TMA-EDGE-1.85

Ensure 'Control where security restrictions on insecure origins apply' is set to 'Disabled'

高レベル 1自動edge

説明

This policy setting allows for a specified list of origins (URLs) or hostname patterns (like "*.contoso.com") for which security restrictions on insecure origins don´t apply. Allowed origins for legacy applications that can´t deploy TLS or set up a staging server for internal web development so that developers can test features requiring secure contexts without having to deploy TLS on the staging server. Rationale: Insecure contexts should always be labeled as insecure. The policy is Disabled when it is not present: the audit prints 'absent' when neither the value OverrideSecurityRestrictionsOnInsecureOrigin nor a populated list subkey OverrideSecurityRestrictionsOnInsecureOrigin exists under HKLM\SOFTWARE\Policies\Microsoft\Edge, otherwise the configured entries.

チェック方法

監査方法: Windows レジストリ

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\OverrideSecurityRestrictionsOnInsecureOrigin' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge' -Name 'OverrideSecurityRestrictionsOnInsecureOrigin' -ErrorAction SilentlyContinue).'OverrideSecurityRestrictionsOnInsecureOrigin'; if ($null -eq $v -and $l.Count -eq 0) { 'absent' } else { 'configured: ' + (@($v) + $l -join ', ') }

期待される出力: absent

修正方法

修正方法: ガイダンスまたは IaC パッチ

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Control where security restrictions on insecure origins apply = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Microsoft\Edge\OverrideSecurityRestrictionsOnInsecureOrigin after reviewing them.

プロパティ

オペレーティングシステム: すべて
タグ: edgebrowsercis-l1
参照: CIS Microsoft Edge Benchmark v5.0.0 - 1.85 Ensure 'Control where security restrictions on insecure origins apply' is set to 'Disabled'

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target edge