TMA-CHROME-1.12
Ensure 'Disable Certificate Transparency enforcement for a list of URLs' is set to 'Disabled'
Описание
Google Chrome can specify URLs/hostnames for which Certificate Transparency will not be enforced. If this setting is disabled, no URLs are excluded from Certificate Transparency requirements. The recommended state for this setting is: Disabled (0) Rationale: Certificates that are required to be disclosed via Certificate Transparency shall be treated for all URLs as untrusted if they are not disclosed according to the Certificate Transparency policy. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls is missing or empty, otherwise the configured entries.
Как проверяется
Метод проверки: Реестр Windows
$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }- Ожидаемый вывод
absent
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Disable Certificate Transparency enforcement for a list of URLs = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls after reviewing them.
Свойства
- Операционные системы
- Любая
- Теги
- chromebrowsercis-l1
- Источник
- CIS Google Chrome Benchmark v3.0.0 - 1.12 Ensure 'Disable Certificate Transparency enforcement for a list of URLs' is set to 'Disabled'
Проверить этот хост
Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.
tmaegis scan --target chrome