TMA-CHROME-1.11

Ensure 'Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes' is set to 'Disabled'

高レベル 1自動chrome

説明

Google Chrome can exclude certificates by their subjectPublicKeyInfo hashes from enforcing Certificate Transparency requirements. If this setting is disabled, no certificates are excluded from Certificate Transparency requirements. The recommended state for this setting is: Disabled (0) Rationale: Certificate Transparency requirements shall be enforced for all certificates. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas is missing or empty, otherwise the configured entries.

チェック方法

監査方法: Windows レジストリ

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

期待される出力: absent

修正方法

修正方法: ガイダンスまたは IaC パッチ

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas after reviewing them.

プロパティ

オペレーティングシステム: すべて
タグ: chromebrowsercis-l1
参照: CIS Google Chrome Benchmark v3.0.0 - 1.11 Ensure 'Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes' is set to 'Disabled'

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target chrome