Internet links and Network UNCs created as embedded hyperlinks must be prevented.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17650	DTOO138	SV-53725r1_rule		Medium

Description
When users type a string of characters, Excel recognizes as a Uniform Resource Locator (URL) or Uniform Naming Convention (UNC) path to a resource on the Internet or a local network, Excel will transform it into a hyperlink. Clicking the hyperlink opens it in the configured default web browser or the appropriate application. This functionality can enable users to accidentally create links to dangerous or restricted resources, which could create a security risk.

Description

When users type a string of characters, Excel recognizes as a Uniform Resource Locator (URL) or Uniform Naming Convention (UNC) path to a resource on the Internet or a local network, Excel will transform it into a hyperlink. Clicking the hyperlink opens it in the configured default web browser or the appropriate application. This functionality can enable users to accidentally create links to dangerous or restricted resources, which could create a security risk.

STIG	Date
Microsoft Excel 2013 STIG	2018-04-03

Details

Check Text ( C-47811r1_chk )
Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Proofing -> Autocorrect Options "Internet and network paths as hyperlinks" is set to "Disabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\15.0\excel\options If the value AutoHyperlink is REG_DWORD = 0, this is not a finding.

Check Text ( C-47811r1_chk )

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Proofing -> Autocorrect Options "Internet and network paths as hyperlinks" is set to "Disabled".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\15.0\excel\options

If the value AutoHyperlink is REG_DWORD = 0, this is not a finding.

Fix Text (F-46634r1_fix)
Set the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Proofing -> Autocorrect Options "Internet and network paths as hyperlinks" to "Disabled".