Detections
Analytics

1.78 Ensure 'Configure the list of names that will bypass the HSTS policy check' is set to 'Disabled'

Information

This policy setting allows a list of names to be specified that will be exempt from HTTP Strict Transport Security (HSTS) policy checks then potentially upgraded from http:// to https://.

The recommended state for this setting is: Disabled.

Allowing hostnames to be exempt from HSTS policy checks could allow for protocol downgrade attacks and cookie hijackings.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled.

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Configure the list of names that will bypass the HSTS policy check

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft https://www.microsoft.com/en-us/edge/business/download.

Impact:

There should be no adverse effect when disabling this policy setting.

See Also

https://workbench.cisecurity.org/benchmarks/28120

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Windows

Control ID: 256bc79041e10841fd9abd65cd453a2c00c3414678f566966b40fbce0940cb52