TMA-CHROME-1.11

Ensure 'Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes' is set to 'Disabled'

높음레벨 1자동chrome

설명

Google Chrome can exclude certificates by their subjectPublicKeyInfo hashes from enforcing Certificate Transparency requirements. If this setting is disabled, no certificates are excluded from Certificate Transparency requirements. The recommended state for this setting is: Disabled (0) Rationale: Certificate Transparency requirements shall be enforced for all certificates. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas is missing or empty, otherwise the configured entries.

점검 방법

감사 방식: Windows 레지스트리

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

예상 출력: absent

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas after reviewing them.

속성

운영 체제: 모두
태그: chromebrowsercis-l1
참고 자료: CIS Google Chrome Benchmark v3.0.0 - 1.11 Ensure 'Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes' is set to 'Disabled'

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target chrome