Ensure 'Configure the list of names that will bypass the HSTS policy check' is set to 'Disabled'

高レベル 1自動edge

説明

This policy setting allows a list of names to be specified that will be exempt from HTTP Strict Transport Security (HSTS) policy checks then potentially upgraded from http:// to https://. The recommended state for this setting is: Disabled. Rationale: Allowing hostnames to be exempt from HSTS policy checks could allow for protocol downgrade attacks and cookie hijackings. The policy is Disabled when it is not present: the audit prints 'absent' when neither the value HSTSPolicyBypassList nor a populated list subkey HSTSPolicyBypassList exists under HKLM\SOFTWARE\Policies\Microsoft\Edge, otherwise the configured entries.

チェック方法

監査方法: Windows レジストリ

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\HSTSPolicyBypassList' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge' -Name 'HSTSPolicyBypassList' -ErrorAction SilentlyContinue).'HSTSPolicyBypassList'; if ($null -eq $v -and $l.Count -eq 0) { 'absent' } else { 'configured: ' + (@($v) + $l -join ', ') }

期待される出力: absent

修正方法

修正方法: ガイダンスまたは IaC パッチ

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Configure the list of names that will bypass the HSTS policy check = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Microsoft\Edge\HSTSPolicyBypassList after reviewing them.

プロパティ

オペレーティングシステム: すべて
タグ: edgebrowsercis-l1
参照: CIS Microsoft Edge Benchmark v5.0.0 - 1.78 Ensure 'Configure the list of names that will bypass the HSTS policy check' is set to 'Disabled'

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target edge