2.2.4.1.1.1.1 Ensure 'Load Pictures from Web pages not created in Excel' is set to 'Disabled'

Information

This policy setting controls whether Excel loads graphics when opening Web pages that were not created in Excel.

The recommended state for this setting is: Disabled.

Rationale:

By default, when users open Web pages in Excel, Excel loads any graphics that are included in the pages, regardless of whether they were originally created in Excel. Users can change this option in the Web Options dialog box, which is available from the Advanced section of the Excel Options dialog box.

Allowing Excel to load graphics created in other programs can make it vulnerable to possible future zero-day attacks that use graphic files as an attack vector. If such an event occurs, this setting can be used to mitigate the vulnerability.

Impact:

Excel will not load pictures from Web pages that were not created in Excel. This configuration can cause some disruptions for users who load Web pages in Excel that were created by other applications. Users who do not load Web pages in Excel will not be affected by this setting.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled.

User Configuration\Administrative Templates\Microsoft Excel 2016\Excel Options\Advanced\Web Options...\General\Load Pictures from Web Pages Not Created in Excel

Default Value:

Enabled. (Excel loads any graphics that are included in the pages regardless of origin.)

See Also

https://workbench.cisecurity.org/benchmarks/12129

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(3)

Plugin: Windows

Control ID: f02a6afe030e53a969134efaa9c27977effe40e7c7246641a0d3d3197eb76ea8