Detections
Analytics

1.18 DTOO412

Information

The ability to run unsecure Office web add-ins and Catalogs must be disabled.

GROUP ID: V-238041RULE ID: SV-238041r961863

This policy setting allows users to run unsecure web add-in, which are add-ins that have web page or catalog locations that are not SSL-secured (https://), and are not in users' Internet zones. If you enable this policy setting, users can run unsecure apps. To enable specific unsecure web add-ins, you must also configure the Trusted Web add-in Catalog policy settings to trust the catalogs that contains those Add-ins. If you disable or do not configure this policy setting, unsecure web add-ins are not allowed.

Solution

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings -> Trust Center -> Trusted Catalogs 'Allow Unsecure web add-ins and Catalogs' to 'Disabled'.

See Also

https://workbench.cisecurity.org/benchmarks/23729

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-238041r961863_rule, STIG-ID|DTOO412, Vuln-ID|V-238041

Plugin: Windows

Control ID: bf2a1a905bb53cd2165b541ba32bb743871b187851c7f9df37da525f89c3c215