1.13.1.4 Ensure 'Do not permit download of content from safe zones' is set to Disabled

Information

This policy setting controls whether Outlook automatically downloads content from safe zones when displaying messages.
If you enable this policy setting, Outlook will not automatically download content from safe zones. Recipients can choose to download external content from untrusted senders on a message-by-message basis.
If you disable this policy setting, content from safe zones will be downloaded automatically.
If you do not configure this policy setting, Outlook automatically downloads content from sites that are considered 'safe,' as defined in the Security tab of the Internet Options dialog box in Internet Explorer.
Important - Note that this policy setting is 'backward.' Despite the name, disabling the policy setting prevents the download of content from safe zones and enabling the policy setting allows it. The recommended state for this setting is: Disabled.

Rationale:

By default, Outlook automatically downloads content from sites that are considered 'safe,' as defined in the Security tab of the Internet Options dialog box in Internet Explorer. This configuration could allow users to inadvertently download Web beacons that reveal their identity to spammers and other malicious people.

Solution

To implement the recommended configuration state, set the following Group Policy setting to Disabled.

User Configuration\Administrative Templates\Microsoft Outlook 2016\Security\Automatic Picture Download Settings\Do not permit download of content from safe zones

Impact:

Disabling this setting can cause some disruptions for Outlook users who receive many e-mail messages that include content from safe zones, because they will be required to download content for each message individually.

See Also

https://workbench.cisecurity.org/files/553

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(4)

Plugin: Windows

Control ID: 9c65a1396aab5877dd5ee59f2eefacbada35553cf1e64b04646416f1f178cf7c