files for restricted sites zone are not disabled.
Medium - V-6301 - SV-16434r1_rule
RMF Control
Severity
M
CCI
Version
DTBI126
Vuln IDs
  • V-6301
Rule IDs
  • SV-16434r1_rule
Drag and Drop of files must have level of protection based upon the site being accessed.System AdministratorECSC-1
Checks: C-14647r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow drag and drop or copy and paste files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1802 is REG_DWORD = 3, this is not a finding.

Fix: F-15222r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow drag and drop or copy and paste files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1802 to REG_DWORD = 3.

b
Allow installation of desktop items for restricted sites zone is not disabled.
Medium - V-6302 - SV-16438r1_rule
RMF Control
Severity
M
CCI
Version
DTBI127
Vuln IDs
  • V-6302
Rule IDs
  • SV-16438r1_rule
Installation of items must have level of protection based upon the site being accessed. System AdministratorDCMC-1
Checks: C-14653r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow installation of desktop items" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1800 is REG_DWORD = 3, this is not a finding.

Fix: F-15226r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow installation of desktop items" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1800 to REG_DWORD = 3.

b
Launching applications and files in an IFRAME is not disabled.
Medium - V-6303 - SV-16450r1_rule
RMF Control
Severity
M
CCI
Version
DTBI128
Vuln IDs
  • V-6303
Rule IDs
  • SV-16450r1_rule
Launching of programs in IFRAME must have level of protection based upon the site being accessed.System AdministratorDCMC-1
Checks: C-14689r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Launching applications and files in an IFRAME" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1804 is REG_DWORD = 3, this is not a finding.

Fix: F-15238r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Launching applications and files in an IFRAME" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1804 to REG_DWORD = 3.

b
Navigate sub-frames across different domains for restricted sites zone are not disabled.
Medium - V-6304 - SV-16454r1_rule
RMF Control
Severity
M
CCI
Version
DTBI129
Vuln IDs
  • V-6304
Rule IDs
  • SV-16454r1_rule
Frames that navigate across different domains are a security concern because the user may think they are accessing pages on one site while they are actually accessing pages on another site. System AdministratorECSC-1
Checks: C-14693r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Navigate sub-frames across different domains" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1607 is REG_DWORD = 3, this is not a finding.

Fix: F-15242r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Navigate sub-frames across different domains" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1607 to REG_DWORD = 3.

b
Software channel permissions for restricted sites zone are not disabled.
Medium - V-6305 - SV-16456r1_rule
RMF Control
Severity
M
CCI
Version
DTBI130
Vuln IDs
  • V-6305
Rule IDs
  • SV-16456r1_rule
Software channel permissions must have level of protection based upon the site being accessed.System AdministratorDCMC-1
Checks: C-14695r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Software channel permissions" will be set to “Enabled” and "High Safety" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1E05 is REG_DWORD = 65536 (decimal), this is not a finding.

Fix: F-15243r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Software channel permissions" will be set to “Enabled” and "High Safety" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1E05 to REG_DWORD = 65536 (decimal).

b
Userdata persistence for restricted sites zone is not disabled.
Medium - V-6307 - SV-16458r1_rule
RMF Control
Severity
M
CCI
Version
DTBI132
Vuln IDs
  • V-6307
Rule IDs
  • SV-16458r1_rule
No perseistant data should exist and be used in the Restricted sites zone. System AdministratorECSC-1
Checks: C-14697r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Userdata persistence" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1606 is REG_DWORD = 3, this is not a finding.

Fix: F-15245r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Userdata persistence" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1606 to REG_DWORD = 3.

b
Allow active scripting is not disabled.
Medium - V-6308 - SV-16461r1_rule
RMF Control
Severity
M
CCI
Version
DTBI133
Vuln IDs
  • V-6308
Rule IDs
  • SV-16461r1_rule
Active Scripting must have level of protection based upon the site being accessed.System AdministratorDCMC-1
Checks: C-14700r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow active scripting" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1400 is REG_DWORD = 3, this is not a finding.

Fix: F-15248r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow active scripting" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1400 to REG_DWORD = 3.

b
Allow cut, copy or paste operations from the clipboard via script are not disabled for restricted sites zone.
Medium - V-6309 - SV-16432r1_rule
RMF Control
Severity
M
CCI
Version
DTBI134
Vuln IDs
  • V-6309
Rule IDs
  • SV-16432r1_rule
The Allow paste operations via script must have level of protection based upon the site being browsed.System AdministratorECSC-1
Checks: C-14645r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow cut, copy or paste operations from the clipboard via script" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1407 is REG_DWORD = 3, this is not a finding.

Fix: F-15220r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow cut, copy or paste operations from the clipboard via script" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1407 to REG_DWORD = 3.

b
Logon options for restricted sites zones are not enabled.
Medium - V-6311 - SV-16452r1_rule
RMF Control
Severity
M
CCI
Version
DTBI136
Vuln IDs
  • V-6311
Rule IDs
  • SV-16452r1_rule
Care must be taken with user credentials and how automatic logons are performed and how default Windows credentials are passed to web sites. System AdministratorECSC-1
Checks: C-14691r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Logon options" will be set to “Enabled” and "Anonymous logon" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1A00 is REG_DWORD = 196608 (decimal), this is not a finding.

Fix: F-15240r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Logon options" will be set to “Enabled” and "Anonymous logon" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1A00 to REG_DWORD = 196608 (decimal).

b
Java permissions for restricted sites zone are not disabled.
Medium - V-7007 - SV-16448r1_rule
RMF Control
Severity
M
CCI
Version
DTBI121
Vuln IDs
  • V-7007
Rule IDs
  • SV-16448r1_rule
Java must have level of protection based upon the site being browsed.System AdministratorDCMC-1
Checks: C-14687r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.

Fix: F-15236r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1C00 to REG_DWORD = 0.

a
Internet Explorer - Do not allow users to enable or disable add-ons.
Low - V-14245 - SV-14856r1_rule
RMF Control
Severity
L
CCI
Version
DTBI697
Vuln IDs
  • V-14245
Rule IDs
  • SV-14856r1_rule
This check verifies that the system is configured to allow users to enable or disable add-ons through Add-On Manager in Internet Explorer.System AdministratorECSC-1
Checks: C-11590r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Do Not Allow Users to enable or Disable Add-Ons” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria: If the value NoExtensionManagement “does not” exist or the value is set to REG_DWORD = 0, this is not a finding. If the value NoExtensionManagement “does” exist and is set to REG_DWORD = 1 (decimal), this is a finding.

Fix: F-13570r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Do Not Allow Users to enable or Disable Add-Ons” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria: Remove the value NoExtensionManagement or set to REG_DWORD = 0 (decimal).

b
Automatic configuration of Internet Explorer is not disabled.
Medium - V-15490 - SV-16337r1_rule
RMF Control
Severity
M
CCI
Version
DTBI305
Vuln IDs
  • V-15490
Rule IDs
  • SV-16337r1_rule
This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. This setting specifies that Internet explorer use the configuration settings provided in a file by the system administrator. If you enable this policy setting, the user will not be able to do automatic configuration. You can import your current connection settings from your machine using Internet Explorer Maintenance under Admin Templates using group policy editor. If you disable or do no configure this policy setting, the user will have the freedom to automatically configure these settings.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14513r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable changing Automatic Configuration settings" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: If the value Autoconfig is REG_DWORD = 1 (Hex), this is not a finding.

Fix: F-15121r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable changing Automatic Configuration settings" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: Set the value Autoconfig to REG_DWORD = 1 (Hex).

b
Prevent participation in the Customer Experience Improvement Program is not disabled.
Medium - V-15492 - SV-16339r1_rule
RMF Control
Severity
M
CCI
Version
DTBI315
Vuln IDs
  • V-15492
Rule IDs
  • SV-16339r1_rule
This setting controls whether users can participate in the Microsoft Customer Experience Improvement Program to help improve Microsoft applications. When users choose to participate in the Customer Experience Improvement Program (CEIP), applications automatically send information to Microsoft about how the applications are used. This information is combined with other CEIP data to help Microsoft solve problems and to improve the products and features customers use most often. This feature does not collect users' names, addresses, or any other identifying information except the IP address that is used to send the data. By default, users have the opportunity to opt into participation in the CEIP the first time they run an application. If your organization has policies that govern the use of external resources such as the CEIP, allowing users to opt in to the program might cause them to violate these policies. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14515r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Prevent participation in the Customer Experience Improvement Program" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\SQM Criteria: If the value DisableCustomerImprovementProgram is REG_DWORD = 0, this is not a finding.

Fix: F-15123r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Prevent participation in the Customer Experience Improvement Program" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\SQM Criteria: Set the value DisableCustomerImprovementProgram to REG_DWORD = 0.

b
Turn off the Security Settings Check feature is not disabled.
Medium - V-15494 - SV-16341r1_rule
RMF Control
Severity
M
CCI
Version
DTBI325
Vuln IDs
  • V-15494
Rule IDs
  • SV-16341r1_rule
This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this policy setting, the security settings check will not be performed. If you disable or do not configure this policy setting, the security settings check will be performed.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14517r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off the Security Settings Check feature" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Security Criteria: If the value DisableSecuritySettingsCheck is REG_DWORD = 0, this is not a finding.

Fix: F-15125r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off the Security Settings Check feature" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Security Criteria: Set the value DisableSecuritySettingsCheck to REG_DWORD = 0.

b
Turn off Managing Phishing filter is not disabled.
Medium - V-15495 - SV-16342r1_rule
RMF Control
Severity
M
CCI
Version
DTBI330
Vuln IDs
  • V-15495
Rule IDs
  • SV-16342r1_rule
This policy setting allows the user to enable a phishing filter that will warn if the Web site being visited is known for fraudulent attempts to gather personal information through "phishing." If you enable this policy setting, the user will not be prompted to enable the phishing filter. You must specify which mode the phishing filter uses: manual, automatic, or off. If you select manual mode, the phishing filter performs only local analysis and users are prompted to permit any data to be sent to Microsoft. If the feature is fully enabled, all website addresses not contained on the filter's whitelist will be sent automatically to Microsoft without prompting the user. If you disable or do not configure this policy setting, the user will be prompted to decide the mode of operation for the phishing filter.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14518r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off Managing Phishing filter" will be set to “Enabled” and "Off" selected. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter Criteria: If the value Enabled is REG_DWORD = 0, this is not a finding.

Fix: F-15126r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off Managing Phishing filter" will be set to “Enabled” and "Off" selected. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter Criteria: Set the value Enabled to REG_DWORD = 0.

b
Allow active content from CDs to run on user machines is not disabled.
Medium - V-15497 - SV-16344r1_rule
RMF Control
Severity
M
CCI
Version
DTBI340
Vuln IDs
  • V-15497
Rule IDs
  • SV-16344r1_rule
This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run. If you enable this policy setting, active content on a CD will run without a prompt. If you disable this policy setting, active content on a CD will always prompt before running. If you do not configure this policy, users can choose whether to be prompted before running active content on a CD. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14520r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow active content from CDs to run on user machines" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings Criteria: If the value LOCALMACHINE_CD_UNLOCK is REG_DWORD = 0, this is not a finding.

Fix: F-15129r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow active content from CDs to run on user machines" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings Criteria: Set the value LOCALMACHINE_CD_UNLOCK to REG_DWORD = 0.

b
Allow software to run or install even if the signature is invalid is not disabled.
Medium - V-15499 - SV-16346r1_rule
RMF Control
Severity
M
CCI
Version
DTBI350
Vuln IDs
  • V-15499
Rule IDs
  • SV-16346r1_rule
Microsoft ActiveX controls and file downloads often have digital signatures attached that vouch for both the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure that unmodified.System AdministratorInformation Assurance OfficerDCMC-1
Checks: C-14522r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow software to run or install even if the signature is invalid" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: If the value RunInvalidSignatures is REG_DWORD = 0, this is not a finding.

Fix: F-15131r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow software to run or install even if the signature is invalid" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: Set the value RunInvalidSignatures to REG_DWORD = 0.

b
Allow third-party browser extensions are not disabled.
Medium - V-15500 - SV-16347r1_rule
RMF Control
Severity
M
CCI
Version
DTBI355
Vuln IDs
  • V-15500
Rule IDs
  • SV-16347r1_rule
This policy setting allows you to manage whether Internet Explorer will launch COM add-ons known as browser helper objects, such as toolbars. Browser helper objects may contain flaws such as buffer overruns which impact Internet Explorer's performance or stability. If you enable this policy setting, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer. If you disable this policy setting, browser helper objects do not launch. If you do not configure this policy, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14523r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow third-party browser extensions" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value Enable Browser Extensions is REG_SZ = no, this is not a finding.

Fix: F-15132r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow third-party browser extensions" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value Enable Browser Extensions to REG_SZ = no.

b
Check for server certificate revocation is not enabled.
Medium - V-15502 - SV-16349r1_rule
RMF Control
Severity
M
CCI
Version
DTBI365
Vuln IDs
  • V-15502
Rule IDs
  • SV-16349r1_rule
This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure. If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked. If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.System AdministratorInformation Assurance OfficerIATS-1, IATS-2
Checks: C-14525r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Check for server certificate revocation" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value CertificateRevocation is REG_DWORD = 1, this is not a finding.

Fix: F-15134r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Check for server certificate revocation" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: Set the value CertificateRevocation to REG_DWORD = 1.

b
Check for signatures on downloaded programs is not enabled.
Medium - V-15503 - SV-16350r1_rule
RMF Control
Severity
M
CCI
Version
DTBI370
Vuln IDs
  • V-15503
Rule IDs
  • SV-16350r1_rule
This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs. If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers. If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14526r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Check for signatures on downloaded programs" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: If the value CheckExeSignatures is REG_SZ = yes, this is not a finding.

Fix: F-15135r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Check for signatures on downloaded programs" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: Set the value CheckExeSignatures to REG_SZ = yes.

b
Intranet Sites: Include all network paths (UNCs) are disabled.
Medium - V-15504 - SV-16351r1_rule
RMF Control
Severity
M
CCI
Version
DTBI375
Vuln IDs
  • V-15504
Rule IDs
  • SV-16351r1_rule
This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there). If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14527r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> "Intranet Sites: Include all network paths (UNCs)" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Criteria: If the value UNCAsIntranet is REG_DWORD = 0, this is not a finding.

Fix: F-15136r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> "Intranet Sites: Include all network paths (UNCs)" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Criteria: Set the value UNCAsIntranet to REG_DWORD = 0.

b
Allow script-initiated windows without size or position constraints for internet zone is not disabled.
Medium - V-15507 - SV-16354r1_rule
RMF Control
Severity
M
CCI
Version
DTBI385
Vuln IDs
  • V-15507
Rule IDs
  • SV-16354r1_rule
This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14530r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow script-initiated windows without size or position constraints" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2102 is REG_DWORD = 3, this is not a finding.

Fix: F-15139r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow script-initiated windows without size or position constraints" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2102 to REG_DWORD = 3.

b
Allow script-initiated windows without size or position constraints for restricted sites zone are not disabled.
Medium - V-15508 - SV-16355r1_rule
RMF Control
Severity
M
CCI
Version
DTBI390
Vuln IDs
  • V-15508
Rule IDs
  • SV-16355r1_rule
This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14531r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow script-initiated windows without size or position constraints" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2102 is REG_DWORD = 3, this is not a finding.

Fix: F-15140r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow script-initiated windows without size or position constraints" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2102 to REG_DWORD = 3.

b
Allow Scriptlets are not disabled.
Medium - V-15509 - SV-16356r1_rule
RMF Control
Severity
M
CCI
Version
DTBI395
Vuln IDs
  • V-15509
Rule IDs
  • SV-16356r1_rule
This policy setting allows you to manage whether scriptlets can be allowed. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14532r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow Scriptlets" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1209 is REG_DWORD = 3, this is not a finding.

Fix: F-15141r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow Scriptlets" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1209 to REG_DWORD = 3.

b
Automatic prompting for file downloads dialog box is not disabled.
Medium - V-15513 - SV-16360r2_rule
RMF Control
Severity
M
CCI
Version
DTBI415
Vuln IDs
  • V-15513
Rule IDs
  • SV-16360r2_rule
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14536r3_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Automatic prompting for file downloads" will be set to “Enabled” and "Disable" selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2200 is REG_DWORD = 3, this is not a finding.

Fix: F-15145r3_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Automatic prompting for file downloads" will be set to “Enabled” and "Disable" selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2200 to REG_DWORD = 3.

b
Java permissions for my computer are not disabled.
Medium - V-15515 - SV-16362r2_rule
RMF Control
Severity
M
CCI
Version
DTBI425
Vuln IDs
  • V-15515
Rule IDs
  • SV-16362r2_rule
This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.System AdministratorInformation Assurance OfficerDCMC-1
Checks: C-14538r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Criteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.

Fix: F-15147r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Criteria: Set the value 1C00 to REG_DWORD = 0.

b
Java permissions for my computer group policy are not disabled.
Medium - V-15516 - SV-16363r2_rule
RMF Control
Severity
M
CCI
Version
DTBI430
Vuln IDs
  • V-15516
Rule IDs
  • SV-16363r2_rule
This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.System AdministratorInformation Assurance OfficerDCMC-1
Checks: C-14539r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 Criteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.

Fix: F-15148r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 Criteria: Set the value 1C00 to REG_DWORD = 0.

b
Java permissions for group policy for local intranet zone are not disabled.
Medium - V-15517 - SV-16364r2_rule
RMF Control
Severity
M
CCI
Version
DTBI435
Vuln IDs
  • V-15517
Rule IDs
  • SV-16364r2_rule
This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.System AdministratorInformation Assurance OfficerDCMC-1
Checks: C-14540r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 Criteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.

Fix: F-15149r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 Criteria: Set the value 1C00 to REG_DWORD = 0.

b
Java permissions for group policy for trusted sites zone are not disabled.
Medium - V-15518 - SV-16365r2_rule
RMF Control
Severity
M
CCI
Version
DTBI440
Vuln IDs
  • V-15518
Rule IDs
  • SV-16365r2_rule
This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.System AdministratorInformation Assurance OfficerDCMC-1
Checks: C-14541r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 Criteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.

Fix: F-15150r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 Criteria: Set the value 1C00 to REG_DWORD = 0.

b
Java permissions for group policy for internet zone are not disabled.
Medium - V-15519 - SV-16366r2_rule
RMF Control
Severity
M
CCI
Version
DTBI445
Vuln IDs
  • V-15519
Rule IDs
  • SV-16366r2_rule
This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.System AdministratorInformation Assurance OfficerDCMC-1
Checks: C-14542r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Internet Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 Criteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.

Fix: F-15151r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Internet Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 Criteria: Set the value 1C00 to REG_DWORD = 0.

b
Java permissions for group policy for restricted sites zone are not disabled.
Medium - V-15520 - SV-16367r2_rule
RMF Control
Severity
M
CCI
Version
DTBI450
Vuln IDs
  • V-15520
Rule IDs
  • SV-16367r2_rule
This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.System AdministratorInformation Assurance OfficerDCMC-1
Checks: C-14543r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 Criteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.

Fix: F-15152r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 Criteria: Set the value 1C00 to REG_DWORD = 0.

b
Loose or un-compiled XAML files for internet zone are not disabled.
Medium - V-15521 - SV-16368r1_rule
RMF Control
Severity
M
CCI
Version
DTBI455
Vuln IDs
  • V-15521
Rule IDs
  • SV-16368r1_rule
These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer 7.0. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files. If you disable this policy setting, .XAML files will not be loaded inside Internet Explorer 7. User will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer 7.0.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14544r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Loose or un-compiled XAML files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2402 is REG_DWORD = 3, this is not a finding.

Fix: F-15153r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Loose or un-compiled XAML files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2402 to REG_DWORD = 3.

b
Loose or un-compiled XAML files for restricted sites zone are not disabled.
Medium - V-15522 - SV-16369r1_rule
RMF Control
Severity
M
CCI
Version
DTBI460
Vuln IDs
  • V-15522
Rule IDs
  • SV-16369r1_rule
These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer 7.0. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files. If you disable this policy setting, .XAML files will not be loaded inside Internet Explorer 7. User will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer 7.0.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14545r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Loose or un-compiled XAML files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2402 is REG_DWORD = 3, this is not a finding.

Fix: F-15154r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Loose or un-compiled XAML files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2402 to REG_DWORD = 3.

b
Open files based on content, not file extension for internet zone are not disabled.
Medium - V-15523 - SV-16370r1_rule
RMF Control
Severity
M
CCI
Version
DTBI465
Vuln IDs
  • V-15523
Rule IDs
  • SV-16370r1_rule
This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature. If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14547r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Open files based on content, not file extension" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2100 is REG_DWORD = 3, this is not a finding.

Fix: F-15156r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Open files based on content, not file extension" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2100 to REG_DWORD = 3.

b
Open files based on content, not file extension for restricted sites zone are not disabled.
Medium - V-15524 - SV-16371r1_rule
RMF Control
Severity
M
CCI
Version
DTBI470
Vuln IDs
  • V-15524
Rule IDs
  • SV-16371r1_rule
This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature. If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14548r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Open files based on content, not file extension" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2100 is REG_DWORD = 3, this is not a finding.

Fix: F-15157r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Open files based on content, not file extension" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2100 to REG_DWORD = 3.

b
Turn Off First-Run Opt-In for internet zone is not disabled.
Medium - V-15525 - SV-16372r1_rule
RMF Control
Severity
M
CCI
Version
DTBI475
Vuln IDs
  • V-15525
Rule IDs
  • SV-16372r1_rule
This policy setting controls the First Run response that users see on a zone by zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control. This feature determines if the user gets the prompt or not. If you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone. If you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone. If you do not configure this policy setting, the first-run prompt is turned off by default. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14549r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Turn Off First-Run Opt-In" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1208 is REG_DWORD = 0, this is not a finding.

Fix: F-15158r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Turn Off First-Run Opt-In" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1208 to REG_DWORD = 0.

b
Turn Off First-Run Opt-In for restricted sites zone are not disabled.
Medium - V-15526 - SV-16373r1_rule
RMF Control
Severity
M
CCI
Version
DTBI480
Vuln IDs
  • V-15526
Rule IDs
  • SV-16373r1_rule
This policy setting controls the First Run response that users see on a zone by zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control. This feature determines if the user gets the prompt or not. If you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone. If you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone. If you do not configure this policy setting, the first-run prompt is turned off by default. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14550r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Turn Off First-Run Opt-In" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1208 is REG_DWORD = 0, this is not a finding.

Fix: F-15159r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Turn Off First-Run Opt-In" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1208 to REG_DWORD = 0.

b
Turn on Protected Mode internet zone is not enabled.
Medium - V-15527 - SV-16374r1_rule
RMF Control
Severity
M
CCI
Version
DTBI485
Vuln IDs
  • V-15527
Rule IDs
  • SV-16374r1_rule
Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off protected mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode. If you do not configure this policy, users will be able to turn on or off protected mode. Requires Windows Vista; will be ignored by Windows XP. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14551r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Turn on Protected Mode" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2500 is REG_DWORD = 0, this is not a finding.

Fix: F-15160r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Turn on Protected Mode" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2500 to REG_DWORD = 0.

b
Turn on Protected Mode for restricted sites zone is not enabled.
Medium - V-15528 - SV-16375r1_rule
RMF Control
Severity
M
CCI
Version
DTBI490
Vuln IDs
  • V-15528
Rule IDs
  • SV-16375r1_rule
VISTA Only Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off protected mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode. If you do not configure this policy, users will be able to turn on or off protected mode. Requires Windows Vista; will be ignored by Windows XP. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14552r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Turn on Protected Mode" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2500 is REG_DWORD = 0, this is not a finding.

Fix: F-15161r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Turn on Protected Mode" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2500 to REG_DWORD = 0.

b
Use Pop-up Blocker for internet zone is not enabled.
Medium - V-15529 - SV-16376r1_rule
RMF Control
Severity
M
CCI
Version
DTBI495
Vuln IDs
  • V-15529
Rule IDs
  • SV-16376r1_rule
This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14553r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Use Pop-up Blocker" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1809 is REG_DWORD = 0, this is not a finding.

Fix: F-15162r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Use Pop-up Blocker" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1809 to REG_DWORD = 0.

b
Use Pop-up Blocker for restricted sites zone is not enabled.
Medium - V-15530 - SV-16377r1_rule
RMF Control
Severity
M
CCI
Version
DTBI500
Vuln IDs
  • V-15530
Rule IDs
  • SV-16377r1_rule
This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14554r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Use Pop-up Blocker" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1809 is REG_DWORD = 0, this is not a finding.

Fix: F-15163r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Use Pop-up Blocker" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1809 to REG_DWORD = 0.

b
Web sites in less privileged Web content zones can navigate into internet zone is not disabled.
Medium - V-15533 - SV-16380r1_rule
RMF Control
Severity
M
CCI
Version
DTBI515
Vuln IDs
  • V-15533
Rule IDs
  • SV-16380r1_rule
This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14557r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Web sites in less privileged Web content zones can navigate into this zone" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2101 is REG_DWORD = 3, this is not a finding.

Fix: F-15166r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Web sites in less privileged Web content zones can navigate into this zone" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria:Set the value 2101 to REG_DWORD = 3.

b
Web sites in less privileged Web content zones can navigate into restricted sites zone is not disabled.
Medium - V-15534 - SV-16381r1_rule
RMF Control
Severity
M
CCI
Version
DTBI520
Vuln IDs
  • V-15534
Rule IDs
  • SV-16381r1_rule
This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14558r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Web sites in less privileged Web content zones can navigate into this zone" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2101 is REG_DWORD = 3, this is not a finding.

Fix: F-15168r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Web sites in less privileged Web content zones can navigate into this zone" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2101 to REG_DWORD = 3.

b
Allow binary and script behaviors are not disabled.
Medium - V-15545 - SV-16392r1_rule
RMF Control
Severity
M
CCI
Version
DTBI575
Vuln IDs
  • V-15545
Rule IDs
  • SV-16392r1_rule
This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. If you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available. If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. If you do not configure this policy setting, binary and script behaviors are available.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14569r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow binary and script behaviors" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2000 is REG_DWORD = 3, this is not a finding.

Fix: F-15179r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow binary and script behaviors" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2000 to REG_DWORD = 3.

b
Automatic prompting for file downloads is not disabled.
Medium - V-15546 - SV-16393r2_rule
RMF Control
Severity
M
CCI
Version
DTBI580
Vuln IDs
  • V-15546
Rule IDs
  • SV-16393r2_rule
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14570r3_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Automatic prompting for file downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2200 is REG_DWORD = 3, this is not a finding.

Fix: F-15180r3_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Automatic prompting for file downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2200 to REG_DWORD = 3.

b
Internet Explorer Processes for MIME handling is not enabled. (Reserved)
Medium - V-15548 - SV-16395r1_rule
RMF Control
Severity
M
CCI
Version
DTBI590
Vuln IDs
  • V-15548
Rule IDs
  • SV-16395r1_rule
Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. Therefore, this appendix recommends you configure this policy as Enabled for all environments specified in this guide.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14572r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.

Fix: F-15182r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: Set the value (Reserved) to REG_SZ = 1.

b
Internet Explorer Processes for MIME sniffing is not enabled. (Reserved)
Medium - V-15549 - SV-16396r2_rule
RMF Control
Severity
M
CCI
Version
DTBI595
Vuln IDs
  • V-15549
Rule IDs
  • SV-16396r2_rule
MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network. Therefore, this appendix recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-14573r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.

Fix: F-15183r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: Set the value (Reserved) to REG_SZ = 1.

b
Internet Explorer Processes for MK protocol is not enabled. (Explorer)
Medium - V-15550 - SV-16397r1_rule
RMF Control
Severity
M
CCI
Version
DTBI600
Vuln IDs
  • V-15550
Rule IDs
  • SV-16397r1_rule
The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Setting this policy to Enabled blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This appendix recommends you configure this setting to Enabled to block the MK protocol unless you specifically need it in your environment. Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol. System AdministratorECSC-1
Checks: C-14574r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value explorer.exe is REG_SZ = 1, this is not a finding

Fix: F-15184r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: Set the value explorer.exe to REG_SZ = 1.

b
Internet Explorer Processes for MK protocol is not enabled. (IExplore)
Medium - V-15551 - SV-16398r1_rule
RMF Control
Severity
M
CCI
Version
DTBI605
Vuln IDs
  • V-15551
Rule IDs
  • SV-16398r1_rule
The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Setting this policy to Enabled blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This appendix recommends you configure this setting to Enabled to block the MK protocol unless you specifically need it in your environment. Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol.System AdministratorECSC-1
Checks: C-14575r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.

Fix: F-15185r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: Set the value iexplore.exe to REG_SZ = 1.

b
Internet Explorer Processes for Zone Elevation is not enabled. (Reserved)
Medium - V-15552 - SV-16399r1_rule
RMF Control
Severity
M
CCI
Version
DTBI610
Vuln IDs
  • V-15552
Rule IDs
  • SV-16399r1_rule
Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet zone, Intranet zone, or Local Machine zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine zone, which makes the Local Machine security zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this appendix recommends that you configure this setting as Enabled in all environments. System AdministratorECSC-1
Checks: C-14576r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.

Fix: F-15186r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: Set the value (Reserved) to REG_SZ = 1.

b
Internet Explorer Processes for Download prompt is not enabled. (Reserved)
Medium - V-15556 - SV-16403r1_rule
RMF Control
Severity
M
CCI
Version
DTBI630
Vuln IDs
  • V-15556
Rule IDs
  • SV-16403r1_rule
In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.System AdministratorECSC-1
Checks: C-14580r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.

Fix: F-15190r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: Set the value (Reserved) to REG_SZ = 1.

b
Internet Explorer Processes for Download prompt is not enabled. Explorer
Medium - V-15557 - SV-16404r1_rule
RMF Control
Severity
M
CCI
Version
DTBI635
Vuln IDs
  • V-15557
Rule IDs
  • SV-16404r1_rule
In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.System AdministratorECSC-1
Checks: C-14581r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.

Fix: F-15191r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: Set the value explorer.exe to REG_SZ = 1.

b
Internet Explorer Processes for Download prompt is not enabled. IExplore
Medium - V-15558 - SV-16405r1_rule
RMF Control
Severity
M
CCI
Version
DTBI640
Vuln IDs
  • V-15558
Rule IDs
  • SV-16405r1_rule
In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.System AdministratorECSC-1
Checks: C-14582r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.

Fix: F-15192r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: Set the value iexplore.exe to REG_SZ = 1.

b
Internet Explorer Processes for restricting pop-up windows is not enabled. (Reserved)
Medium - V-15559 - SV-16406r1_rule
RMF Control
Severity
M
CCI
Version
DTBI645
Vuln IDs
  • V-15559
Rule IDs
  • SV-16406r1_rule
Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows’ title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This appendix recommends you configure this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.System AdministratorECSC-1
Checks: C-14583r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.

Fix: F-15193r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: Set the value (Reserved) is REG_SZ = 1.

b
Run .NET Framework-reliant components not signed with Authenticode are not disabled.
Medium - V-15560 - SV-16407r1_rule
RMF Control
Severity
M
CCI
Version
DTBI650
Vuln IDs
  • V-15560
Rule IDs
  • SV-16407r1_rule
This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will execute signed managed components. This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will execute unsigned managed components. System AdministratorECSC-1
Checks: C-14584r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run .NET Framework-reliant components not signed with Authenticode" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2004 is REG_DWORD = 3, this is not a finding.

Fix: F-15194r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run .NET Framework-reliant components not signed with Authenticode" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2004 to REG_DWORD = 3.

b
Run .NET Framework-reliant components signed with Authenticode are not disabled.
Medium - V-15561 - SV-16408r1_rule
RMF Control
Severity
M
CCI
Version
DTBI655
Vuln IDs
  • V-15561
Rule IDs
  • SV-16408r1_rule
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will execute unsigned managed components. System AdministratorECSC-1
Checks: C-14585r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run .NET Framework-reliant components signed with Authenticode" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2001 is REG_DWORD = 3, this is not a finding.

Fix: F-15195r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run .NET Framework-reliant components signed with Authenticode" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2001 to REG_DWORD = 3.

b
Scripting of Java applets is not disabled.
Medium - V-15562 - SV-16409r2_rule
RMF Control
Severity
M
CCI
Version
DTBI670
Vuln IDs
  • V-15562
Rule IDs
  • SV-16409r2_rule
This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets. If you disable this policy setting, scripts are prevented from accessing applets. If you do not configure this policy setting, scripts can access applets automatically without user intervention.System AdministratorECSC-1
Checks: C-14586r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Scripting of Java applets" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1402 is REG_DWORD = 3, this is not a finding.

Fix: F-15196r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Scripting of Java applets" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1402 to REG_DWORD = 3.

b
Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools is not disabled.
Medium - V-15563 - SV-16410r1_rule
RMF Control
Severity
M
CCI
Version
DTBI675
Vuln IDs
  • V-15563
Rule IDs
  • SV-16410r1_rule
This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer. If you enable this policy setting, users will not be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools. You must specify the URL to be displayed for checking updates to Internet Explorer and Internet Tools. If you disable or do not configure this policy setting, users will be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools.System AdministratorECSC-1
Checks: C-14587r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> "Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools" will be set to “Enabled” and "blank or empty" selection box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: The Update_Check_Page value must exist. The value must contain no data value. If the value Update_Check_Page is not present this is a finding.

Fix: F-15197r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> "Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools" will be set to “Enabled” and "blank or empty" selection box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Create the value Update_Check_Page . The value must contain no data.

b
Turn off configuring the update check interval is not disabled.
Medium - V-15564 - SV-16411r1_rule
RMF Control
Severity
M
CCI
Version
DTBI680
Vuln IDs
  • V-15564
Rule IDs
  • SV-16411r1_rule
This setting specifies the update check interval. The default value is 30 days. If you enable this policy setting, the user will not be able to configure the update check interval. You have to specify the update check interval. If you disable or do not configure this policy setting, the user will have the freedom to configure the update check interval. System AdministratorECSC-1
Checks: C-14588r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> "Turn off configuring the update check interval (in days)" will be set to “Enabled” and "30" selected from drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value Update_Check_Interval is REG_DWORD = 30 (Decimal), this is not a finding.

Fix: F-15198r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> "Turn off configuring the update check interval (in days)" will be set to “Enabled” and "30" selected from drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value Update_Check_Interval to REG_DWORD = 30 (Decimal).

b
Internet Explorer Processes for MIME handling is not enabled. Explorer
Medium - V-15565 - SV-16412r1_rule
RMF Control
Severity
M
CCI
Version
DTBI592
Vuln IDs
  • V-15565
Rule IDs
  • SV-16412r1_rule
Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. Therefore, this appendix recommends you configure this policy as Enabled for all environments specified in this guide.System AdministratorECSC-1
Checks: C-14604r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.

Fix: F-15199r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: Set the value explorer.exe to REG_SZ = 1.

b
Internet Explorer Processes for MIME handling is not enabled. IExplore
Medium - V-15566 - SV-16413r1_rule
RMF Control
Severity
M
CCI
Version
DTBI594
Vuln IDs
  • V-15566
Rule IDs
  • SV-16413r1_rule
Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. Therefore, this appendix recommends you configure this policy as Enabled for all environments specified in this guide.System AdministratorECSC-1
Checks: C-14605r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.

Fix: F-15200r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: Set the value iexplore.exe to REG_SZ = 1.

b
Internet Explorer Processes for MK protocol is not enabled. (Reserved)
Medium - V-15568 - SV-16415r1_rule
RMF Control
Severity
M
CCI
Version
DTBI599
Vuln IDs
  • V-15568
Rule IDs
  • SV-16415r1_rule
The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Setting this policy to Enabled blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This appendix recommends you configure this setting to Enabled to block the MK protocol unless you specifically need it in your environment. Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol.System AdministratorECSC-1
Checks: C-14607r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: If the value (reserved) is REG_SZ = 1, this is not a finding

Fix: F-15202r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: Set the value (reserved) to REG_SZ = 1.

b
Internet Explorer Processes for Zone Elevation is not enabled. Explorer
Medium - V-15569 - SV-16416r1_rule
RMF Control
Severity
M
CCI
Version
DTBI612
Vuln IDs
  • V-15569
Rule IDs
  • SV-16416r1_rule
Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet zone, Intranet zone, or Local Machine zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine zone, which makes the Local Machine security zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this appendix recommends that you configure this setting as Enabled in all environments.System AdministratorECSC-1
Checks: C-14608r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.

Fix: F-15203r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: Set the value explorer.exe to REG_SZ = 1.

b
Internet Explorer Processes for Zone Elevation is not enabled. IExplore
Medium - V-15570 - SV-16417r1_rule
RMF Control
Severity
M
CCI
Version
DTBI614
Vuln IDs
  • V-15570
Rule IDs
  • SV-16417r1_rule
Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet zone, Intranet zone, or Local Machine zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine zone, which makes the Local Machine security zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this appendix recommends that you configure this setting as Enabled in all environments.System AdministratorECSC-1
Checks: C-14630r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.

Fix: F-15204r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: Set the value iexplore.exe to REG_SZ = 1.

b
Internet Explorer Processes for restricting pop-up windows is not enabled. Explorer
Medium - V-15571 - SV-16418r1_rule
RMF Control
Severity
M
CCI
Version
DTBI647
Vuln IDs
  • V-15571
Rule IDs
  • SV-16418r1_rule
Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows’ title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This appendix recommends you configure this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.System AdministratorECSC-1
Checks: C-14631r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.

Fix: F-15205r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: Set the value explorer.exe to REG_SZ = 1.

b
Internet Explorer Processes for restricting pop-up windows is not enabled. IExplore
Medium - V-15572 - SV-16419r1_rule
RMF Control
Severity
M
CCI
Version
DTBI649
Vuln IDs
  • V-15572
Rule IDs
  • SV-16419r1_rule
Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows’ title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This appendix recommends you configure this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.System AdministratorECSC-1
Checks: C-14632r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.

Fix: F-15206r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: Set the value iexplore.exe to REG_SZ = 1.

b
Disable AutoComplete for forms is not enabled.
Medium - V-15574 - SV-16421r1_rule
RMF Control
Severity
M
CCI
Version
DTBI690
Vuln IDs
  • V-15574
Rule IDs
  • SV-16421r1_rule
This AutoComplete feature suggests possible matches when users are filling up forms. If you enable this setting, the user is not suggested matches when filling forms. The user cannot change it. If you disable this setting, the user is suggested possible matches when filling forms. The user cannot change it. If you do not configure this setting, the user has the freedom to turn on the auto-complete feature for forms. To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button. System AdministratorECSC-1
Checks: C-14634r1_chk

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable AutoComplete for forms" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value Use FormSuggest is REG_SZ = no, this is not a finding. HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: If the value FormSuggest is REG_DWORD = 1, this is not a finding.

Fix: F-15208r1_fix

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable AutoComplete for forms" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value Use FormSuggest to REG_SZ = no. HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: Set the value FormSuggest to REG_DWORD = 1.

b
Disable external branding of Internet Explorer is not enabled.
Medium - V-15575 - SV-16422r1_rule
RMF Control
Severity
M
CCI
Version
DTBI695
Vuln IDs
  • V-15575
Rule IDs
  • SV-16422r1_rule
Prevents branding of Internet programs, such as customization of Internet Explorer and Outlook Express logos and title bars, by another party. If you enable this policy, it prevents customization of the browser by another party, such as an Internet service provider or Internet content provider. If you disable this policy or do not configure it, users could install customizations from another party-for example, when signing up for Internet services. This policy is intended for administrators who want to maintain a consistent browser across an organization.System AdministratorECSC-1
Checks: C-14635r1_chk

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable external branding of Internet Explorer" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria: If the value NoExternalBranding is REG_DWORD = 1, this is not a finding.

Fix: F-15209r1_fix

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable external branding of Internet Explorer" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria: Set the value NoExternalBranding to REG_DWORD = 1.

b
Turn off Crash Detection is not enabled.
Medium - V-15579 - SV-16426r1_rule
RMF Control
Severity
M
CCI
Version
DTBI715
Vuln IDs
  • V-15579
Rule IDs
  • SV-16426r1_rule
The Turn off Crash Detection policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP Professional Service Pack 1 and earlier: Windows Error Reporting will be invoked. If you disable this policy setting, the crash detection feature in add-on management will be functional. Because Internet Explorer crash report information could contain sensitive information from the computer's memory, this appendix recommends you configure this option to Enabled unless you are experiencing frequent repeated crashes and need to report them for follow-up troubleshooting. In those cases you could temporarily configure the setting to Disabled.System AdministratorECSC-1
Checks: C-14639r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off Crash Detection" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria: If the value NoCrashDetection is REG_DWORD = 1, this is not a finding.

Fix: F-15213r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off Crash Detection" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria:Set the value NoCrashDetection to REG_DWORD = 1.

b
Turn off page transitions is not enabled.
Medium - V-15580 - SV-16427r1_rule
RMF Control
Severity
M
CCI
Version
DTBI720
Vuln IDs
  • V-15580
Rule IDs
  • SV-16427r1_rule
This policy setting specifies if, as you move from one Web page to another, Internet Explorer fades out of the page you are leaving and fades into the page to which you are going. If you enable this policy setting, page transitions will be turned off. The user cannot change this behavior. If you disable this policy setting, page transitions will be turned on. The user cannot change this behavior. If you do not configure this policy setting, the user can turn on or off page transitions.System AdministratorECSC-1
Checks: C-14641r1_chk

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Advanced Settings -> Browsing -> "Turn off page transitions" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value Page_Transitions is REG_DWORD = 0, this is not a finding.

Fix: F-15215r1_fix

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Advanced Settings -> Browsing -> "Turn off page transitions" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value Page_Transitions to REG_DWORD = 0.

b
Turn on the auto-complete feature for user names and passwords on forms are not disabled.
Medium - V-15581 - SV-16428r1_rule
RMF Control
Severity
M
CCI
Version
DTBI725
Vuln IDs
  • V-15581
Rule IDs
  • SV-16428r1_rule
This AutoComplete feature can remember and suggest User names and passwords on Forms. If you enable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms will be turned on. You have to decide whether to select "prompt me to save passwords". If you disable this setting the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms is turned off. The user also cannot opt to be prompted to save passwords. If you do not configure this setting, the user has the freedom of turning on Auto complete for User name and passwords on forms and the option of prompting to save passwords. To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button.System AdministratorECSC-1
Checks: C-14640r1_chk

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn on the auto-complete feature for user names and passwords on forms" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value FormSuggest Passwords is REG_SZ = no, this is not a finding. HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: If the value FormSuggest Passwords is REG_DWORD = 1, this is not a finding.

Fix: F-15216r1_fix

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn on the auto-complete feature for user names and passwords on forms" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value FormSuggest Passwords to REG_SZ = no. HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: Set the value FormSuggest Passwords to REG_DWORD = 1.

b
Turn on the Internet Connection Wizard Auto Detect is not disabled.
Medium - V-15582 - SV-16429r1_rule
RMF Control
Severity
M
CCI
Version
DTBI730
Vuln IDs
  • V-15582
Rule IDs
  • SV-16429r1_rule
This policy setting determines if the Internet Connection Wizard was completed. If it was not completed, it launches the Internet Connection Wizard. If you enable this policy setting, the Internet Connection Wizard is launched automatically if it was not completed before. The user cannot prevent the wizard from launching. If you disable this policy setting, the Internet Connection Wizard is not launched automatically. The user can launch the wizard manually. If you do not configure this policy setting, the user will have the freedom to decide whether the Internet Connection Wizard should be launched automatically.System AdministratorECSC-1
Checks: C-14642r1_chk

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Advanced Settings -> Internet Connection Wizard Settings -> "Turn on the Internet Connection Wizard Auto Detect" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Connection Wizard Criteria: If the value DisableICW is REG_DWORD = 1, this is not a finding.

Fix: F-15217r1_fix

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Advanced Settings -> Internet Connection Wizard Settings -> "Turn on the Internet Connection Wizard Auto Detect" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Connection Wizard Criteria: Set the value DisableICW to REG_DWORD = 1.

b
Internet Explorer Processes for MIME sniffing is not enabled. Explorer
Medium - V-15603 - SV-16492r1_rule
RMF Control
Severity
M
CCI
Version
DTBI596
Vuln IDs
  • V-15603
Rule IDs
  • SV-16492r1_rule
MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network. Therefore, this appendix recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME handling settings.System AdministratorECSC-1
Checks: C-15225r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.

Fix: F-15424r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value explorer.exe is REG_SZ = 1.

b
Internet Explorer Processes for MIME sniffing is not enabled. IExplore
Medium - V-15604 - SV-16493r1_rule
RMF Control
Severity
M
CCI
Version
DTBI597
Vuln IDs
  • V-15604
Rule IDs
  • SV-16493r1_rule
MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network. Therefore, this appendix recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME handling settings.System AdministratorECSC-1
Checks: C-15226r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.

Fix: F-15425r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: If the value iexplore.exe is REG_SZ = 1.

b
The Download signed ActiveX controls property is not set properly for the Lockdown Zone.
Medium - V-16879 - SV-17879r1_rule
RMF Control
Severity
M
CCI
Version
DTBI025
Vuln IDs
  • V-16879
Rule IDs
  • SV-17879r1_rule
This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded. If you disable the policy setting, signed controls cannot be downloaded. If you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.System AdministratorInformation Assurance OfficerDCMC-1
Checks: C-17467r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Internet Zone -> "Download signed ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 Criteria: If the value 1001 is REG_DWORD = 3, this is not a finding.

Fix: F-16726r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Internet Zone -> "Download signed ActiveX controls" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 Criteria: Set the value 1001 to REG_DWORD = 3.

b
Prevent performance of First Run Customize settings is not enabled.
Medium - V-17296 - SV-18332r1_rule
RMF Control
Severity
M
CCI
Version
DTBI010
Vuln IDs
  • V-17296
Rule IDs
  • SV-18332r1_rule
This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they launch Internet Explorer for the first time after installation of Internet Explorer. If you enable this policy setting, users must make one of two choices: 1: Skip Customize Settings, and go directly to the user’s home page. 2: Skip Customize Settings, and go directly to the "Welcome to Internet Explorer" Web page. If you disable or do not configure this policy setting, users go through the regular first run process. System AdministratorInformation Assurance OfficerECSC-1
Checks: C-17941r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Prevent performance of First Run Customize settings" will be set to “Enabled” and "Go directly to home page" selected. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value DisableFirstRunCustomize is REG_DWORD = 1, this is not a finding.

Fix: F-17208r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Prevent performance of First Run Customize settings" will be set to “Enabled” and "Go directly to home page" selected. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value DisableFirstRunCustomize is REG_DWORD = 1.

b
Disable Configuring History - Histroy setting is not set to 40 days.
Medium - V-21887 - SV-24724r1_rule
RMF Control
Severity
M
CCI
Version
DTBI300
Vuln IDs
  • V-21887
Rule IDs
  • SV-24724r1_rule
This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options and General tab. It is also available as Delete History directly under tools, Internet options, Delete Browsing History in Internet Explorer 7. If you enable this policy setting, a user cannot set the number of days that Internet Explorer keeps track of the pages viewed in the History List. You must specify the number of days that Internet Explorer keeps track of the pages viewed in the History List. Users will not be able to delete browsing history. If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer keeps track of the pages viewed in the History List and has the freedom to Delete Browsing History.System AdministratorECSC-1
Checks: C-14512r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable "Configuring History" " will be set to “Enabled” and "40" entered in 'Days to keep pages in History'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: If the value History is REG_DWORD = 1, this is not a finding. HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History Criteria: If the value DaysToKeep is REG_DWORD = 40 (decimal), this is not a finding.

Fix: F-15120r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable "Configuring History" " will be set to “Enabled” and "40" entered in 'Days to keep pages in History'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: Set the value History to REG_DWORD = 1. HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History Criteria: Set the value DaysToKeep to REG_DWORD = 40 (decimal).

b
Internet Explorer Processes Restrict ActiveX Install (Reserved) property is properly set.
Medium - V-22171 - SV-44647r1_rule
RMF Control
Severity
M
CCI
Version
DTBI900
Vuln IDs
  • V-22171
Rule IDs
  • SV-44647r1_rule
This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you do not configure this policy setting, the user’s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.System AdministratorECSC-1
Checks: C-42151r2_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> “Internet Explorer Processes” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.

Fix: F-38103r2_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> “Internet Explorer Processes” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: Set the value (Reserved) to REG_SZ = 1.

b
Allow status bar updates via script (Internet Zone) property is properly set.
Medium - V-22634 - SV-44766r1_rule
RMF Control
Severity
M
CCI
Version
DTBI910
Vuln IDs
  • V-22634
Rule IDs
  • SV-44766r1_rule
This policy setting allows you to manage whether script is allowed to update the status bar within the zone.System AdministratorECSC-1
Checks: C-42272r2_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone “Allow status bar updates via script” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2103 is REG_DWORD = 3, this is not a finding.

Fix: F-38217r2_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone “Allow status bar updates via script” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2103 to REG_DWORD = 3.

b
Run .NET Framework-reliant components not signed with Authenticode (Internet Zone) property is properly set.
Medium - V-22635 - SV-44768r1_rule
RMF Control
Severity
M
CCI
Version
DTBI920
Vuln IDs
  • V-22635
Rule IDs
  • SV-44768r1_rule
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.System AdministratorECSC-1
Checks: C-42274r3_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone “Run .NET Framework-reliant components not signed with Authenticode” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2004 is REG_DWORD = 3, this is not a finding.

Fix: F-38219r3_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone “Run .NET Framework-reliant components not signed with Authenticode” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2004 to REG_DWORD = 3.

b
Run .NET Framework-reliant components signed with Authenticode (Internet Zone) property is properly set.
Medium - V-22636 - SV-44904r1_rule
RMF Control
Severity
M
CCI
Version
DTBI930
Vuln IDs
  • V-22636
Rule IDs
  • SV-44904r1_rule
This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.System AdministratorECSC-1
Checks: C-42346r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone “Run .NET Framework-reliant components signed with Authenticode” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 2001 is REG_DWORD = 3, this is not a finding.

Fix: F-38337r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone “Run .NET Framework-reliant components signed with Authenticode” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2001 to REG_DWORD = 3.

b
Allow Scriptlets (Restricted Sites Zone) property is properly set.
Medium - V-22637 - SV-44769r1_rule
RMF Control
Severity
M
CCI
Version
DTBI940
Vuln IDs
  • V-22637
Rule IDs
  • SV-44769r1_rule
This policy setting allows you to manage whether scriptlets can be allowed.System AdministratorECSC-1
Checks: C-42275r2_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone “Allow Scriptlets” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 1209 is REG_DWORD = 3, this is not a finding.

Fix: F-38220r2_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone “Allow Scriptlets” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1209 to REG_DWORD = 3.

b
Allow status bar updates via script (Restricted Sites Zone) property is properly set.
Medium - V-22638 - SV-44770r1_rule
RMF Control
Severity
M
CCI
Version
DTBI950
Vuln IDs
  • V-22638
Rule IDs
  • SV-44770r1_rule
This policy setting allows you to manage whether script is allowed to update the status bar within the zone.System AdministratorECSC-1
Checks: C-42276r2_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone “Allow status bar updates via script” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value 2103 is REG_DWORD = 3, this is not a finding.

Fix: F-38221r2_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone “Allow status bar updates via script” will be set to “Enabled” and “Disable” selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2103 to REG_DWORD = 3.

b
Internet Explorer Processes Restrict ActiveX Install (Explorer) property is properly set.
Medium - V-22687 - SV-44648r1_rule
RMF Control
Severity
M
CCI
Version
DTBI1010
Vuln IDs
  • V-22687
Rule IDs
  • SV-44648r1_rule
This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you do not configure this policy setting, the user’s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.System AdministratorECSC-1
Checks: C-42152r2_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> “Internet Explorer Processes” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.

Fix: F-38104r2_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> “Internet Explorer Processes” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: Set the value explorer.exe to REG_SZ = 1.

b
Internet Explorer Processes Restrict ActiveX Install (IExplorer) property is properly set.
Medium - V-22688 - SV-44649r1_rule
RMF Control
Severity
M
CCI
Version
DTBI1020
Vuln IDs
  • V-22688
Rule IDs
  • SV-44649r1_rule
This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you do not configure this policy setting, the user’s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.System AdministratorECSC-1
Checks: C-42153r3_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> “Internet Explorer Processes” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.

Fix: F-38105r2_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> “Internet Explorer Processes” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL Criteria: Set the value iexplore.exe to REG_SZ = 1.

b
Automatic checking for Internet Explorer updates is not disabled.
Medium - V-30777 - SV-44836r1_rule
RMF Control
Severity
M
CCI
Version
DTBI775
Vuln IDs
  • V-30777
Rule IDs
  • SV-44836r1_rule
This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they become available. If you enable this policy setting, Internet Explorer checks the Internet for a new version approximately every 30 days and prompts the user to download new versions when they are available. Newer versions might not comply with the Internet Explorer version requirements of the organization. System AdministratorECSC-1
Checks: C-42318r1_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel-> Advanced Page-> "Automatically check for Internet Explorer updates" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value NoUpdateCheck is REG_DWORD = 1, this is not a finding.

Fix: F-38289r1_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel-> Advanced Page-> "Automatically check for Internet Explorer updates" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value NoUpdateCheck is REG_DWORD = 1, this is not a finding.

b
Internet Explorer Processes for Information bars are enforced (Reserved).
Medium - V-30779 - SV-44845r2_rule
RMF Control
Severity
M
CCI
Version
DTBI815
Vuln IDs
  • V-30779
Rule IDs
  • SV-44845r2_rule
This policy setting allows you to manage whether the Information bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Information bar is displayed for Internet Explorer processes. If you enable this policy setting, the Information bar will be displayed for Internet Explorer Processes. If you disable this policy setting, the Information n bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Information bar will be displayed for Internet Explorer Processes.System AdministratorECSC-1
Checks: C-42314r3_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Information Bar-> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.

Fix: F-38282r3_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Information Bar-> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: Set the value (Reserved) to REG_SZ = 1.

b
Internet Explorer Processes for Information bars is not enforced (Explorer).
Medium - V-30780 - SV-44907r2_rule
RMF Control
Severity
M
CCI
Version
DTBI825
Vuln IDs
  • V-30780
Rule IDs
  • SV-44907r2_rule
This policy setting allows you to manage whether the Information bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Information bar is displayed for Internet Explorer processes. If you enable this policy setting, the Information bar will be displayed for Internet Explorer Processes. If you disable this policy setting, the Information bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Information bar will be displayed for Internet Explorer ProcessesSystem AdministratorECSC-1
Checks: C-42348r2_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Information Bar-> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.

Fix: F-34629r1_fix

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> "Internet Explorer Processes" to “Enabled”.

b
Internet Explorer Processes for Information bars is not enforced (IExplore).
Medium - V-30781 - SV-44909r2_rule
RMF Control
Severity
M
CCI
Version
DTBI835
Vuln IDs
  • V-30781
Rule IDs
  • SV-44909r2_rule
This policy setting allows you to manage whether the Information bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Information bar is displayed for Internet Explorer processes. If you enable this policy setting, the Information bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Information bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Information bar will be displayed for Internet Explorer processes.System AdministratorECSC-1
Checks: C-42351r2_chk

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Information Bar-> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.

Fix: F-38342r2_fix

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Information Bar-> "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Criteria: Set the value iexplore.exe to REG_SZ = 1.

b
Check for publishers certificate revocation must be enforced.
Medium - V-32808 - SV-43161r1_rule
RMF Control
Severity
M
CCI
Version
DTBI018
Vuln IDs
  • V-32808
Rule IDs
  • SV-43161r1_rule
Check for publisher's certificate revocation options should be enforced to ensure all PKI signed objects are validated.System AdministratorECSC-1
Checks: C-41149r2_chk

Procedure: Open Internet Explorer. From the menu bar select Tools. From the Tools dropdown menu, select the Internet Options. From the Internet Options window, select the Advanced tab, from the Advanced tab window scroll down to the Security category, verify a check mark is placed in the "check for publishers certificate revocation" box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Criteria: If the value State is REG_DWORD = 65536 (decimal), this is not a finding.

Fix: F-36697r2_fix

Check mark the option to enable "Check for publishers certificate revocation" in the Internet Explorer Options, Advanced page. NOTE: Manual entry for the value State, set to REG_DWORD = 65536, may first be required