Ensure 'Disable Certificate Transparency enforcement for a list of URLs' is set to 'Disabled'

高等級 1自動化chrome

說明

Google Chrome can specify URLs/hostnames for which Certificate Transparency will not be enforced. If this setting is disabled, no URLs are excluded from Certificate Transparency requirements. The recommended state for this setting is: Disabled (0) Rationale: Certificates that are required to be disclosed via Certificate Transparency shall be treated for all URLs as untrusted if they are not disclosed according to the Certificate Transparency policy. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls is missing or empty, otherwise the configured entries.

檢查方式

稽核方法: Windows 登錄檔

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

預期輸出: absent

修補方式

修補方法: 操作指南或基礎設施修補檔

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Disable Certificate Transparency enforcement for a list of URLs = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls after reviewing them.

屬性

作業系統: 不限
標籤: chromebrowsercis-l1
參考資料: CIS Google Chrome Benchmark v3.0.0 - 1.12 Ensure 'Disable Certificate Transparency enforcement for a list of URLs' is set to 'Disabled'

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target chrome