AutoComplete feature for forms must be disallowed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15574	DTBI690	SV-45099r1_rule	ECSC-1	Medium

Description
This AutoComplete feature suggests possible matches when users are filling in forms. It is possible that this feature will cache sensitive data and store it in the user's profile, where it might not be protected as rigorously as required by organizational policy. If you enable this setting, the user is not presented with suggested matches when filling in forms. If you disable this setting, the user is presented with suggested possible matches when filling forms. If you do not configure this setting, the user has the freedom to turn on the auto-complete feature for forms. To display this option, the user opens the Internet Options dialog box, clicks the Contents Tab, and clicks the Settings button.

Description

This AutoComplete feature suggests possible matches when users are filling in forms. It is possible that this feature will cache sensitive data and store it in the user's profile, where it might not be protected as rigorously as required by organizational policy. If you enable this setting, the user is not presented with suggested matches when filling in forms. If you disable this setting, the user is presented with suggested possible matches when filling forms. If you do not configure this setting, the user has the freedom to turn on the auto-complete feature for forms. To display this option, the user opens the Internet Options dialog box, clicks the Contents Tab, and clicks the Settings button.

STIG	Date
Microsoft Internet Explorer 10 Security Technical Implementation Guide	2013-04-01

Details

Check Text ( C-42457r1_chk )
The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable AutoComplete for forms" must be "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value Use FormSuggest is REG_SZ = no, this is not a finding.

Fix Text (F-38499r1_fix)
Set the policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable AutoComplete for forms" to "Enabled".