Browser must retain history on exit.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22148	DTBI760	SV-40707r1_rule	ECSC-1	Medium

Description
Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious web sites and files that could later be used for anti-virus and intrusion detection system (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.

Description

Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious web sites and files that could later be used for anti-virus and intrusion detection system (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.

STIG	Date
Microsoft Internet Explorer 9 Security Technical Implementation Guide	2012-09-11

Details

Check Text ( C-39435r2_chk )
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> “Configure Delete Browsing History on exit” must be “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: If the value ClearBrowsingHistoryOnExit is REG_DWORD = 0, this is not a finding.

Check Text ( C-39435r2_chk )

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> “Configure Delete Browsing History on exit” must be “Disabled”.

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy

Criteria: If the value ClearBrowsingHistoryOnExit is REG_DWORD = 0, this is not a finding.

Fix Text (F-34563r1_fix)
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> “Configure Delete Browsing History on exit” to “Disabled”.