Detections
Analytics

1.73 (L1) Ensure 'Configure the list of names that will bypass the HSTS policy check' is set to 'Disabled'

Information

This policy setting allows a list of names to be specified that will be exempt from HTTP Strict Transport Security (HSTS) policy checks then potentially upgraded from http:// to https://.

The recommended state for this setting is: Disabled.

Allowing hostnames to be exempt from HSTS policy checks could allow for protocol downgrade attacks and cookie hijackings.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Disabled.

Microsoft Edge\Configure the list of names that will bypass the HSTS policy check

Impact:

There should be no adverse effect when disabling this policy setting.

See Also

https://workbench.cisecurity.org/benchmarks/24642

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 5c472416b4655d232e45b8439548e811924ead0975d5d05d8c843c1910907f70