Detections
Analytics

2.11.2 (L1) Ensure 'Enable saving passwords to the password manager' is Explicitly Configured

Information

Google Chrome has a built-in password manager that is configured with the policy PasswordManagerEnabled . The password manager allows the user to save, manage, and autofill user credentials. This policy is based on an organization's needs and must be explicitly set. This guarantees that all instances of the browser within an organization follows the same policy.

This policy can be set to:

 - (1) Enabled
 - (0) Disabled

If this policy is unset, it is treated as Enabled but can be configured by individual users.

The Google Chrome password manager is Enabled by default and each organization should review and determine if they want to allow users to store passwords in the Browser. If another solution is used instead of the built in Chrome option then an organization should configure the setting to Disabled.

Solution

To establish the recommended configuration via Group Policy, configure the following setting to either Enabled or Disabled :

Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Password manager\Enable saving passwords to the password manager

Note: Leaving the policy to Not Configured removes the auditable artifact and is a fail.

Impact:

Organizationally dependent.

See Also

https://workbench.cisecurity.org/benchmarks/23110

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8, CSCv7|4.8

Plugin: Windows

Control ID: f7afdca15abeab37cd387729faffdf9b66633ba8c59fffb5e84243b16e7db6e2