Title

The ability to run unsecure Office apps must be disabled. (Cat II impact)

Discussion

Unsecure apps for Office, which are apps that have web page or catalog locations that are not SSL-secured (https://), and/or are not in users' Internet zones may allow data to be transmitted/accessed via clear text to outside sources. By configuring this policy to be disabled, users will be prevented from transmitting/accessing data in a nonsecure manner.

Check Content

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings >> Trust Center >> Trusted Catalogs "Allow Unsecure Apps and Catalogs" is set to "Disabled". Procedure: Use the Windows Registry Editor to navigate to the following hive: HKCU\Software\Policies\Microsoft\Office\15.0\wef\trustedcatalogs If the value 'requireserververification' is REG_DWORD = 1, this is not a finding.

Fix Text

Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings >> Trust Center >> Trusted Catalogs "Allow Unsecure Apps and Catalogs" to "Disabled".

Additional Identifiers

Rule ID: SV-228526r508020_rule

Vulnerability ID: V-228526

Group Title: SRG-APP-000516

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.