1.4.1.1.2 Ensure 'Load Pictures from Web Pages Not Created in Excel' is set to Disabled

Information

This policy setting controls whether Excel loads graphics when opening Web pages that were not created in Excel. The recommended state for this setting is: Disabled. By default, when users open Web pages in Excel, Excel loads any graphics that are included in the pages, regardless of whether they were originally created in Excel. Users can change this option in the Web Options dialog box, which is available from the Advanced section of the Excel Options dialog box. Allowing Excel to load graphics created in other programs can make Excel vulnerable to possible future zero-day attacks that use graphic files as an attack vector. If such an event occurs, this setting can be used to mitigate the vulnerability.

Solution

To implement the recommended configuration state, set the following Group Policy setting to Disabled. User Configuration\Administrative Templates\Microsoft Excel 2016\Excel Options\Advanced\Web Options...\General\Load Pictures from Web Pages Not Created in Excel Impact: If this setting is disabled Excel will not load pictures from Web pages that were not created in Excel. This configuration can cause some disruptions for users who load Web pages in Excel that were created by other applications. Users who do not load Web pages in Excel will not be affected by this setting.

See Also

https://workbench.cisecurity.org/files/569

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(3)

Plugin: Windows

Control ID: 44bdb63b76d37f7753cf9465d1e34644ddb5bc27d923a7aa16940ec062ae7890