{
"stig": {
"date": "2015-12-17",
"description": "Settings in this guidance assume a complete installation of Microsoft Internet Explorer 9 on the Windows 7 Platform. Registry paths and values identified in each control assume the use of Group Policy Administrative Templates. Installations not using Group Policies to administer Microsoft Browser products may observe alternate registry paths for stored configuration values.",
"findings": {
"V-14245": {
"checkid": "C-39307r5_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \u201cDo Not Allow Users to enable or Disable Add-Ons\u201d must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Restrictions\n\nCriteria: If the value NoExtensionManagement does not exist or the value is set to REG_DWORD = 0, this is not a finding. ",
"description": "Users often choose to install add-ons that are not permitted by an organization's security policy. Such add-ons can pose a significant security and privacy risk to your network. This policy setting allows you to manage whether users have the ability to allow or deny add-ons through Add-On Manager. If you enable this policy setting, users cannot enable or disable add-ons through Add-On Manager. The only exception occurs if an add-on has been specifically entered into the 'Add-On List' policy setting in such a way as to allow users to continue to manage the add-on. In this case, the user can still manage the add-on. If you disable or do not configure this policy setting, the appropriate controls in the Add-On Manager will be available to the user. ",
"fixid": "F-34418r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> \u201cDo Not Allow Users to enable or Disable Add-Ons\u201d to \u201cDisabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-14245",
"ruleID": "SV-40529r1_rule",
"severity": "low",
"title": "Ability for users to enable or disable add-ons must be enforced.",
"version": "DTBI697"
},
"V-15490": {
"checkid": "C-39308r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable changing Automatic Configuration settings\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel \n\nCriteria: If the value Autoconfig is REG_DWORD = 1 (Hex), this is not a finding.",
"description": "This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. This setting specifies that Internet Explorer use the configuration settings provided in a file by the system administrator. If you enable this policy setting, the user will not be able to do automatic configuration. You can import current connection settings using Internet Explorer Maintenance under Admin Templates using group policy editor. If you disable or do not configure this policy setting, the user will have the freedom to automatically configure these settings.",
"fixid": "F-34419r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable changing Automatic Configuration settings\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15490",
"ruleID": "SV-40530r1_rule",
"severity": "medium",
"title": "Automatic configuration of Internet Explorer must be disallowed.",
"version": "DTBI305"
},
"V-15492": {
"checkid": "C-39309r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Prevent participation in the Customer Experience Improvement Program\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\SQM \n\nCriteria: If the value DisableCustomerImprovementProgram is REG_DWORD = 0, this is not a finding.",
"description": "This setting controls whether users can participate in the Microsoft Customer Experience Improvement Program to help improve Microsoft applications. When users choose to participate in the Customer Experience Improvement Program (CEIP), applications automatically send information to Microsoft about how the applications are used. This information is combined with other CEIP data to help Microsoft solve problems and to improve the products and features customers use most often. This feature does not collect users' names, addresses, or any other identifying information except the IP address that is used to send the data. By default, users have the opportunity to opt into participation in the CEIP the first time they run an application. If an organization has policies that govern the use of external resources such as the CEIP, allowing users to opt in to the program might cause them to violate these policies.",
"fixid": "F-34420r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Prevent participation in the Customer Experience Improvement Program\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15492",
"ruleID": "SV-40531r1_rule",
"severity": "medium",
"title": "Participation in the Customer Experience Improvement Program must be disallowed.",
"version": "DTBI315"
},
"V-15494": {
"checkid": "C-39314r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn off the Security Settings Check feature\" must be \u201cDisabled\u201d.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Security \n\nCriteria: If the value DisableSecuritySettingsCheck is REG_DWORD = 0, this is not a finding.",
"description": "This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this policy setting, the security settings check will not be performed. If you disable or do not configure this policy setting, the security settings check will be performed.",
"fixid": "F-34423r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn off the Security Settings Check feature\" to \u201cDisabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15494",
"ruleID": "SV-40547r1_rule",
"severity": "medium",
"title": "Security checking features must be enforced.",
"version": "DTBI325"
},
"V-15497": {
"checkid": "C-39365r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Allow active content from CDs to run on user machines\" must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\Settings \n\nCriteria: If the value LOCALMACHINE_CD_UNLOCK is REG_DWORD = 0, this is not a finding. ",
"description": "This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run. If you enable this policy setting, active content on a CD will run without a prompt. If you disable this policy setting, active content on a CD will always prompt before running. If you do not configure this policy, users can choose whether to be prompted before running active content on a CD.",
"fixid": "F-34479r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Allow active content from CDs to run on user machines\" to \u201cDisabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15497",
"ruleID": "SV-40626r1_rule",
"severity": "medium",
"title": "Active content from CDs must be disallowed to run on user machines.",
"version": "DTBI340"
},
"V-15499": {
"checkid": "C-39366r3_chk",
"checktext": "Note: Some legitimate software and controls may have an invalid signature. You should carefully test such software in isolation before it is allowed to be used on an organization's network.\n\nThe policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Allow software to run or install even if the signature is invalid\" must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Download \n\nCriteria: If the value RunInvalidSignatures is REG_DWORD = 0, this is not a finding.",
"description": "Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure unmodified software is downloaded and the user can positively identify the signer to determine whether you trust them enough to run their software. The validity of unsigned code cannot be ascertained.",
"fixid": "F-34480r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Allow software to run or install even if the signature is invalid\" to \u201cDisabled\u201d.",
"iacontrols": [
"DCMC-1"
],
"id": "V-15499",
"ruleID": "SV-40627r2_rule",
"severity": "medium",
"title": "Software must be disallowed to run or install with invalid signatures.",
"version": "DTBI350"
},
"V-15500": {
"checkid": "C-39367r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Allow third-party browser extensions\" must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main \n\nCriteria: If the value Enable Browser Extensions is REG_SZ = no, this is not a finding. ",
"description": "This policy setting allows you to manage whether Internet Explorer will launch COM add-ons, known as browser helper objects such as toolbars. Browser helper objects may contain flaws such as buffer overruns which impact Internet Explorer's performance or stability. If you enable this policy setting, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer. If you disable this policy setting, browser helper objects do not launch. If you do not configure this policy, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer.",
"fixid": "F-34481r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Allow third-party browser extensions\" to \u201cDisabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15500",
"ruleID": "SV-40628r2_rule",
"severity": "medium",
"title": "Third-party browser extensions must be disallowed.",
"version": "DTBI355"
},
"V-15502": {
"checkid": "C-39368r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Check for server certificate revocation\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \n\nCriteria: If the value CertificateRevocation is REG_DWORD = 1, this is not a finding. ",
"description": "This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure. If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked. If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.",
"fixid": "F-34482r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Check for server certificate revocation\" to \u201cEnabled\u201d. ",
"iacontrols": [
"IATS-1",
"IATS-2"
],
"id": "V-15502",
"ruleID": "SV-40629r1_rule",
"severity": "medium",
"title": "Checking for server certificate revocation must be enforced.",
"version": "DTBI365"
},
"V-15503": {
"checkid": "C-39369r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Check for signatures on downloaded programs\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Download \n\nCriteria: If the value CheckExeSignatures is REG_SZ = yes, this is not a finding. ",
"description": "This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified or tampered with) on user computers before downloading executable programs. If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers. If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.",
"fixid": "F-34483r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> \"Check for signatures on downloaded programs\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15503",
"ruleID": "SV-40630r1_rule",
"severity": "medium",
"title": "Checking for signatures on downloaded programs must be enforced.",
"version": "DTBI370"
},
"V-15504": {
"checkid": "C-39370r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> \"Intranet Sites: Include all network paths (UNCs)\" must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap \n\nCriteria: If the value UNCAsIntranet is REG_DWORD = 0, this is not a finding.",
"description": "Some UNC paths could refer to servers not managed by the organization which means they could host malicious content and therefore, it is safest to not include all UNC paths in the Intranet Sites zone. This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there). If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.",
"fixid": "F-34484r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> \"Intranet Sites: Include all network paths (UNCs)\" to \u201cDisabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15504",
"ruleID": "SV-40632r1_rule",
"severity": "medium",
"title": "All network paths (UNCs) for Intranet sites must be disallowed. ",
"version": "DTBI375"
},
"V-15507": {
"checkid": "C-39371r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow script-initiated windows without size or position constraints\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2102 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.",
"fixid": "F-34485r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow script-initiated windows without size or position constraints\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15507",
"ruleID": "SV-40633r1_rule",
"severity": "medium",
"title": "Script-initiated windows without size or position constraints must be disallowed (Internet zone).",
"version": "DTBI385"
},
"V-15508": {
"checkid": "C-39372r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Allow script-initiated windows without size or position constraints\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2102 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.",
"fixid": "F-34486r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Allow script-initiated windows without size or position constraints\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15508",
"ruleID": "SV-40634r1_rule",
"severity": "medium",
"title": "Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone).",
"version": "DTBI390"
},
"V-15509": {
"checkid": "C-39373r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow Scriptlets\" must be \u201cEnabled\u201d and \"Disable\" from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1209 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.",
"fixid": "F-34488r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow Scriptlets\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15509",
"ruleID": "SV-40635r1_rule",
"severity": "medium",
"title": "Scriptlets must be disallowed (Internet zone).",
"version": "DTBI395"
},
"V-15513": {
"checkid": "C-39374r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Automatic prompting for file downloads\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2200 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt.",
"fixid": "F-34490r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Automatic prompting for file downloads\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15513",
"ruleID": "SV-40636r1_rule",
"severity": "medium",
"title": "Automatic prompting for file downloads must be disallowed (Internet zone).",
"version": "DTBI415"
},
"V-15515": {
"checkid": "C-39375r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0 \n\nCriteria: If the value 1C00 is REG_DWORD = 0, this is not a finding. ",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34491r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> \"Java permissions\" to \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-15515",
"ruleID": "SV-40637r2_rule",
"severity": "medium",
"title": "Java permissions must be disallowed (Local Machine zone).",
"version": "DTBI425"
},
"V-15516": {
"checkid": "C-39376r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0 \n\nCriteria: If the value 1C00 is REG_DWORD = 0, this is not a finding. ",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34492r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> \"Java permissions\" to \u201cEnabled\u201d and select \"Disable Java\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-15516",
"ruleID": "SV-40638r2_rule",
"severity": "medium",
"title": "Java permissions must be disallowed (Locked Down Local Machine zone).",
"version": "DTBI430"
},
"V-15517": {
"checkid": "C-39377r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1 \n\nCriteria: If the value 1C00 is REG_DWORD = 0, this is not a finding. ",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34493r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> \"Java permissions\" to \u201cEnabled\u201d and select \"Disable Java\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-15517",
"ruleID": "SV-40639r2_rule",
"severity": "medium",
"title": "Java permissions must be disallowed (Locked Down Intranet zone).",
"version": "DTBI435"
},
"V-15518": {
"checkid": "C-39378r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2 \n\nCriteria: If the value 1C00 is REG_DWORD = 0, this is not a finding. ",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34494r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> \"Java permissions\" to \u201cEnabled\u201d and select \"Disable Java\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-15518",
"ruleID": "SV-40640r2_rule",
"severity": "medium",
"title": "Java permissions must be disallowed (Locked Down Trusted Sites zone).",
"version": "DTBI440"
},
"V-15519": {
"checkid": "C-39379r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Internet Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3 \n\nCriteria: If the value 1C00 is REG_DWORD = 0, this is not a finding. ",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34495r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Internet Zone -> \"Java permissions\" to \u201cEnabled\u201d and select \"Disable Java\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-15519",
"ruleID": "SV-40641r2_rule",
"severity": "medium",
"title": "Java permissions must be disallowed (Locked Down Internet zone).",
"version": "DTBI445"
},
"V-15520": {
"checkid": "C-39380r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4 \n\nCriteria: If the value 1C00 is REG_DWORD = 0, this is not a finding. ",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34497r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> \"Java permissions\" to \u201cEnabled\u201d and select \"Disable Java\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-15520",
"ruleID": "SV-40642r2_rule",
"severity": "medium",
"title": "Java permissions must be disallowed (Locked Down Restricted Sites zone).",
"version": "DTBI450"
},
"V-15521": {
"checkid": "C-39381r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Loose XAML files\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2402 is REG_DWORD = 3, this is not a finding. ",
"description": "These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the dropdown box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.",
"fixid": "F-34498r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Loose XAML files\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15521",
"ruleID": "SV-40643r1_rule",
"severity": "medium",
"title": "Loose XAML files must be disallowed (Internet zone).",
"version": "DTBI455"
},
"V-15522": {
"checkid": "C-39382r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Loose XAML files\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2402 is REG_DWORD = 3, this is not a finding. ",
"description": "These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the dropdown box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.",
"fixid": "F-34499r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Loose XAML files\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15522",
"ruleID": "SV-40644r1_rule",
"severity": "medium",
"title": "Loose XAML files must be disallowed (Restricted Sites zone).",
"version": "DTBI460"
},
"V-15523": {
"checkid": "C-39383r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Enable MIME Sniffing\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2100 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature. If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone.",
"fixid": "F-34500r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Enable MIME Sniffing\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15523",
"ruleID": "SV-40645r1_rule",
"severity": "medium",
"title": "MIME sniffing must be disallowed (Internet zone).",
"version": "DTBI465"
},
"V-15524": {
"checkid": "C-39385r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Enable MIME Sniffing \" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2100 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature. If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone.",
"fixid": "F-34502r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Enable MIME Sniffing\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15524",
"ruleID": "SV-40647r1_rule",
"severity": "medium",
"title": "MIME sniffing must be disallowed (Restricted Sites zone).",
"version": "DTBI470"
},
"V-15525": {
"checkid": "C-39387r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Turn Off First-Run Opt-In\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1208 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting controls the First Run response that users see on a zone-by-zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control. This feature determines if the user gets the prompt or not. If you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone. If you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone. If you do not configure this policy setting, the first-run prompt is turned off by default.",
"fixid": "F-34504r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Turn Off First-Run Opt-In\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15525",
"ruleID": "SV-40648r1_rule",
"severity": "medium",
"title": "First-Run Opt-In ability must be disallowed (Internet zone).",
"version": "DTBI475"
},
"V-15526": {
"checkid": "C-39388r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Turn Off First-Run Opt-In\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1208 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting controls the First Run response that users see on a zone-by-zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control. This feature determines if the user gets the prompt or not. If you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone. If you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone. If you do not configure this policy setting, the first-run prompt is turned off by default.",
"fixid": "F-34505r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Turn Off First-Run Opt-In\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15526",
"ruleID": "SV-40649r1_rule",
"severity": "medium",
"title": "First-Run Opt-In ability must be disallowed (Restricted Sites zone).",
"version": "DTBI480"
},
"V-15527": {
"checkid": "C-39389r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Turn on Protected Mode\" must be \u201cEnabled\u201d and \"Enable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2500 is REG_DWORD = 0, this is not a finding. ",
"description": "Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off protected mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode. If you do not configure this policy, users will be able to turn on or off protected mode. ",
"fixid": "F-34507r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Turn on Protected Mode\" to \u201cEnabled\u201d and select \"Enable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15527",
"ruleID": "SV-40650r2_rule",
"severity": "medium",
"title": "Protected Mode must be enforced (Internet zone).",
"version": "DTBI485"
},
"V-15528": {
"checkid": "C-39391r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Turn on Protected Mode\" must be \u201cEnabled\u201d and \"Enable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2500 is REG_DWORD = 0, this is not a finding.",
"description": "Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off protected mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode. If you do not configure this policy, users will be able to turn on or off protected mode.\n",
"fixid": "F-34509r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Turn on Protected Mode\" to \u201cEnabled\u201d and select \"Enable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15528",
"ruleID": "SV-40652r1_rule",
"severity": "medium",
"title": "Protected Mode must be enforced (Restricted Sites zone).",
"version": "DTBI490"
},
"V-15529": {
"checkid": "C-39392r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Use Pop-up Blocker\" must be \u201cEnabled\u201d and \"Enable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1809 is REG_DWORD = 0, this is not a finding. ",
"description": "This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.",
"fixid": "F-34510r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Use Pop-up Blocker\" to \u201cEnabled\u201d and select \"Enable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15529",
"ruleID": "SV-40654r1_rule",
"severity": "medium",
"title": "Pop-up Blocker must be enforced (Internet zone).",
"version": "DTBI495"
},
"V-15530": {
"checkid": "C-39393r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Use Pop-up Blocker\" must be \u201cEnabled\u201d and \"Enable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1809 is REG_DWORD = 0, this is not a finding. ",
"description": "This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.",
"fixid": "F-34511r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Use Pop-up Blocker\" to \u201cEnabled\u201d and select \"Enable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15530",
"ruleID": "SV-40655r1_rule",
"severity": "medium",
"title": "Pop-up Blocker must be enforced (Restricted Sites zone).",
"version": "DTBI500"
},
"V-15533": {
"checkid": "C-39394r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Web sites in less privileged Web content zones can navigate into this zone\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2101 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage whether web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. If you enable this policy setting, web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. If you do not configure this policy setting, web sites from less privileged zones can open new windows in, or navigate into, this zone.",
"fixid": "F-34512r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Web sites in less privileged Web content zones can navigate into this zone\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15533",
"ruleID": "SV-40656r1_rule",
"severity": "medium",
"title": "Web sites in less privileged web content zones must be disallowed to navigate into the Internet zone.",
"version": "DTBI515"
},
"V-15534": {
"checkid": "C-39395r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Web sites in less privileged Web content zones can navigate into this zone\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2101 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage whether web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. If you enable this policy setting, web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. If you do not configure this policy setting, web sites from less privileged zones can open new windows in, or navigate into, this zone.",
"fixid": "F-34513r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Web sites in less privileged Web content zones can navigate into this zone\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15534",
"ruleID": "SV-40657r1_rule",
"severity": "medium",
"title": "Web sites in less privileged web content zones must be disallowed to navigate into the Restricted Site zone.",
"version": "DTBI520"
},
"V-15545": {
"checkid": "C-39396r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Allow binary and script behaviors\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2000 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage dynamic binary and script behaviors; components that encapsulate specific functionality for HTML elements to which they were attached. If you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available. If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. If you do not configure this policy setting, binary and script behaviors are available.",
"fixid": "F-34515r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Allow binary and script behaviors\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15545",
"ruleID": "SV-40659r1_rule",
"severity": "medium",
"title": "Allow binary and script behaviors must be disallowed (Restricted Sites zone).",
"version": "DTBI575"
},
"V-15546": {
"checkid": "C-39397r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Automatic prompting for file downloads\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2200 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt.",
"fixid": "F-34516r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Automatic prompting for file downloads\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15546",
"ruleID": "SV-40661r1_rule",
"severity": "medium",
"title": "Automatic prompting for file downloads must be disallowed (Restricted Sites zone).",
"version": "DTBI580"
},
"V-15548": {
"checkid": "C-39398r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_HANDLING \n\nCriteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. ",
"fixid": "F-34518r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15548",
"ruleID": "SV-40662r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MIME handling must be enforced (Reserved).",
"version": "DTBI590"
},
"V-15549": {
"checkid": "C-39399r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_SNIFFING \n\nCriteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.",
"description": "MIME sniffing is the process of examining the content of a MIME file to determine its context \u2014 whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.",
"fixid": "F-34519r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15549",
"ruleID": "SV-40663r2_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MIME sniffing must be enforced (Reserved).",
"version": "DTBI595"
},
"V-15550": {
"checkid": "C-39400r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_DISABLE_MK_PROTOCOL \n\nCriteria: If the value explorer.exe is REG_SZ = 1, this is not a finding",
"description": "The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to enabled, blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This guide recommends you configure this setting to Enabled to block the MK protocol unless it is specifically needed it in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.",
"fixid": "F-34520r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15550",
"ruleID": "SV-40665r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MK protocol must be enforced (Explorer).",
"version": "DTBI600"
},
"V-15551": {
"checkid": "C-39401r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_DISABLE_MK_PROTOCOL \n\nCriteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.",
"description": "The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to enabled, blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This guide recommends you configure this setting to Enabled to block the MK protocol unless specifically needed it in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.",
"fixid": "F-34522r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15551",
"ruleID": "SV-40667r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MK protocol must be enforced (IExplore).",
"version": "DTBI605"
},
"V-15552": {
"checkid": "C-39402r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ZONE_ELEVATION \n\nCriteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.",
"fixid": "F-34524r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15552",
"ruleID": "SV-40671r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for Zone Elevation must be enforced (Reserved).",
"version": "DTBI610"
},
"V-15556": {
"checkid": "C-39403r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_FILEDOWNLOAD \n\nCriteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.",
"description": "In certain circumstances, web sites can initiate file download prompts without interaction from users. This technique can allow web sites to put unauthorized files on user's hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.",
"fixid": "F-34525r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15556",
"ruleID": "SV-40672r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for Restrict File Download must be enforced (Reserved).",
"version": "DTBI630"
},
"V-15557": {
"checkid": "C-39404r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_FILEDOWNLOAD \n\nCriteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.",
"description": "In certain circumstances, web sites can initiate file download prompts without interaction from users. This technique can allow web sites to put unauthorized files on user's hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.",
"fixid": "F-34526r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15557",
"ruleID": "SV-40673r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for Restrict File Download must be enforced (Explorer).",
"version": "DTBI635"
},
"V-15558": {
"checkid": "C-39405r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_FILEDOWNLOAD \n\nCriteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.",
"description": "In certain circumstances, web sites can initiate file download prompts without interaction from users. This technique can allow web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.",
"fixid": "F-34527r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15558",
"ruleID": "SV-40674r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for Restrict File Download must be enforced (IExplore).",
"version": "DTBI640"
},
"V-15559": {
"checkid": "C-39406r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_WINDOW_RESTRICTIONS \n\nCriteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable web sites will resize windows to either hide other windows or force the user to interact with a window containing malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows\u2019 title and status bars. If you enable the Scripted Window Security Restrictions\\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows, and windows that hide other windows. Recommend configuring this setting to Enabled to help prevent malicious web sites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.",
"fixid": "F-34529r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15559",
"ruleID": "SV-40676r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved).",
"version": "DTBI645"
},
"V-15560": {
"checkid": "C-39407r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Run .NET Framework-reliant components not signed with Authenticode\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2004 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.\n",
"fixid": "F-34530r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Run .NET Framework-reliant components not signed with Authenticode\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15560",
"ruleID": "SV-40677r1_rule",
"severity": "medium",
"title": ".NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Site Zone).",
"version": "DTBI650"
},
"V-15561": {
"checkid": "C-39408r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Run .NET Framework-reliant components signed with Authenticode\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2001 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will execute signed managed components.\n",
"fixid": "F-34532r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Run .NET Framework-reliant components signed with Authenticode\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15561",
"ruleID": "SV-40678r1_rule",
"severity": "medium",
"title": ".NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Site Zone).",
"version": "DTBI655"
},
"V-15562": {
"checkid": "C-39409r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Scripting of Java applets\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1402 is REG_DWORD = 3, this is not a finding. ",
"description": "This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets. If you disable this policy setting, scripts are prevented from accessing applets. If you do not configure this policy setting, scripts can access applets automatically without user intervention.",
"fixid": "F-34533r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Scripting of Java applets\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15562",
"ruleID": "SV-40679r2_rule",
"severity": "medium",
"title": "Scripting of Java applets must be disallowed (Restricted Sites zone).",
"version": "DTBI670"
},
"V-15563": {
"checkid": "C-39410r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> \"Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools\" must be \u201cEnabled\u201d with a \"blank or empty\" selection box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main \n\nCriteria: The Update_Check_Page value must exist. The value must contain no data value. If the value Update_Check_Page is not present, this is a finding. ",
"description": "This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer. If you enable this policy setting, users will not be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools. The URL must be specified to be displayed for checking updates to Internet Explorer and Internet Tools. If you disable or do not configure this policy setting, users will be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools.",
"fixid": "F-34534r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> \"Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools\" to \u201cEnabled\u201d with a \"blank or empty\" selection box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15563",
"ruleID": "SV-40680r1_rule",
"severity": "medium",
"title": "The URL to be displayed for checking updates to Internet Explorer and Internet Tools must be about:blank.",
"version": "DTBI675"
},
"V-15564": {
"checkid": "C-39411r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> \"Turn off configuring the update check interval (in days)\" must be \u201cEnabled\u201d and \"30\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main \n\nCriteria: If the value Update_Check_Interval is REG_DWORD = 30 (Decimal), this is not a finding.",
"description": "Although Microsoft thoroughly tests all patches and service packs before they are published, organizations should carefully control all of the software that is installed on their managed computers. This setting specifies the update check interval, automatic installation and the default interval value, which is 30 days. If you enable this policy setting, the user will not be able to configure the update check interval, and computers will not automatically download and install updates for Internet Explorer. The update check interval must be specified. If you disable or do not configure this policy setting, the user will have the freedom to configure the update check interval.",
"fixid": "F-34535r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> \"Turn off configuring the update check interval (in days)\" to \u201cEnabled\u201d and select \"30\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15564",
"ruleID": "SV-40681r1_rule",
"severity": "medium",
"title": "The update check interval must be configured and set to 30 days.",
"version": "DTBI680"
},
"V-15565": {
"checkid": "C-39412r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_HANDLING \n\nCriteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to the organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as Enabled for all environments specified in this guide.",
"fixid": "F-34536r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15565",
"ruleID": "SV-40682r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MIME handling must be enforced (Explorer).",
"version": "DTBI592"
},
"V-15566": {
"checkid": "C-39415r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_HANDLING \n\nCriteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as Enabled for all environments specified in this guide.",
"fixid": "F-34543r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15566",
"ruleID": "SV-40685r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MIME handling must be enforced (IExplore).",
"version": "DTBI594"
},
"V-15568": {
"checkid": "C-39416r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_DISABLE_MK_PROTOCOL \n\nCriteria: If the value (Reserved) is REG_SZ = 1, this is not a finding",
"description": "The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to enabled, blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends configuring this setting to Enabled to block the MK protocol unless it is specifically needed it in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.",
"fixid": "F-34544r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15568",
"ruleID": "SV-40686r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MK protocol must be enforced (Reserved).",
"version": "DTBI599"
},
"V-15569": {
"checkid": "C-39417r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ZONE_ELEVATION \n\nCriteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends configuring this setting as Enabled in all environments.",
"fixid": "F-34545r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15569",
"ruleID": "SV-40687r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for Zone Elevation must be enforced (Explorer).",
"version": "DTBI612"
},
"V-15570": {
"checkid": "C-39418r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ZONE_ELEVATION \n\nCriteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.",
"fixid": "F-34546r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15570",
"ruleID": "SV-40688r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for Zone Elevation must be enforced (IExplore).",
"version": "DTBI614"
},
"V-15571": {
"checkid": "C-39419r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_WINDOW_RESTRICTIONS \n\nCriteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable web sites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows\u2019 title and status bars. If you enable the Scripted Window Security Restrictions\\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This guide recommends configuring this setting to Enabled to help prevent malicious web sites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.",
"fixid": "F-34547r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15571",
"ruleID": "SV-40689r1_rule",
"severity": "medium",
"title": "\u00a0Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer).",
"version": "DTBI647"
},
"V-15572": {
"checkid": "C-39420r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_WINDOW_RESTRICTIONS \n\nCriteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.",
"description": "Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable web sites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows\u2019 title and status bars. If you enable the Scripted Window Security Restrictions\\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This guide recommends configuring this setting to Enabled to help prevent malicious web sites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.",
"fixid": "F-34548r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15572",
"ruleID": "SV-40690r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for restricting pop-up windows must be enforced (IExplore).",
"version": "DTBI649"
},
"V-15574": {
"checkid": "C-39421r4_chk",
"checktext": "The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable AutoComplete for forms\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Main \n\nCriteria: If the value Use FormSuggest is REG_SZ = no, this is not a finding. ",
"description": "This AutoComplete feature suggests possible matches when users are filling in forms. If you enable this setting, the user is not suggested matches when filling forms. The user cannot change it. If you disable this setting, the user is suggested possible matches when filling forms. The user cannot change it. If you do not configure this setting, the user has the freedom to turn on the auto-complete feature for forms. To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button.",
"fixid": "F-34549r1_fix",
"fixtext": "Set the policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable AutoComplete for forms\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15574",
"ruleID": "SV-40691r1_rule",
"severity": "medium",
"title": "AutoComplete feature for forms must be disallowed.",
"version": "DTBI690"
},
"V-15575": {
"checkid": "C-39422r2_chk",
"checktext": "The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable external branding of Internet Explorer\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Restrictions \n\nCriteria: If the value NoExternalBranding is REG_DWORD = 1, this is not a finding.",
"description": "Prevents branding of Internet programs, such as customization of Internet Explorer and Outlook Express logos and title bars, by another party. If you enable this policy, it prevents customization of the browser by another party, such as an Internet service provider or Internet content provider. If you disable this policy or do not configure it, users could install customizations from another party-for example, when signing up for Internet services. This policy is intended for administrators who want to maintain a consistent browser across an organization.",
"fixid": "F-34550r1_fix",
"fixtext": "Set the policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable external branding of Internet Explorer\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15575",
"ruleID": "SV-40692r1_rule",
"severity": "medium",
"title": "External branding feature of Internet Explorer must be disallowed .",
"version": "DTBI695"
},
"V-15579": {
"checkid": "C-39423r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn off Crash Detection\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Restrictions \n\nCriteria: If the value NoCrashDetection is REG_DWORD = 1, this is not a finding. ",
"description": "The Turn off Crash Detection policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP Professional Service Pack 1 and earlier; Windows Error Reporting will be invoked. If you disable this policy setting, the crash detection feature in add-on management will be functional. Because Internet Explorer crash report information could contain sensitive information from the computer's memory, this guide recommends configuring this option to Enabled unless experiencing frequent repeated crashes and need to report them for follow-up troubleshooting. In those cases, you could temporarily configure the setting to Disabled.",
"fixid": "F-34551r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn off Crash Detection\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15579",
"ruleID": "SV-40693r1_rule",
"severity": "medium",
"title": "Crash Detection must be enforced.",
"version": "DTBI715"
},
"V-15581": {
"checkid": "C-39424r4_chk",
"checktext": "The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn on the auto-complete feature for user names and passwords on forms\" must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Main \n\nCriteria: If the value FormSuggest Passwords is REG_SZ = no, this is not a finding. ",
"description": "It is possible this feature will cache sensitive data and store it in the user's profile where it might not be protected as rigorously as required by organizational policy. This policy setting controls automatic completion of fields in forms on web pages. If you enable this setting, the user cannot change \"User name and passwords on forms\" or \"prompt me to save passwords\". The Auto Complete feature for user names and passwords on forms will be turned on. If you disable this setting, the user cannot change \"User name and passwords on forms\" or \"prompt me to save passwords\". The Auto Complete feature for user names and passwords on forms is turned off. The user also cannot opt to be prompted to save passwords. If you do not configure this setting, the user has the freedom of turning on Auto Complete for user name and passwords on forms, and the option of prompting to save passwords. ",
"fixid": "F-34552r1_fix",
"fixtext": "Set the policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn on the auto-complete feature for user names and passwords on forms\" to \u201cDisabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-15581",
"ruleID": "SV-40694r1_rule",
"severity": "medium",
"title": "AutoComplete feature for user names and passwords on forms must be disallowed.",
"version": "DTBI725"
},
"V-15603": {
"checkid": "C-39425r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_SNIFFING \n\nCriteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.",
"description": "MIME sniffing is the process of examining the content of a MIME file to determine its context \u2014 whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME handling settings.",
"fixid": "F-34554r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15603",
"ruleID": "SV-40695r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MIME sniffing must be enforced (Explorer).",
"version": "DTBI596"
},
"V-15604": {
"checkid": "C-39427r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_SNIFFING \n\nCriteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.",
"description": "MIME sniffing is the process of examining the content of a MIME file to determine its context \u2014 whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME handling settings.",
"fixid": "F-34556r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> \"Internet Explorer Processes\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-15604",
"ruleID": "SV-40700r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for MIME sniffing must be enforced (IExplore).",
"version": "DTBI597"
},
"V-17296": {
"checkid": "C-39428r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Prevent performance of First Run Customize settings\" must be \u201cEnabled\u201d and \"Go directly to home page\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main \n\nCriteria: If the value DisableFirstRunCustomize is REG_DWORD = 1, this is not a finding. ",
"description": "This policy setting prevents performance of the First Run Customize settings ability and provides central management controls of what web page will be provided to the user when they launch Internet Explorer for the first time after installation of Internet Explorer. If you enable this policy setting, you can configure one of two choices: \n1) Skip Customize Settings, and go directly to the user\u2019s home page, or \n2) Skip Customize Settings, and go directly to the \"Welcome to Internet Explorer\" Web page. \nIf you disable or do not configure this policy setting, users go through the regular first run process.\n",
"fixid": "F-34557r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Prevent performance of First Run Customize settings\" to \u201cEnabled\u201d and select \"Go directly to home page\" from the drop-down box.\n",
"iacontrols": [
"ECSC-1"
],
"id": "V-17296",
"ruleID": "SV-40701r1_rule",
"severity": "medium",
"title": "First Run Customize settings must be enabled as home page.",
"version": "DTBI010"
},
"V-21887": {
"checkid": "C-39429r3_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> \"Disable \"Configuring History\" \" must be \u201cEnabled\u201d and \"40\" entered in 'Days to keep pages in History'. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel \n\nCriteria: If the value History is REG_DWORD = 1, this is not a finding. \n\nAND \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Url History \n\nCriteria: If the value DaysToKeep is REG_DWORD = 40 (decimal), this is not a finding.",
"description": "This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, General tab, and then click Settings under Browsing History. If you enable this policy setting, a user cannot set the number of days that Internet Explorer keeps track of the pages viewed in the History List. The number of days that Internet Explorer keeps track of the pages viewed in the History List must be specified. Users will not be able to delete browsing history. If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History List. Users can delete browsing history.",
"fixid": "F-34558r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> \"Disable \"Configuring History\" \" to \u201cEnabled\u201d and enter \"40\" entered in 'Days to keep pages in History'. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-21887",
"ruleID": "SV-40702r1_rule",
"severity": "medium",
"title": "Configuring History setting must be set to 40 days.",
"version": "DTBI300"
},
"V-22108": {
"checkid": "C-39431r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn off Managing SmartScreen Filter for Internet Explorer 9\" must be \u201cEnabled\u201d and \u201cOff\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter \n\nCriteria: If the value EnabledV9 is REG_DWORD = 0, this is not a finding.",
"description": "This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection via visiting malicious web sites. This policy setting allows the users to enable the SmartScreen Filter, which will warn if the web site being visited is known for fraudulent attempts to gather personal information through \"phishing\" or is known to host malware. If you enable this setting, the user will not be prompted to enable the SmartScreen Filter. It must be specified which mode the SmartScreen Filter uses: on or off. If the feature is on, all web site addresses not contained on the filter's allow list, will be sent automatically to Microsoft without prompting the user. If the feature is off, the user will be prompted to decide the mode of operation for the SmartScreen Filter during the first run experience.",
"fixid": "F-34560r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn off Managing SmartScreen Filter for Internet Explorer 9\" to \u201cEnabled\u201d and select \u201cOff\u201d from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22108",
"ruleID": "SV-40704r1_rule",
"severity": "medium",
"title": "Managing SmartScreen Filter use must be enforced.",
"version": "DTBI740"
},
"V-22147": {
"checkid": "C-39433r3_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Compatibility View -> \u201cInclude updated Web site lists from Microsoft\u201d must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\BrowserEmulation \n\nCriteria: If the value MSCompatibilityMode is REG_DWORD = 0, this is not a finding.",
"description": "This policy controls the web site compatibility lists provided by Microsoft. If you enable this policy setting, the compatibility web site lists provided by Microsoft will be used during browser navigation. If a user visits a site on the compatibility list provided by Microsoft, the page will automatically display in Compatibility view. If you disable this policy setting, the Microsoft web site list will not be used. Additionally, users can not enable the feature using the Compatibility View Settings dialog box. If you do not configure this setting, the Microsoft web site list will not be active. The user can enable the functionality using the Compatibility View Settings dialog box.",
"fixid": "F-34562r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Compatibility View -> \u201cInclude updated Web site lists from Microsoft\u201d to \u201cDisabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22147",
"ruleID": "SV-40706r1_rule",
"severity": "low",
"title": "Updates to web site lists from Microsoft must be disallowed.",
"version": "DTBI750"
},
"V-22148": {
"checkid": "C-39435r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> \u201cConfigure Delete Browsing History on exit\u201d must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Privacy \n\nCriteria: If the value ClearBrowsingHistoryOnExit is REG_DWORD = 0, this is not a finding.",
"description": "Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious web sites and files that could later be used for anti-virus and intrusion detection system (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.",
"fixid": "F-34563r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> \u201cConfigure Delete Browsing History on exit\u201d to \u201cDisabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22148",
"ruleID": "SV-40707r1_rule",
"severity": "medium",
"title": "Browser must retain history on exit.",
"version": "DTBI760"
},
"V-22149": {
"checkid": "C-39436r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> \u201cPrevent Deleting Web sites that the User has Visited\u201d must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Privacy \n\nCriteria: If the value CleanHistory is REG_DWORD = 0, this is not a finding.",
"description": "This policy prevents users from deleting the history of web sites the user has visited. If you enable this policy setting, web sites the user has visited will be preserved when the user clicks Delete. If you disable this policy setting, web sites that the user has visited will be deleted when user clicks Delete. If you do not configure this policy setting, the user will be able to select whether to delete or preserve web sites the user visited when the user clicks Delete.",
"fixid": "F-34564r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> \u201cPrevent Deleting Web sites that the User has Visited\u201d to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22149",
"ruleID": "SV-40708r1_rule",
"severity": "medium",
"title": "Deleting web sites that the user has visited must be disallowed.",
"version": "DTBI770"
},
"V-22150": {
"checkid": "C-39439r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Privacy -> \u201cTurn off InPrivate Browsing\u201d must be \u201cEnabled\u201d.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Privacy \n\nCriteria: If the value EnableInPrivateBrowsing is REG_DWORD = 0, this is not a finding.",
"description": "InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method. The InPrivate Browsing feature in Internet Explorer makes browser privacy easy by not storing history, cookies, temporary Internet files, or other data. If you enable this policy setting, InPrivate Browsing will be disabled. If you disable this policy setting, InPrivate Browsing will be available for use. If you do not configure this setting, InPrivate Browsing can be turned on or off through the registry.",
"fixid": "F-34567r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Privacy -> \u201cTurn off InPrivate Browsing\u201d to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22150",
"ruleID": "SV-40711r1_rule",
"severity": "medium",
"title": "InPrivate Browsing must be disallowed.",
"version": "DTBI780"
},
"V-22152": {
"checkid": "C-39441r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cAllow scripting of Internet Explorer web browser control\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1206 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting controls whether a page may control embedded WebBrowser Controls via script. Scripted code hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser Control is allowed. If you disable this policy setting, script access to the WebBrowser Control is not allowed. If you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser control is only allowed in the Local Machine and Intranet Zones.",
"fixid": "F-34568r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cAllow scripting of Internet Explorer web browser control\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22152",
"ruleID": "SV-40712r1_rule",
"severity": "medium",
"title": "Scripting of Internet Explorer web browser control property must be disallowed (Internet zone).",
"version": "DTBI800"
},
"V-22153": {
"checkid": "C-39473r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cInclude local directory path when uploading files to a server\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 160A is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.",
"fixid": "F-34591r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cInclude local directory path when uploading files to a server\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22153",
"ruleID": "SV-40729r1_rule",
"severity": "medium",
"title": "When uploading files to a server, the local directory path must be excluded (Internet zone).",
"version": "DTBI810"
},
"V-22154": {
"checkid": "C-39474r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cLaunching programs and unsafe files\u201d must be \u201cEnabled\u201d and \u201cPrompt\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1806 is REG_DWORD = 1, this is not a finding.",
"description": "This policy setting controls whether or not the \u201cOpen File \u2013 Security Warning\u201d prompt is shown when launching executables or other unsafe files. If you do not configure this policy setting, users can configure the prompt behavior. By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer Zone, and set to prompt in the Internet and Trusted Zones.",
"fixid": "F-34592r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cLaunching programs and unsafe files\u201d to \u201cEnabled\u201d and select \u201cPrompt\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22154",
"ruleID": "SV-40732r1_rule",
"severity": "medium",
"title": "Launching programs and unsafe files property must be set to prompt (Internet zone).",
"version": "DTBI820"
},
"V-22155": {
"checkid": "C-39475r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cOnly allow approved domains to use ActiveX controls without prompt\u201d must be \u201cEnabled\u201d and \u201cEnable\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 120b is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on web sites other than the web site that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Web sites should be moved into another zone if permissions need to be changed.",
"fixid": "F-34593r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cOnly allow approved domains to use ActiveX controls without prompt\u201d to \u201cEnabled\u201d and select \u201cEnable\u201d from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22155",
"ruleID": "SV-40734r1_rule",
"severity": "medium",
"title": "ActiveX controls without prompt property must be used in approved domains only (Internet zone).",
"version": "DTBI830"
},
"V-22156": {
"checkid": "C-39478r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cTurn on Cross-Site Scripting (XSS) Filter\u201d must be \u201cEnabled\u201d and \u201cEnable\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1409 is REG_DWORD = 0, this is not a finding.",
"description": "The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into web sites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.",
"fixid": "F-34594r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cTurn on Cross-Site Scripting (XSS) Filter\u201d to \u201cEnabled\u201d and select \u201cEnable\u201d from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22156",
"ruleID": "SV-40735r1_rule",
"severity": "medium",
"title": "Cross-Site Scripting (XSS) Filter must be enforced (Internet zone).",
"version": "DTBI840"
},
"V-22157": {
"checkid": "C-39480r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow scripting of Internet Explorer web browser control\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\n\nCriteria: If the value 1206 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting controls whether a page may control embedded WebBrowser Controls via script. Scripted code hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser Control is allowed. If you disable this policy setting, script access to the WebBrowser Control is not allowed. If you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser control is only allowed in the Local Machine and Intranet Zones.",
"fixid": "F-34595r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow scripting of Internet Explorer web browser control\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22157",
"ruleID": "SV-40736r1_rule",
"severity": "medium",
"title": "Scripting of Internet Explorer Web Browser Control must be disallowed (Restricted Sites zone).",
"version": "DTBI850"
},
"V-22158": {
"checkid": "C-39481r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cInclude local directory path when uploading files to a server\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\n\nCriteria: If the value 160A is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.",
"fixid": "F-34596r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cInclude local directory path when uploading files to a server\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22158",
"ruleID": "SV-40737r1_rule",
"severity": "medium",
"title": "When uploading files to a server, the local directory path must be excluded (Restricted Sites zone).",
"version": "DTBI860"
},
"V-22159": {
"checkid": "C-39485r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cLaunching programs and unsafe files\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1806 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting controls whether or not the \u201cOpen File \u2013 Security Warning\u201d prompt is shown when launching executables or other unsafe files. If you do not configure this policy setting, users can configure the prompt behavior. By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer Zones, and set to prompt in the Internet and Trusted Zones.",
"fixid": "F-34597r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cLaunching programs and unsafe files\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22159",
"ruleID": "SV-40738r1_rule",
"severity": "medium",
"title": "Launching programs and unsafe files property must be set to prompt (Restricted Site zone).",
"version": "DTBI870"
},
"V-22160": {
"checkid": "C-39486r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cOnly allow approved domains to use ActiveX controls without prompt\u201d must be \u201cEnabled\u201d and \u201cEnable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 120b is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on web sites other than the web site that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Web sites should be moved into another zone if permissions need to be changed.",
"fixid": "F-34603r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cOnly allow approved domains to use ActiveX controls without prompt\u201d to \u201cEnabled\u201d and select \u201cEnable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22160",
"ruleID": "SV-40739r1_rule",
"severity": "medium",
"title": "ActiveX controls without prompt property must be used in approved domains only (Restricted Site zone).",
"version": "DTBI880"
},
"V-22161": {
"checkid": "C-39487r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cTurn on Cross-Site Scripting (XSS) Filter\u201d must be \u201cEnabled\u201d and \u201cEnable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1409 is REG_DWORD = 0, this is not a finding.",
"description": "The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into web sites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.",
"fixid": "F-34604r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cTurn on Cross-Site Scripting (XSS) Filter\u201d to \u201cEnabled\u201d and select \u201cEnable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22161",
"ruleID": "SV-40740r1_rule",
"severity": "medium",
"title": "Cross-Site Scripting (XSS) Filter property must be enforced (Restricted Site zone).",
"version": "DTBI890"
},
"V-22171": {
"checkid": "C-39488r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> \u201cInternet Explorer Processes\u201d must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_ACTIVEXINSTALL \n\nCriteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.",
"description": "Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user\u2019s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.",
"fixid": "F-34605r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> \u201cInternet Explorer Processes\u201d to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22171",
"ruleID": "SV-40741r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved).",
"version": "DTBI900"
},
"V-22634": {
"checkid": "C-39489r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone \u201cAllow status bar updates via script\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2103 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause them to perform an undesirable action. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled. ",
"fixid": "F-34606r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone \u201cAllow status bar updates via script\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22634",
"ruleID": "SV-40742r1_rule",
"severity": "medium",
"title": "Status bar updates via script must be disallowed (Internet zone).",
"version": "DTBI910"
},
"V-22635": {
"checkid": "C-39490r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone \u201cRun .NET Framework-reliant components not signed with Authenticode\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2004 is REG_DWORD = 3, this is not a finding.",
"description": "Unsigned components may have a greater chance of including malicious code and it is more difficult to determine the author of the application, therefore they should be avoided if possible. This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.",
"fixid": "F-34607r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone \u201cRun .NET Framework-reliant components not signed with Authenticode\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22635",
"ruleID": "SV-40743r1_rule",
"severity": "medium",
"title": ".NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet Zone).",
"version": "DTBI920"
},
"V-22636": {
"checkid": "C-39491r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone \u201cRun .NET Framework-reliant components signed with Authenticode\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 2001 is REG_DWORD = 3, this is not a finding.",
"description": "It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will not execute signed managed components.",
"fixid": "F-34608r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone \u201cRun .NET Framework-reliant components signed with Authenticode\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22636",
"ruleID": "SV-40744r1_rule",
"severity": "medium",
"title": ".NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet Zone).",
"version": "DTBI930"
},
"V-22637": {
"checkid": "C-39492r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone \u201cAllow Scriptlets\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1209 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.",
"fixid": "F-34609r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone \u201cAllow Scriptlets\u201d to \u201cEnabled\u201d and select \u201cDisable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22637",
"ruleID": "SV-40745r1_rule",
"severity": "medium",
"title": "Scriptlets must be disallowed (Restricted Site zone).",
"version": "DTBI940"
},
"V-22638": {
"checkid": "C-39493r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone \u201cAllow status bar updates via script\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 2103 is REG_DWORD = 3, this is not a finding.",
"description": "A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled. ",
"fixid": "F-34610r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone \u201cAllow status bar updates via script\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-22638",
"ruleID": "SV-40747r1_rule",
"severity": "medium",
"title": "Status bar updates via script must be disallowed (Restricted Site zone).",
"version": "DTBI950"
},
"V-22687": {
"checkid": "C-39494r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> \u201cInternet Explorer Processes\u201d must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_ACTIVEXINSTALL \n\nCriteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.",
"description": "Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user\u2019s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.",
"fixid": "F-34611r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> \u201cInternet Explorer Processes\u201d to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22687",
"ruleID": "SV-40748r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer).",
"version": "DTBI1010"
},
"V-22688": {
"checkid": "C-39495r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> \u201cInternet Explorer Processes\u201d must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_ACTIVEXINSTALL \n\nCriteria: If the value iexplore.exe is REG_SZ = 1 , this is not a finding.",
"description": "Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user\u2019s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.",
"fixid": "F-34612r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> \u201cInternet Explorer Processes\u201d to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-22688",
"ruleID": "SV-40750r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes Restrict ActiveX Install must be enforced (IExplore).",
"version": "DTBI1020"
},
"V-30774": {
"checkid": "C-39499r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable add-on performance notifications\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Ext \n\nCriteria: If the value DisableAddonLoadTimePerformanceNotifications is REG_DWORD = 1, this is not a finding.",
"description": "This policy setting prevents Internet Explorer from displaying a notification when the average time it takes to load all the user's enabled add-ons exceeds the threshold. The notification informs the user that add-ons are slowing their browsing and displays a button which opens the Disable Add-ons dialog box. The Disable Add-ons dialog box displays the load time for each group of add-ons enabled in the browser. It allows the user to disable add-ons and configure the threshold. If you enable this policy setting, users will not be notified when the average time it takes to load all the user's enabled add-ons exceeds the threshold.",
"fixid": "F-34614r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable add-on performance notifications\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-30774",
"ruleID": "SV-40754r1_rule",
"severity": "medium",
"title": "Add-on performance notifications must be disallowed.",
"version": "DTBI745"
},
"V-30775": {
"checkid": "C-39502r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable Browser Geolocation\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Geolocation \n\nCriteria: If the value PolicyDisableGeolocation is REG_DWORD = 1, this is not a finding.",
"description": "This setting has a small impact on user privacy because users may unknowingly allow their browser to share location data with web sites that they visit. The value of enabling this setting is diminished due to the fact that malicious web sites can learn a great deal about the location of a user merely by analyzing their IP address. If you enable this policy setting, browser geolocation support will be turned off. If you disable this policy setting, browser geolocation will be turned on. If you do not configure this setting, browser geolocation support can be turned on or off in Internet Options on the Privacy Tab.",
"fixid": "F-34708r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Disable Browser Geolocation\" to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-30775",
"ruleID": "SV-40757r1_rule",
"severity": "medium",
"title": "Browser Geolocation functionality must be disallowed.",
"version": "DTBI755"
},
"V-30776": {
"checkid": "C-39504r3_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn on Suggested Sites\" must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites \n\nCriteria: If the value Enabled is REG_DWORD = 0, this is not a finding.",
"description": "This policy setting controls the Suggested Sites feature, which recommends sites based on the user's browsing activity. Suggested Sites reports a user's browsing history to Microsoft to store and monitor user page activity to suggest sites the user might want to visit. If you enable this policy setting, the user will not be prompted to enable the Suggested Sites and the user's browsing activities will be sent and stored online to produce suggestions. If you disable this policy setting, the entry points and functionality associated with this feature will be disabled.",
"fixid": "F-34621r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn on Suggested Sites\" to \u201cDisabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-30776",
"ruleID": "SV-40759r1_rule",
"severity": "medium",
"title": "Suggested Sites functionality must be disallowed.",
"version": "DTBI765"
},
"V-30777": {
"checkid": "C-39507r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel-> Advanced Page-> \"Automatically check for Internet Explorer updates\" must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main \n\nCriteria: If the value NoUpdateCheck is REG_DWORD = 1, this is not a finding.",
"description": "This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they become available. If you enable this policy setting, Internet Explorer checks the Internet for a new version approximately every 30 days and prompts the user to download new versions when they are available. Newer versions might not comply with the Internet Explorer version requirements of the organization. ",
"fixid": "F-34623r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel-> Advanced Page-> \"Automatically check for Internet Explorer updates\" to \u201cDisabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-30777",
"ruleID": "SV-40762r1_rule",
"severity": "medium",
"title": "Automatic checking for Internet Explorer updates must be disallowed.",
"version": "DTBI775"
},
"V-30778": {
"checkid": "C-39509r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn off ActiveX opt-in prompt\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Ext \n\nCriteria: If the value NoFirsttimeprompt is REG_DWORD = 1, this is not a finding.",
"description": "This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents Web sites from loading any COM object without prior approval. If a page attempts to load a COM object that Internet Explorer has not used before, an Information bar will appear asking the user for approval. If you enable this policy setting, the ActiveX opt-in prompt will not appear. Internet Explorer does not ask the user for permission to load a control, and will load the ActiveX if it passes all other internal security checks. If you disable or do not configure this policy setting the ActiveX opt-in prompt will appear.",
"fixid": "F-34625r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> \"Turn off ActiveX opt-in prompt\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-30778",
"ruleID": "SV-40764r1_rule",
"severity": "medium",
"title": "ActiveX opt-in prompt must be disallowed.",
"version": "DTBI805"
},
"V-30779": {
"checkid": "C-39511r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_SECURITYBAND \n\nCriteria: If the value (Reserved) is REG_SZ = 1, this is not a finding.",
"description": "This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer Processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer Processes.",
"fixid": "F-34627r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-30779",
"ruleID": "SV-40766r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for notification bars must be enforced (Reserved).",
"version": "DTBI815"
},
"V-30780": {
"checkid": "C-39513r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_SECURITYBAND \n\nCriteria: If the value explorer.exe is REG_SZ = 1, this is not a finding.",
"description": "This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer Processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer Processes",
"fixid": "F-34629r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-30780",
"ruleID": "SV-40768r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for notification bars must be enforced (Explorer).",
"version": "DTBI825"
},
"V-30781": {
"checkid": "C-39515r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> \"Internet Explorer Processes\" must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\nHKLM\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_SECURITYBAND \n\nCriteria: If the value iexplore.exe is REG_SZ = 1, this is not a finding.",
"description": "This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer processes.",
"fixid": "F-34631r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> \"Internet Explorer Processes\" to \u201cEnabled\u201d.",
"iacontrols": [
"ECSC-1"
],
"id": "V-30781",
"ruleID": "SV-40770r1_rule",
"severity": "medium",
"title": "Internet Explorer Processes for notification bars must be enforced (IExplore).",
"version": "DTBI835"
},
"V-32808": {
"checkid": "C-41151r3_chk",
"checktext": "Procedure: Open Internet Explorer. From the menu bar select Tools. From the Tools dropdown menu, select the Internet Options. From the Internet Options window, select the \"Advanced\" tab from the Advanced tab window, scroll down to the Security category, and verify the \"check for publishers certificate revocation\" box is selected. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key:\n \nHKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\n\nCriteria: If the value State is REG_DWORD = 65536 (decimal), this is not a finding.\n",
"description": "Check for publisher's certificate revocation options should be enforced to ensure all PKI signed objects are validated.",
"fixid": "F-36699r5_fix",
"fixtext": "In the Internet Explorer Options, on the \"Advanced\" tab, scroll down to Security category, and select the \"Check for publisher's certificate revocation\" box.\n\nNOTE: Manual entry for the value State, set to REG_DWORD = 65536, may first be required. \n",
"iacontrols": [
"ECSC-1"
],
"id": "V-32808",
"ruleID": "SV-43163r2_rule",
"severity": "medium",
"title": "Check for publishers certificate revocation must be enforced.",
"version": "DTBI018"
},
"V-3427": {
"checkid": "C-39317r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer \u201cSecurity Zones: Use only machine settings\u201d must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \n\nCriteria: If the value Security_HKLM_only is REG_DWORD = 1, this is not a finding.",
"description": "Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and web sites listed in the Restricted Sites zone in the browser. This setting enforces consistent security zone settings to all users of the computer. Security zones control browser behavior at various web sites and it is desirable to maintain a consistent policy for all users of a machine. This policy setting affects how security zone changes apply to different users. If you enable this policy setting, changes that one user makes to a security zone will apply to all users of that computer. If this policy setting is disabled or not configured, users of the same computer are allowed to establish their own security zone settings.",
"fixid": "F-34425r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer \u201cSecurity Zones: Use only machine settings\u201d to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-3427",
"ruleID": "SV-40549r1_rule",
"severity": "medium",
"title": "Internet Explorer must be configured to use machine settings.",
"version": "DTBI320"
},
"V-3428": {
"checkid": "C-39318r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer \u201cSecurity Zones: Do not allow users to change policies\u201d must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \n\nCriteria: If the value Security_options_edit is REG_DWORD = 1, this is not a finding.",
"description": "Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and web sites listed in the Restricted Sites zone in the browser. This setting prevents users from changing the Internet Explorer policies on the machine. Policy changes should be made by administrators only, so this setting should be enabled. If you enable this policy setting, you disable the Custom level button and Security level for this zone slider on the Security tab in the Internet Options dialog box. If this policy setting is disabled or not configured, users will be able to change the settings for security zones. It prevents users from changing security zone policy settings that are established by the administrator.",
"fixid": "F-34426r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer \u201cSecurity Zones: Do not allow users to change policies\u201d to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-3428",
"ruleID": "SV-40552r1_rule",
"severity": "medium",
"title": "Internet Explorer must be configured to disallow users to change policies.",
"version": "DTBI319"
},
"V-3429": {
"checkid": "C-39319r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer \u201cSecurity Zones: Do not allow users to add/delete sites\u201d must be \u201cEnabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \n\nCriteria: If the value Security_zones_map_edit is REG_DWORD = 1, this is not a finding.",
"description": "This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system. If you do not configure this policy setting, users will be able to add or remove sites from the Trusted Sites and Restricted Sites zones at will and change settings in the Local Intranet zone. This configuration could allow sites that host malicious mobile code to be added to these zones, which users could execute.",
"fixid": "F-34427r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer \u201cSecurity Zones: Do not allow users to add/delete sites\u201d to \u201cEnabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-3429",
"ruleID": "SV-40553r1_rule",
"severity": "medium",
"title": "Internet Explorer must be set to disallow users to add/delete sites.",
"version": "DTBI318"
},
"V-3430": {
"checkid": "C-39323r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer \u201cMake proxy settings per-machine (rather than per user)\u201d must be \u201cDisabled\u201d. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \n\nCriteria: If the value ProxySettingsPerUser is REG_DWORD = 1, this is not a finding. ",
"description": "This setting controls whether or not the Internet Explorer proxy settings are configured on a per-user or per-machine basis. If you enable this policy, users cannot set user specific proxy settings. They must use the zones created for all users of the computer. If you disable this policy or do not configure it, users of the same computer can establish their own proxy settings. This policy is intended to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user.",
"fixid": "F-34429r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer \u201cMake proxy settings per-machine (rather than per user)\u201d to \u201cDisabled\u201d. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-3430",
"ruleID": "SV-40555r1_rule",
"severity": "low",
"title": "Internet Explorer must be configured to make Proxy settings per user.",
"version": "DTBI367"
},
"V-6228": {
"checkid": "C-170r4_chk",
"checktext": "The policy for User Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer \"Disable changing home page settings\" must be \"Enable\" and specify the URL for the home page.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKCU\\Software\\Microsoft\\Internet Explorer\\Main\n\nCriteria: If the value Start Page is about:blank or a trusted site this is not a finding. \n",
"description": "By setting this parameter appropriately, a malicious web site will not be automatically loaded into a browser which may contain mobile code.",
"fixid": "F-131r3_fix",
"fixtext": "Set the policy for User Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer \"Disable changing home page settings\" to \"Enable\" and specify the URL for the home page.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6228",
"ruleID": "SV-72161r2_rule",
"severity": "medium",
"title": "The IE home page is not set to blank or a trusted site.",
"version": "DTBI001"
},
"V-6238": {
"checkid": "C-41147r19_chk",
"checktext": "Open Internet Explorer. From the menu bar, select \"Tools\". From the \"Tools\" drop-down menu, select \"Internet Options\". \nFrom the \"Internet Options\" window, select the \"Advanced\" tab, from the \"Advanced\" tab window scroll down to the \n\"Security\" category. Verify a checkmark is placed in 'Use TLS 1.0' or higher check boxes. Verify there is not a check \nplaced in the check box for 'Use SSL 2.0' or 'Use SSL 3.0'. If 'Use SSL 2.0' or 'Use SSL 3.0' is checked, then this \nis a finding. \n1) The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet \nExplorer-> Internet Control Panel-> Advanced Page-> 'Turn off Encryption Support' must be 'Enabled' and ensure the \noption selected is 'Use TLS 1.0' or higher' from the drop-down box. If the selected options contain 'SSL 2.0' \nor 'SSL 3.0', then this is a finding.\n2) The policy value for Computer Configuration -> Administrative Templates -> Internet Explorer -> Security Features -> 'Allow fallback to SSL 3.0 (Internet Explorer)' must be selected, and 'No Sites' selected from the drop-down box.",
"description": "This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser. TLS is a protocol for protecting communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other\u2019s list of supported protocols and versions and pick the most preferred match. ",
"fixid": "F-36695r14_fix",
"fixtext": "Open Internet Explorer. From the menu bar, select \"Tools\". From the \"Tools\" drop-down menu, select \"Internet Options\". \nFrom the \"Internet Options\" window, select the \"Advanced\" tab, from the \"Advanced\" tab window scroll down to the \n\"Security\" category. Place a checkmark in the 'Use TLS 1.0' or higher check boxes. Uncheck 'Use SSL 2.0' and 'Use SSL \n3.0' options. \nSet the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet \nExplorer-> Internet Control Panel-> Advanced Page-> 'Turn off Encryption Support' to 'Enabled', and select 'Use TLS \n1.0' or higher from the drop-down box. Ensure the options do not include 'SSL 2.0' or 'SSL 3.0'.",
"iacontrols": [
"ECSC-1"
],
"id": "V-6238",
"ruleID": "SV-43159r5_rule",
"severity": "medium",
"title": "The IE TLS parameter must be set correctly.",
"version": "DTBI014"
},
"V-6239": {
"checkid": "C-41144r2_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page \"Turn on Warn about Certificate Address Mismatch\" must be \"Enabled\". \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: \n\nHKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings \n\nCriteria: If the value WarnOnBadCertRecving is REG_DWORD = 1, this is not a finding.\n",
"description": "This parameter warns users if the certificate being presented by the web site is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presented by the web server. This setting aids to prevent spoofing attacks.",
"fixid": "F-36692r2_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page \"Turn on Warn about Certificate Address Mismatch\" to \"Enabled\".",
"iacontrols": [
"ECSC-1"
],
"id": "V-6239",
"ruleID": "SV-43156r1_rule",
"severity": "medium",
"title": "The IE warning about certificate address mismatch must be enforced.",
"version": "DTBI015"
},
"V-6243": {
"checkid": "C-39324r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Download signed ActiveX controls\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1001 is REG_DWORD = 3, this is not a finding.",
"description": "Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by untrusted publishers. Code signed by trusted publishers is silently downloaded. If you disable the policy setting, signed controls cannot be downloaded.",
"fixid": "F-34430r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Download signed ActiveX controls\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6243",
"ruleID": "SV-40558r1_rule",
"severity": "medium",
"title": "The Download signed ActiveX controls property must be disallowed (Internet zone).",
"version": "DTBI022"
},
"V-6244": {
"checkid": "C-39325r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Download unsigned ActiveX controls\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1004 is REG_DWORD = 3, this is not a finding.",
"description": "Unsigned code is potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. If you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run. If you disable this policy setting, users cannot run unsigned controls. If you do not configure this policy setting, users cannot run unsigned controls.",
"fixid": "F-34431r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Download unsigned ActiveX controls\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6244",
"ruleID": "SV-40559r1_rule",
"severity": "medium",
"title": "The Download unsigned ActiveX controls property must be disallowed (Internet zone).",
"version": "DTBI023"
},
"V-6245": {
"checkid": "C-39327r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Initialize and script ActiveX controls not marked as safe\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1201 is REG_DWORD = 3, this is not a finding.",
"description": "ActiveX controls that are not marked safe scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones. ",
"fixid": "F-34433r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Initialize and script ActiveX controls not marked as safe\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6245",
"ruleID": "SV-40561r1_rule",
"severity": "medium",
"title": "The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone).",
"version": "DTBI024"
},
"V-6248": {
"checkid": "C-39328r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow font downloads\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1604 is REG_DWORD = 3, this is not a finding.",
"description": "Download of fonts can sometimes contain malicious code. It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the font. This policy setting allows you to manage whether pages of the zone may download HTML fonts. If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. If you disable this policy setting, HTML fonts are prevented from downloading.",
"fixid": "F-34434r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow font downloads\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6248",
"ruleID": "SV-40563r1_rule",
"severity": "medium",
"title": "Font downloads must be disallowed (Internet zone).",
"version": "DTBI030"
},
"V-6249": {
"checkid": "C-39329r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34435r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Java permissions\" to \u201cEnabled\u201d and select \"Disable Java\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6249",
"ruleID": "SV-40565r2_rule",
"severity": "medium",
"title": "The Java Permissions must be disallowed (Internet zone).",
"version": "DTBI031"
},
"V-6250": {
"checkid": "C-39330r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Access data sources across domains\" must be \"Enabled\" and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1406 is REG_DWORD = 3, this is not a finding.",
"description": "The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be controlled based upon the site being browsed. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).",
"fixid": "F-34437r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Access data sources across domains\" to \"Enabled\" and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6250",
"ruleID": "SV-40567r1_rule",
"severity": "medium",
"title": "Accessing data sources across domains must be disallowed (Internet zone).",
"version": "DTBI032"
},
"V-6253": {
"checkid": "C-39331r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow drag and drop or copy and paste files\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value for 1802 is REG_DWORD = 3, this is not a finding.",
"description": "Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and Drop or copy and paste files must have a level of protection based upon the site being accessed.",
"fixid": "F-34438r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow drag and drop or copy and paste files\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-6253",
"ruleID": "SV-40568r1_rule",
"severity": "medium",
"title": "Functionality to drag and drop or copy and paste files must be disallowed (Internet zone).",
"version": "DTBI036"
},
"V-6255": {
"checkid": "C-39333r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Launching applications and files in an IFRAME\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1804 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.",
"fixid": "F-34441r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Launching applications and files in an IFRAME\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6255",
"ruleID": "SV-40572r1_rule",
"severity": "medium",
"title": "Launching programs and files in IFRAME must be disallowed (Internet zone).",
"version": "DTBI038"
},
"V-6256": {
"checkid": "C-39334r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Navigate windows and frames across different domains\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1607 is REG_DWORD = 3, this is not a finding.",
"description": "Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a web site hosting malicious content could use this feature in a manner similar to cross site scripting. This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. ",
"fixid": "F-34442r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Navigate windows and frames across different domains\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-6256",
"ruleID": "SV-40573r1_rule",
"severity": "medium",
"title": "Navigating windows and frames across different domains must be disallowed (Internet zone).",
"version": "DTBI039"
},
"V-6259": {
"checkid": "C-39336r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cUserdata persistence\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1606 is REG_DWORD = 3, this is not a finding.",
"description": "Userdata persistence must have level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured. ",
"fixid": "F-34444r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \u201cUserdata persistence\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-6259",
"ruleID": "SV-40577r1_rule",
"severity": "medium",
"title": "Userdata persistence must be disallowed (Internet zone).",
"version": "DTBI042"
},
"V-6260": {
"checkid": "C-39337r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow cut, copy or paste operations from the clipboard via script\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1407 is REG_DWORD = 3, this is not a finding.",
"description": "A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have level of protection based upon the site being accessed. ",
"fixid": "F-34445r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Allow cut, copy or paste operations from the clipboard via script\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-6260",
"ruleID": "SV-40578r1_rule",
"severity": "medium",
"title": "Clipboard operations via script must be disallowed (Internet zone).",
"version": "DTBI044"
},
"V-6262": {
"checkid": "C-39338r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Logon options\" must be \u201cEnabled\u201d and \"Prompt for user name and password\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3 \n\nCriteria: If the value 1A00 is REG_DWORD = 65536 (decimal), this is not a finding.",
"description": "Users could submit credentials to servers operated by malicious people who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to web sites. ",
"fixid": "F-34446r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> \"Logon options\" to \u201cEnabled\u201d and select \"Prompt for user name and password\" from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-6262",
"ruleID": "SV-40580r1_rule",
"severity": "medium",
"title": "Logon options must be configured to prompt (Internet zone).",
"version": "DTBI046"
},
"V-6267": {
"checkid": "C-39339r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> \u201cJava permissions\u201d must be \u201cEnabled\u201d and \u201cHigh Safety\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1 \n\nCriteria: If the value 1C00 is REG_DWORD = 65536, (Decimal), this is not a finding.",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34447r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> \u201cJava permissions\u201d to \u201cEnabled\u201d and select \u201cHigh Safety\u201d from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6267",
"ruleID": "SV-40582r2_rule",
"severity": "medium",
"title": "Java Permissions must be configured with High Safety (Intranet zone).",
"version": "DTBI061"
},
"V-6281": {
"checkid": "C-39340r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"High Safety\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2 \n\nCriteria: If the value 1C00 is REG_DWORD = 65536, (Decimal), this is not a finding.",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34448r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> \"Java permissions\" to \u201cEnabled\u201d and select \"High Safety\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6281",
"ruleID": "SV-40583r2_rule",
"severity": "medium",
"title": "The Java Permissions must be set with High Safety (Trusted Sites zone).",
"version": "DTBI091"
},
"V-6289": {
"checkid": "C-39341r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Download signed ActiveX controls\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1001 is REG_DWORD = 3, this is not a finding. ",
"description": "ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone. ",
"fixid": "F-34449r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Download signed ActiveX controls\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6289",
"ruleID": "SV-40586r1_rule",
"severity": "medium",
"title": "The Download signed ActiveX controls property must be disallowed (Restricted Site zone).",
"version": "DTBI112"
},
"V-6290": {
"checkid": "C-39342r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Download unsigned ActiveX controls\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1004 is REG_DWORD = 3, this is not a finding. ",
"description": "Unsigned code is potentially harmful, especially when coming from an untrusted zone. ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites and they must be digitally signed.",
"fixid": "F-34451r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Download unsigned ActiveX controls\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6290",
"ruleID": "SV-40587r1_rule",
"severity": "medium",
"title": "The Download unsigned ActiveX controls property must be disallowed (Restricted Site zone).",
"version": "DTBI113"
},
"V-6291": {
"checkid": "C-39343r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Initialize and script ActiveX controls not marked as safe\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1201 is REG_DWORD = 3, this is not a finding.",
"description": "ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.",
"fixid": "F-34452r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Initialize and script ActiveX controls not marked as safe\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6291",
"ruleID": "SV-40588r1_rule",
"severity": "medium",
"title": "The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Site zone).",
"version": "DTBI114"
},
"V-6292": {
"checkid": "C-39344r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Run ActiveX controls and plugins\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1200 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed. If you enable this policy setting, controls and plug-ins can run without user intervention. If you disable this policy setting, controls and plug-ins are prevented from running.",
"fixid": "F-34453r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Run ActiveX controls and plugins\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6292",
"ruleID": "SV-40590r1_rule",
"severity": "medium",
"title": "ActiveX controls and plug-ins must be disallowed (Restricted Sites zone).",
"version": "DTBI115"
},
"V-6293": {
"checkid": "C-39345r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Script ActiveX controls marked safe for scripting\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1405 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. ActiveX controls not marked as safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.",
"fixid": "F-34454r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Script ActiveX controls marked safe for scripting\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6293",
"ruleID": "SV-40591r1_rule",
"severity": "medium",
"title": "ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone).",
"version": "DTBI116"
},
"V-6294": {
"checkid": "C-39348r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Allow file downloads\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1803 is REG_DWORD = 3, this is not a finding.",
"description": "Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from sites that are considered restricted. This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered. ",
"fixid": "F-34458r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Allow file downloads\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6294",
"ruleID": "SV-40602r1_rule",
"severity": "medium",
"title": "File downloads must be disallowed (Restricted Site zone).",
"version": "DTBI119"
},
"V-6295": {
"checkid": "C-39349r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow font downloads\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1604 is REG_DWORD = 3, this is not a finding.",
"description": "It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the font. Download of fonts can sometimes contain malicious code. Files should not be downloaded from restricted sites. This policy setting allows you to manage whether pages of the zone may download HTML fonts.",
"fixid": "F-34460r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow font downloads\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6295",
"ruleID": "SV-40603r1_rule",
"severity": "medium",
"title": "Font downloads must be disallowed (Restricted Site zone).",
"version": "DTBI120"
},
"V-6297": {
"checkid": "C-39350r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAccess data sources across domains\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1406 is REG_DWORD = 3, this is not a finding.",
"description": "The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). ",
"fixid": "F-34461r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAccess data sources across domains\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6297",
"ruleID": "SV-40604r1_rule",
"severity": "medium",
"title": "Accessing data sources across domains must be disallowed (Restricted Sites zone).",
"version": "DTBI122"
},
"V-6298": {
"checkid": "C-39352r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow META REFRESH\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1608 is REG_DWORD = 3, this is not a finding. ",
"description": "It is possible that users will unknowingly be redirected to a site hosting malicious content. Allow META REFRESH must have level of protection based upon the site being browsed. This policy setting allows you to manage whether a user's browser can be redirected to another web page if the author of the web page uses the Meta Refresh setting to redirect browsers to another web page. ",
"fixid": "F-34463r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow META REFRESH\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6298",
"ruleID": "SV-40606r1_rule",
"severity": "medium",
"title": "The Allow META REFRESH property must be disallowed (Restricted Sites zone).",
"version": "DTBI123"
},
"V-6301": {
"checkid": "C-39353r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Allow drag and drop or copy and paste files\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1802 is REG_DWORD=3, this is not a finding.",
"description": "Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed.",
"fixid": "F-34464r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Allow drag and drop or copy and paste files\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-6301",
"ruleID": "SV-40608r1_rule",
"severity": "medium",
"title": "Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone).",
"version": "DTBI126"
},
"V-6302": {
"checkid": "C-39354r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow installation of desktop items\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1800 is REG_DWORD = 3, this is not a finding.",
"description": "Active Desktop items could contain links to unauthorized websites or other undesirable content. It is prudent to prevent users from installing desktop items from this security zone. Installation of items must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether users can install Active Desktop items from this zone.",
"fixid": "F-34465r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow installation of desktop items\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-6302",
"ruleID": "SV-40609r1_rule",
"severity": "medium",
"title": "Installation of desktop items must be disallowed (Restricted Sites zone).",
"version": "DTBI127"
},
"V-6303": {
"checkid": "C-39356r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Launching applications and files in an IFRAME\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1804 is REG_DWORD = 3, this is not a finding.",
"description": "This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.",
"fixid": "F-34467r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Launching applications and files in an IFRAME\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6303",
"ruleID": "SV-40612r1_rule",
"severity": "medium",
"title": "Launching programs and files in IFRAME must be disallowed (Restricted Sites zone).",
"version": "DTBI128"
},
"V-6304": {
"checkid": "C-39357r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Navigate windows and frames across different domains\" must be \u201cEnabled\u201d and \"Disable\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1607 is REG_DWORD = 3, this is not a finding.",
"description": "Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a web site hosting malicious content could use this feature in a manner similar to cross site scripting. This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. ",
"fixid": "F-34468r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Navigate windows and frames across different domains\" to \u201cEnabled\u201d and select \"Disable\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-6304",
"ruleID": "SV-40614r1_rule",
"severity": "medium",
"title": "Navigating windows and frames across different domains must be disallowed (Restricted Sites zone).",
"version": "DTBI129"
},
"V-6307": {
"checkid": "C-39359r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cUserdata persistence\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1606 is REG_DWORD = 3, this is not a finding.",
"description": "Userdata persistence must have level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured. ",
"fixid": "F-34470r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cUserdata persistence\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-6307",
"ruleID": "SV-40616r1_rule",
"severity": "medium",
"title": "Userdata persistence must be disallowed (Restricted Sites zone).",
"version": "DTBI132"
},
"V-6308": {
"checkid": "C-39360r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow active scripting\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1400 is REG_DWORD = 3, this is not a finding.",
"description": "Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether script code on pages in the zone are run.",
"fixid": "F-34471r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow active scripting\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box.",
"iacontrols": [
"DCMC-1"
],
"id": "V-6308",
"ruleID": "SV-40617r1_rule",
"severity": "medium",
"title": "Active scripting must be disallowed (Restricted Sites Zone).",
"version": "DTBI133"
},
"V-6309": {
"checkid": "C-39361r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow cut, copy or paste operations from the clipboard via script\u201d must be \u201cEnabled\u201d and \u201cDisable\u201d selected from the drop-down box.\n \nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1407 is REG_DWORD = 3, this is not a finding.",
"description": "A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have level of protection based upon the site being accessed. ",
"fixid": "F-34472r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \u201cAllow cut, copy or paste operations from the clipboard via script\u201d to \u201cEnabled\u201d and select \u201cDisable\u201d from the drop-down box. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-6309",
"ruleID": "SV-40618r1_rule",
"severity": "medium",
"title": "Clipboard operations via script must be disallowed (Restricted Sites zone).",
"version": "DTBI134"
},
"V-6311": {
"checkid": "C-39362r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Logon options\" must be \u201cEnabled\u201d and \"Anonymous logon\" selected from the drop-down box. \n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1A00 is REG_DWORD = 196608 (decimal), this is not a finding.",
"description": "Users could submit credentials to servers operated by malicious people who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to web sites. ",
"fixid": "F-34473r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Logon options\" to \u201cEnabled\u201d and select \"Anonymous logon\" from the drop-down box.",
"iacontrols": [
"ECSC-1"
],
"id": "V-6311",
"ruleID": "SV-40619r1_rule",
"severity": "medium",
"title": "Logon options must be configured and enforced (Restricted Sites zone).",
"version": "DTBI136"
},
"V-64785": {
"checkid": "C-65477r1_chk",
"checktext": "Procedure: Open Internet Explorer >> Select Help >> Select About.\n\nCriteria: Internet Explorer 9 is only supported on Windows Vista SP2 and Windows Server 2008 SP2. If the version number of Internet Explorer is any version of Internet Explorer 9, the Operating System in use must be Windows Vista SP2 or Windows Server 2008 SP2.\n\nIf Internet Explorer 9 is used on any other Operating System, this is a finding.\n",
"description": "Unsupported versions are no longer being evaluated or updated for security related issues.",
"fixid": "F-70717r1_fix",
"fixtext": "Upgrade Internet Explorer to a supported software version. ",
"iacontrols": [
"ECSC-1"
],
"id": "V-64785",
"ruleID": "SV-79275r1_rule",
"severity": "high",
"title": "The installed version of IE must be a supported version.",
"version": "DTBI002 - IE9"
},
"V-7007": {
"checkid": "C-39363r1_chk",
"checktext": "The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Java permissions\" must be \u201cEnabled\u201d and \"Disable Java\" selected from the drop-down box.\n\nProcedure: Use the Windows Registry Editor to navigate to the following key: HKLM\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4 \n\nCriteria: If the value 1C00 is REG_DWORD = 0, this is not a finding.",
"description": "Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.",
"fixid": "F-34474r1_fix",
"fixtext": "Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> \"Java permissions\" to \u201cEnabled\u201d and select \"Disable Java\" from the drop-down box. ",
"iacontrols": [
"DCMC-1"
],
"id": "V-7007",
"ruleID": "SV-40620r2_rule",
"severity": "medium",
"title": "Java Permissions must be disallowed (Restricted Sites zone).",
"version": "DTBI121"
}
},
"profiles": {
"MAC-1_Classified": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-1_Classified",
"title": "I - Mission Critical Classified"
},
"MAC-1_Public": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-1_Public",
"title": "I - Mission Critical Public"
},
"MAC-1_Sensitive": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-1_Sensitive",
"title": "I - Mission Critical Sensitive"
},
"MAC-2_Classified": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-2_Classified",
"title": "II - Mission Support Classified"
},
"MAC-2_Public": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-2_Public",
"title": "II - Mission Support Public"
},
"MAC-2_Sensitive": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-2_Sensitive",
"title": "II - Mission Support Sensitive"
},
"MAC-3_Classified": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-3_Classified",
"title": "III - Administrative Classified"
},
"MAC-3_Public": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-3_Public",
"title": "III - Administrative Public"
},
"MAC-3_Sensitive": {
"description": "",
"findings": {
"V-14245": "true",
"V-15490": "true",
"V-15492": "true",
"V-15494": "true",
"V-15497": "true",
"V-15499": "true",
"V-15500": "true",
"V-15502": "true",
"V-15503": "true",
"V-15504": "true",
"V-15507": "true",
"V-15508": "true",
"V-15509": "true",
"V-15513": "true",
"V-15515": "true",
"V-15516": "true",
"V-15517": "true",
"V-15518": "true",
"V-15519": "true",
"V-15520": "true",
"V-15521": "true",
"V-15522": "true",
"V-15523": "true",
"V-15524": "true",
"V-15525": "true",
"V-15526": "true",
"V-15527": "true",
"V-15528": "true",
"V-15529": "true",
"V-15530": "true",
"V-15533": "true",
"V-15534": "true",
"V-15545": "true",
"V-15546": "true",
"V-15548": "true",
"V-15549": "true",
"V-15550": "true",
"V-15551": "true",
"V-15552": "true",
"V-15556": "true",
"V-15557": "true",
"V-15558": "true",
"V-15559": "true",
"V-15560": "true",
"V-15561": "true",
"V-15562": "true",
"V-15563": "true",
"V-15564": "true",
"V-15565": "true",
"V-15566": "true",
"V-15568": "true",
"V-15569": "true",
"V-15570": "true",
"V-15571": "true",
"V-15572": "true",
"V-15574": "true",
"V-15575": "true",
"V-15579": "true",
"V-15581": "true",
"V-15603": "true",
"V-15604": "true",
"V-17296": "true",
"V-21887": "true",
"V-22108": "true",
"V-22147": "true",
"V-22148": "true",
"V-22149": "true",
"V-22150": "true",
"V-22152": "true",
"V-22153": "true",
"V-22154": "true",
"V-22155": "true",
"V-22156": "true",
"V-22157": "true",
"V-22158": "true",
"V-22159": "true",
"V-22160": "true",
"V-22161": "true",
"V-22171": "true",
"V-22634": "true",
"V-22635": "true",
"V-22636": "true",
"V-22637": "true",
"V-22638": "true",
"V-22687": "true",
"V-22688": "true",
"V-30774": "true",
"V-30775": "true",
"V-30776": "true",
"V-30777": "true",
"V-30778": "true",
"V-30779": "true",
"V-30780": "true",
"V-30781": "true",
"V-32808": "true",
"V-3427": "true",
"V-3428": "true",
"V-3429": "true",
"V-3430": "true",
"V-6228": "true",
"V-6238": "true",
"V-6239": "true",
"V-6243": "true",
"V-6244": "true",
"V-6245": "true",
"V-6248": "true",
"V-6249": "true",
"V-6250": "true",
"V-6253": "true",
"V-6255": "true",
"V-6256": "true",
"V-6259": "true",
"V-6260": "true",
"V-6262": "true",
"V-6267": "true",
"V-6281": "true",
"V-6289": "true",
"V-6290": "true",
"V-6291": "true",
"V-6292": "true",
"V-6293": "true",
"V-6294": "true",
"V-6295": "true",
"V-6297": "true",
"V-6298": "true",
"V-6301": "true",
"V-6302": "true",
"V-6303": "true",
"V-6304": "true",
"V-6307": "true",
"V-6308": "true",
"V-6309": "true",
"V-6311": "true",
"V-64785": "true",
"V-7007": "true"
},
"id": "MAC-3_Sensitive",
"title": "III - Administrative Sensitive"
}
},
"slug": "microsoft_internet_explorer_9",
"title": "Microsoft Internet Explorer 9 Security Technical Implementation Guide",
"version": "1"
}
}