Findings (MAC III - Administrative Sensitive) Finding ID Severity Title Description Medium Script-initiated windows without size or position constraints must be disallowed (Internet zone). This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions.

• Enable Scripting Activex Controls Cookies And Java Programs For Mac
• Enable Scripting Activex Controls Cookies And Java Programs For Windows 7
• Enable Scripting Activex Controls Cookies And Java Programs Windows 10

Medium All network paths (UNCs) for Intranet sites must be disallowed. Some UNC paths could refer to servers not managed by the organization, which means they could host malicious content; and therefore, it is safest to not include all UNC paths in the Intranet Sites. Medium Checking for signatures on downloaded programs must be enforced. This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified. Medium The Download unsigned ActiveX controls property must be disallowed (Restricted Sites zone). Unsigned code is potentially harmful, especially when coming from an untrusted zone.

ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted. Medium Internet Explorer Processes for Restrict File Download must be enforced (Reserved).

User has disabled all cookies and encounters the need for them on certain sites, cookies can be enabled just for those sites. The difficulty is being able to recognize that. Java, JavaScript, and ActiveX controls are used by many Web sites to make Web browsing convenient and powerful. However, with added convenience.

In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they. Medium Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone).

This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions. Medium Internet Explorer Processes for Zone Elevation must be enforced (iexplore). Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone).

Web pages on a. Medium Scripting of Internet Explorer WebBrowser control property must be disallowed (Internet zone). This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. Medium InPrivate Browsing must be disallowed. InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method.

Medium Deleting websites that the user has visited must be disallowed. This policy prevents users from deleting the history of websites the user has visited. If you enable this policy setting, websites the user has visited will be preserved when the user clicks. Medium Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Restricted Sites Zone. This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and. Medium The Download signed ActiveX controls property must be disallowed (Restricted Sites zone).

ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine. Medium Allow Fallback to SSL 3.0 (Internet Explorer) must be disabled.

This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by blocking an insecure fallback to SSL when TLS 1.1 or greater fails. Medium Automatic prompting for file downloads must be disallowed (Internet zone). This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated. Medium Scriptlets must be disallowed (Internet zone). This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code.

If you enable this policy. Medium Java permissions must be disallowed (Locked Down Local Machine zone). Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down. Medium Java permissions must be disallowed (Local Machine zone). Java applications could contain malicious code.

This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down. Medium Turn on SmartScreen Filter scan option for the Restricted Sites Zone must be enabled. This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.

If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious. Medium The Initialize and script ActiveX controls not marked as safe must be disallowed (Intranet Zone). ActiveX controls that are not marked safe for scripting should not be executed.

Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not. Medium Java permissions must be disallowed (Locked Down Intranet zone). Java applications could contain malicious code.

This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down. Medium The Initialize and script ActiveX controls not marked as safe must be disallowed (Trusted Sites Zone). ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not. Medium Software must be disallowed to run or install with invalid signatures. Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software.

Such signatures. Medium Security checking features must be enforced. This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk.

If you enable this. Medium Checking for server certificate revocation must be enforced. This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer. Medium Cross-Site Scripting Filter must be enforced (Internet zone). The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure.

This setting controls if the Cross-Site Scripting (XSS) Filter detects. Medium Enabling outdated ActiveX controls for Internet Explorer must be blocked. This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released.

Medium ActiveX controls without prompt property must be used in approved domains only (Internet zone). This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable.

Medium Internet Explorer must be set to disallow users to add/delete sites. This setting prevents users from adding sites to various security zones.

Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the. Medium Internet Explorer must be configured to disallow users to change policies. Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. Medium Internet Explorer Processes for Notification Bars must be enforced (Explorer). This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is. Medium Internet Explorer must be configured to use machine settings.

Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. Medium Internet Explorer Processes for Notification Bars must be enforced (iexplore).

This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is. Medium Accessing data sources across domains must be disallowed (Restricted Sites zone). The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server.

This policy setting allows you to manage whether Internet. Medium Font downloads must be disallowed (Restricted Sites zone). It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the font.

Downloads of fonts can sometimes contain malicious. Medium Java permissions must be disallowed (Restricted Sites zone).

Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for. Medium ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone). This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script.

If you enable this policy setting, script interaction can occur. Medium File downloads must be disallowed (Restricted Sites zone). Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from.

Medium Font downloads must be disallowed (Internet zone). Downloads of fonts can sometimes contain malicious code. It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the. Medium Internet Explorer Processes for Zone Elevation must be enforced (Explorer). Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone).

Web pages on a. Medium The Java permissions must be disallowed (Internet zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for. Medium The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone).

ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not. Medium Accessing data sources across domains must be disallowed (Internet zone). The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be.

Enable Scripting Activex Controls Cookies And Java Programs For Mac

Medium Crash Detection management must be enforced. The 'Turn off Crash Detection' policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. A crash report could contain sensitive information from. Medium Turn on the auto-complete feature for user names and passwords on forms must be disabled. This policy setting controls automatic completion of fields in forms on web pages.

It is possible that malware could be developed which would be able to extract the cached user names and passwords. Medium Configuring History setting must be set to 40 days.

This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet. Medium Logon options must be configured and enforced (Restricted Sites zone). Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user. Medium Managing SmartScreen Filter use must be enforced. This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection.

Medium Clipboard operations via script must be disallowed (Restricted Sites zone). A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious. Medium Active scripting must be disallowed (Restricted Sites Zone). Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. Medium Userdata persistence must be disallowed (Restricted Sites zone). Userdata persistence must have a level of protection based upon the site being accessed.

This policy setting allows you to manage the preservation of information in the browser's history, in. Medium Navigating windows and frames across different domains must be disallowed (Restricted Sites zone). Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. Medium ActiveX controls without prompt property must be used in approved domains only (Restricted Sites zone). This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control.

If the user were to disable. Medium Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone). Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and. Medium The Allow META REFRESH property must be disallowed (Restricted Sites zone).

It is possible that users will unknowingly be redirected to a site hosting malicious content. 'Allow META REFRESH' must have a level of protection based upon the site being browsed. Medium Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved). Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to.

Medium Launching programs and files in IFRAME must be disallowed (Restricted Sites zone). This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME. Medium Cross-Site Scripting Filter property must be enforced (Restricted Sites zone). The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects. Medium Launching programs and files in IFRAME must be disallowed (Internet zone).

This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME. Medium Functionality to drag and drop or copy and paste files must be disallowed (Internet zone). Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone.

Drag and drop or copy and paste files must. Medium Userdata persistence must be disallowed (Internet zone). Userdata persistence must have a level of protection based upon the site being accessed. It is possible for sites hosting malicious content to exploit this feature as part of an attack against.

Medium Navigating windows and frames across different domains must be disallowed (Internet zone). Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. Medium Pop-up Blocker must be enforced (Restricted Sites zone). This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.

If you enable this policy setting. Medium Websites in less privileged web content zones must be prevented from navigating into the Internet zone. This policy setting allows a user to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Internet zone. If this policy setting is enabled, websites.

Medium Websites in less privileged web content zones must be prevented from navigating into the Restricted Sites zone. This policy setting allows you to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Restricted zone. If this policy setting is enabled, websites.

Medium Scripting of Java applets must be disallowed (Restricted Sites zone). This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user. Medium The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone).

Enable Scripting Activex Controls Cookies And Java Programs For Windows 7

ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked.

Medium AutoComplete feature for forms must be disallowed. This AutoComplete feature suggests possible matches when users are filling in forms.

It is possible that this feature will cache sensitive data and store it in the user's profile, where it might. Medium ActiveX controls and plug-ins must be disallowed (Restricted Sites zone).

This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed.

Medium Internet Explorer Processes for MIME sniffing must be enforced (Explorer). MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting. Medium Scriptlets must be disallowed (Restricted Sites zone). This policy setting allows you to manage whether scriptlets can be allowed.

Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy. Medium.NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone).

It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether.NET Framework components that are.

Medium Security Warning for unsafe files must be disallowed (Restricted Sites zone). This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file. Medium Protected Mode must be enforced (Restricted Sites zone). Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy. Medium Protected Mode must be enforced (Internet zone). Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.

If you enable this policy. Medium Scripting of Internet Explorer WebBrowser Control must be disallowed (Restricted Sites zone). This policy setting controls whether a page may control embedded WebBrowser Control via script.

Scripted code hosted on sites located in this zone is more likely to contain malicious code. Medium When uploading files to a server, the local directory path must be excluded (Restricted Sites zone).

This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be. Medium Pop-up Blocker must be enforced (Internet zone). This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting. Medium XAML files must be disallowed (Restricted Sites zone).

These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the. Medium Java permissions must be configured with High Safety (Trusted Sites zone). Java applications could contain malicious code.

This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down. Medium Dragging of content from different domains within a window must be disallowed (Internet zone). This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting. Medium Allow binary and script behaviors must be disallowed (Restricted Sites zone).

This policy setting allows you to manage dynamic binary and script behaviors of components that encapsulate specific functionality for HTML elements, to which they were attached. If you enable. Medium Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer). Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy.

Such software can pose significant security and privacy risks to. Medium Java permissions must be disallowed (Locked Down Restricted Sites zone).

Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down. Medium XAML files must be disallowed (Internet zone). These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the.

Medium Internet Explorer Processes for MIME handling must be enforced. (Reserved) Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling Internet. Medium Internet Explorer Processes Restrict ActiveX Install must be enforced (iexplore). Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to. Medium Status bar updates via script must be disallowed (Restricted Sites zone).

A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage. Medium Anti-Malware programs against ActiveX controls must be run for the Local Machine zone. This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting. Medium Run once selection for running outdated ActiveX controls must be disabled. This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer.

Many ActiveX controls are not automatically updated as new versions are released. Medium Anti-Malware programs against ActiveX controls must be run for the Restricted Sites zone. This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting. Medium The Internet Explorer warning about certificate address mismatch must be enforced. This parameter warns users if the certificate being presented by the website is invalid.

Since server certificates are used to validate the identity of the web server it is critical to warn the. Medium Anti-Malware programs against ActiveX controls must be run for the Trusted Sites zone. This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting. Medium Automatic prompting for file downloads must be disallowed (Restricted Sites zone). This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated. Medium Turn off Encryption Support must be enabled. This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL.

TLS is a protocol for protecting. Medium Internet Explorer Processes for Restrict File Download must be enforced (Explorer). In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they.

Medium Internet Explorer Processes for MIME sniffing must be enforced (Reserved). MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting.

Medium Browser must retain history on exit. Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which. Medium Internet Explorer Processes for MIME handling must be enforced (Explorer). Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server.

The Consistent MIME Handling Internet. Medium Internet Explorer Processes for MIME handling must be enforced (iexplore). Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server.

The Consistent MIME Handling Internet. Medium Dragging of content from different domains within a window must be disallowed (Restricted Sites zone). This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting. Medium Internet Explorer Processes for MIME sniffing must be enforced (iexplore).

MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting. Medium Status bar updates via script must be disallowed (Internet zone). This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the. Medium.NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet zone). Unsigned components are more likely to contain malicious code and it is more difficult to determine the author of the application - therefore they should be avoided if possible.

Medium When Enhanced Protected Mode is enabled, ActiveX controls must be disallowed to run in Protected Mode. This setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled.

When a user has an ActiveX control installed that is not compatible with Enhanced. Medium Dragging of content from different domains across windows must be disallowed (Internet zone). This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy. Medium Dragging of content from different domains across windows must be disallowed (Restricted Sites zone). This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows.

If you enable this policy. Medium Enhanced Protected Mode functionality must be enforced. Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced. Medium Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Internet Zone.

This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and. Medium Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer). Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a.

Medium Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved). Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force. Medium Internet Explorer Processes for Restrict File Download must be enforced (iexplore). In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they.

Medium.NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Sites Zone). This policy setting allows you to manage whether.NET Framework-reliant components that are signed with Authenticode can be executed from Internet Explorer. It may be possible for malicious. Medium Internet Explorer Processes for MK protocol must be enforced (Reserved). The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information. Medium Internet Explorer Processes for MK protocol must be enforced (Explorer).

The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information. Medium Internet Explorer Processes for MK protocol must be enforced (iexplore).

The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information. Medium The Download signed ActiveX controls property must be disallowed (Internet zone). Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to. Medium Internet Explorer Processes for Zone Elevation must be enforced (Reserved). Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone).

Web pages on a. Medium The Download unsigned ActiveX controls property must be disallowed (Internet zone). Unsigned code is potentially harmful, especially when coming from an untrusted zone.

This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Medium Logon options must be configured to prompt (Internet zone). Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user.

Medium Clipboard operations via script must be disallowed (Internet zone). A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious. Medium Java permissions must be configured with High Safety (Intranet zone). Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down. Medium Security Warning for unsafe files must be set to prompt (Internet zone).

This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file. Medium Internet Explorer Processes for Notification Bars must be enforced (Reserved). This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted.

By default, the Notification Bar is. Medium When uploading files to a server, the local directory path must be excluded (Internet zone). This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be.

Medium.NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Sites Zone). This policy setting allows you to manage whether.NET Framework-reliant components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed. Medium Anti-Malware programs against ActiveX controls must be run for the Intranet zone. This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting.

Medium Anti-Malware programs against ActiveX controls must be run for the Internet zone. This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting. Medium The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on. This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on. Medium Internet Explorer Processes for restricting pop-up windows must be enforced (iexplore).

Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a. Medium Turn on SmartScreen Filter scan option for the Internet Zone must be enabled. This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious. Medium Java permissions must be disallowed (Locked Down Trusted Sites zone). Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals.

This policy setting allows you to manage permissions for. Medium Prevent per-user installation of ActiveX controls must be enabled. This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis. If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. Medium Prevent ignoring certificate errors option must be enabled. This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as “expired”, “revoked”, or “name. Medium Prevent bypassing SmartScreen Filter warnings must be enabled.

This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host.

Medium Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet must be enabled. This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly. Low Check for publishers certificate revocation must be enforced. Check for publisher's certificate revocation options should be enforced to ensure all PKI signed objects are validated.

This article will help you configure your web browser for safer Internet surfing. It is written for home computer users, students, small business workers, and any other person who works with limited information technology (IT) support and broadband. Although the information in this document may be applicable to users with formal IT support as well, organizational IT policies should supersede these recommendations. If you are responsible for IT policies for your organization, please consider implementing these recommendations as part of your policy. Table of Contents. Why Secure Your Browser Today, web browsers such as Microsoft Internet Explorer, Mozilla Firefox, and Apple Safari are installed on almost all computers. Because web browsers are used so frequently, it is vital to configure them securely.

Often, the web browser that comes with an operating system is not set up in a secure default configuration. Not securing your web browser can lead quickly to a variety of computer problems caused by anything from spyware being installed without your knowledge to intruders taking control of your computer. Ideally, computer users should evaluate the risks from the software they use. Many computers are sold with software already loaded. Whether installed by a computer manufacturer, operating system maker, Internet service provider, or by a retail store, the first step in assessing the vulnerability of your computer is to find out what software is installed and how programs will interact with each other.

Unfortunately, it is not practical for most people to perform this level of analysis. There is an increasing threat from software attacks that take advantage of vulnerable web browsers. We have observed new software vulnerabilities being exploited and directed at web browsers through use of compromised or malicious websites. This problem is made worse by a number of factors, including the following:. Many users have a tendency to click on links without considering the risks of their actions.

Web page addresses can be disguised or take you to an unexpected site. Many web browsers are configured to provide increased functionality at the cost of decreased security.

New security vulnerabilities are often discovered after the software is configured and packaged by the manufacturer. Computer systems and software packages may be bundled with additional software, which increases the number of vulnerabilities that may be attacked.

Third-party software may not have a mechanism for receiving security updates. Many websites require that users enable certain features or install more software, putting the computer at additional risk. Many users do not know how to configure their web browsers securely. Many users are unwilling to enable or disable functionality as required to secure their web browser. As a result, exploiting vulnerabilities in web browsers has become a popular way for attackers to compromise computer systems.

In addition to following this paper's recommendations, refer to the documentation in the section for other steps you can take to secure your system. Web Browser Features and Risks It is important to understand the functionality and features of the web browser you use. Enabling some web browser features may lower security.

Vendors often enable features by default to improve the computing experience, but these features may end up increasing the risk to the computer. Attackers focus on exploiting client-side systems (your computer) through various vulnerabilities. They use these vulnerabilities to take control of your computer, steal your information, destroy your files, and use your computer to attack other computers.

A low-cost method attackers use is to exploit vulnerabilities in web browsers. An attacker can create a malicious web page that will install software or spyware that will steal your information. Additional information about spyware is available in the following document:. Rather than actively targeting and attacking vulnerable systems, a malicious website can passively compromise systems as the site is visited. A malicious HTML document can also be emailed to victims.

Enable Scripting Activex Controls Cookies And Java Programs Windows 10

In these cases, the act of opening the email or attachment can compromise the system. Some specific web browser features and associated risks are briefly described below. Understanding what different features do will help you understand how they affect your web browser's functionality and the security of your computer. ActiveX is a technology used by Microsoft Internet Explorer on Microsoft Windows systems. ActiveX allows applications or parts of applications to be utilized by the web browser. A web page can use ActiveX components that may already reside on a Windows system, or a site may provide the component as a downloadable object. This gives extra functionality to traditional web browsing, but may also introduce more severe vulnerabilities if not properly implemented.

ActiveX has been plagued with various vulnerabilities and implementation issues. One problem with using ActiveX in a web browser is that it greatly increases the attack surface, or “attackability,” of a system. Installing any Windows application introduces the possibility of new ActiveX controls being installed. Vulnerabilities in ActiveX objects may be exploited via Internet Explorer, even if the object was never designed to be used in a web browser.

In 2000, the CERT/CC held a workshop to analyze security in ActiveX. The results from that workshop may be viewed. Many vulnerabilities with respect to ActiveX controls lead to severe impacts.

Often an attacker can take control of the computer. You can search the Vulnerability Notes Database for ActiveX vulnerabilities. Java is an object-oriented programming language that can be used to develop active content for websites. A Java Virtual Machine, or JVM, is used to execute the Java code, or “,” provided by the website. Some operating systems come with a JVM, while others require a JVM to be installed before Java can be used.

Java applets are operating system independent. Java applets usually execute within a “sandbox” where the interaction with the rest of the system is limited. However, various implementations of the JVM contain vulnerabilities that allow an applet to bypass these restrictions.

Signed Java applets can also bypass sandbox restrictions, but they generally prompt the user before they can execute. You can search the Vulnerability Notes Database for Java vulnerabilities. Plug-ins are applications intended for use in the web browser. Netscape has developed the NPAPI standard for developing plug-ins, but this standard is used by multiple web browsers, including Mozilla Firefox and Safari. Plug-ins are similar to ActiveX controls but cannot be executed outside of a web browser. Adobe Flash is an example of an application that is available as a plug-in. Plug-ins can contain programming flaws such as buffer overflows, or they may contain design flaws such as cross-domain violations, which arises when the is not followed.

Cookies are files placed on your system to store data for specific websites. A cookie can contain any information that a website is designed to place in it. Cookies may contain information about the sites you visited, or may even contain credentials for accessing the site. Cookies are designed to be readable only by the website that created the cookie. Session cookies are cleared when the browser is closed, and persistent cookies will remain on the computer until the specified expiration date is reached.

Cookies can be used to uniquely identify visitors of a website, which some people consider a violation of privacy. If a website uses cookies for authentication, then an attacker may be able to acquire unauthorized access to that site by obtaining the cookie. Persistent cookies pose a higher risk than session cookies because they remain on the computer longer. JavaScript, also known as ECMAScript, is a scripting language that is used to make websites more interactive.

There are specifications in the JavaScript standard that restrict certain features such as accessing local files. VBScript is another scripting language that is unique to Microsoft Windows Internet Explorer. VBScript is similar to JavaScript, but it is not as widely used in websites because of limited compatibility with other browsers. The ability to run a scripting language such as JavaScript or VBScript allows web page authors to add a significant amount of features and interactivity to a web page.

However, this same capability can be abused by attackers. The default configuration for most web browsers enables scripting support, which can introduce multiple vulnerabilities, such as the following:. Cross-Site Scripting Cross-Site Scripting, often referred to as XSS, is a vulnerability in a website that permits an attacker to leverage the trust relationship that you have with that site. For a high-level description of XSS attacks, please see the whitepaper published. Note that Cross-Site Scripting is not usually caused by a failure in the web browser. You can search the Vulnerability Notes Database for Cross-Site Scripting vulnerabilities.

Cross-Zone and Cross-Domain Vulnerabilities Most web browsers employ security models to prevent script in a website from accessing data in a different domain. These security models are primarily based on the Netscape Same Origin Policy:. Internet Explorer also has a policy to enforce security zone separation. Vulnerabilities that violate these security models can be used to perform actions that a site could not normally perform. The impact can be similar to a cross-site scripting vulnerability. However, if a vulnerability allows for an attacker to cross into the local machine zone or other protected areas, the attacker may be able to execute arbitrary commands on the vulnerable system. You can search the Vulnerability Notes Database for cross-zone and cross-domain vulnerabilities.

Detection Evasion Anti-virus, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS) generally work by looking for specific patterns in content. If a “known bad” pattern is detected, then the appropriate actions can take place to protect the user. However, because of the dynamic nature of programming languages, scripting in web pages can be used to evade such protective systems.

How to Secure Your Web Browser Some software features that provide functionality to a web browser, such as ActiveX, Java, Scripting (JavaScript, VBScript, etc.), may also introduce vulnerabilities to the computer system. These vulnerabilities may stem from poor implementation, poor design, or an insecure configuration.

For these reasons, you should understand which browsers support which features and the risks they could introduce. Some web browsers permit you to fully disable the use of these technologies, while others may permit you to enable features on a per-site basis. This section provides links that show you how to securely configure a few of the most popular web browsers and how to disable features that can cause vulnerabilities. We encourage you to visit the vendor's website for each browser you use to learn more.

If a vendor does not provide documentation on how to secure the browser, we encourage you to contact the vendor and request more information. Multiple web browsers may be installed on your computer. Other software applications on your computer, such as email clients or document viewers, may use a different browser than the one you normally use to access the web. Also, certain file types may be configured to open with a different web browser. Using one web browser to manually interact with websites does not mean other applications will automatically use the same browser.

For this reason, it is important to securely configure each web browser that may be installed on your computer. One advantage to having multiple web browsers is that one browser can be used for only sensitive activities such as online banking, and the other can be used for general purpose web browsing. Using multiple browsers can minimize the chances that a vulnerability in a particular web browser, website, or related software can be used to compromise sensitive information. Web browsers are frequently updated.

Depending on the version of your software, the features and options may move or change. Microsoft Internet Explorer Microsoft Internet Explorer (IE) is a web browser integrated into the Microsoft Windows operating system.

For up-to-date information on security and privacy settings for Internet Explorer, visit. Mozilla Firefox Mozilla Firefox is a popular third-party browser for Windows, Mac, and Linux. To learn how to keep your information safe and secure with Firefox's private browsing, password features and other security settings, visit.

Apple Safari Apple Safari is installed on its line of computers, tables, and phones. For information on the Safari’s security settings on Apple devices, visit. For information on Safari installed on computers, visit and select “Privacy and security” on the menu. Google Chrome In 2012, Google Chrome became the most widely used browser worldwide, according to Stat Counter and other sources.

For more information on Chrome’s security, safety and reporting features, visit and select the options displayed under the topic. Other Browsers Other web browsers may have similar options to those described above. Please refer to each browser's documentation to determine which options are available and how to make the necessary changes. For example, the links below show where to find security information for two other web browsers:. Opera. Security badges:. Web preferences:.

Chromium. Security information: Keeping Your Computer Secure In addition to selecting and securing your web browser, you can take measures to increase protection to your computer in general. The following are steps and links to information resources that will help you secure your computer. Read the document. Enable automatic software updates if available Vendors will usually release patches for their software when a vulnerability has been discovered.

Most product documentation offers a method to get updates and patches. You should be able to obtain updates from the vendor's website. Read the manuals or browse the vendor's website for more information.

Some applications will automatically check for available updates, and many vendors offer automatic notification of updates via a mailing list. Look on your vendor's website for information about automatic notification. If no mailing list or other automated notification mechanism is offered, you may need to check the vendor's website periodically for updates. Install and use antivirus software While an up-to-date antivirus software package cannot protect against all malicious code, for most users it remains the best first-line of defense against malicious code attacks. Many antivirus packages support automatic updates of virus definitions.

We recommend using these automatic updates when available. A list of is available on the CERT/CC website. Avoid unsafe behavior Additional information on this topic can be found in the document. Use caution when opening email attachments or when using peer-to-peerfile sharing, instant messaging, or chat rooms. Don't enable file sharing on network interfaces exposed directly to the Internet.

Follow the principle of least privilege — don't enable it if you don't need it Consider creating and using an account with limited privileges instead of an 'administrator' or 'root' level account for everyday tasks. Depending on the operating system, you only need to use administrator level access when installing new software, changing system configurations, etc. Many vulnerability exploits (e.g., viruses, Trojan horses) are executed with the privileges of the user that runs them — making it far more risky to be logged in as an administrator all the time. References CERT/CC References.

—. — US-CERT References.

—. —. —. —.

—. —. —.

— Revision History. January 23, 2006 – Initial Release. February 14, 2008 – Updated Internet Explorer and Firefox guidelines. September 8, 2015 – Updated the Web Browser section to point to vendor privacy and security options.