Navigate

Check: FFOX-00-000018

Mozilla Firefox STIG: FFOX-00-000018 (in versions v6 r5 through v6 r1)

Title

Firefox must prevent the user from quickly deleting data. (Cat II impact)

Discussion

There should not be an option for a user to "forget" work they have done. This is required to meet non-repudiation controls.

Check Content

Type "about:policies" in the browser address bar. If "DisableForgetButton" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.

Fix Text

Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: Disable Forget Button Policy State: Enabled macOS "plist" file: Add the following: <key>DisableForgetButton</key> <true/> Linux "policies.json" file: Add the following in the policies section: "DisableForgetButton": true

Additional Identifiers

Rule ID: SV-251562r879703_rule

Vulnerability ID: V-251562

Group Title: SRG-APP-000326

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-002355	The information system enforces access control decisions based on organization-defined security attributes that do not include the identity of the user or process acting on behalf of the user.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AC-24 (2)	No User Or Process Identity