What changed in Google Chrome Current Windows SCAP Benchmark V2R11V2R11 changes

Check text

AND - Registry check registry_test (check: allat least one, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DownloadRestrictions"; key equals "Software\\Policies\\Google\\Chrome" state registry_state: type equals "reg_dword"; value equals "1" state registry_state: type equals "reg_dword"; value equals "2" state registry_state: type equals "reg_dword"; value equals "3" state registry_state: type equals "reg_dword"; value equals "4" If the system is on the SIPRNet, this requirement is NANot Applicable. Universal method: 1. In the omnibox (address bar) type "chrome:// policy". 2. If "DownloadRestrictions" is not displayed under the "Policy Name" column or it is not set to "10" or "2" under the "Policy Value" column, then this is a finding. Windows method: 1. Start "regedit". 2. Navigate to "HKLM\Software\Policies\Google\Chrome\". 3. If the "DownloadRestrictions" value name does not exist or its value data is not set to "10" or "2", then this is a finding.

Fix text

If the system is on the SIPRNet, this requirement is NANot Applicable. Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Allow download restrictions Policy State: 1, 2, or 24 Policy Value: N/A

Discussion

ConfigureSetting the typepolicy ofmeans downloads that Google Chrome will completely block, without letting users overridecannot thebypass download security decisiondecisions. IfThere youare setmany this policy, Google Chrome will prevent certain types of downloads,download andwarnings willwithin notChrome, letwhich userroughly bypassbreak thedown securityinto warnings.these Whencategories: - theMalicious, "Blockas dangerousflagged downloads"by optionthe isSafe chosen,Browsing allserver. - downloadsUncommon areor allowedunwanted, exceptas forflagged thoseby thatthe carrySafe SafeBrowsingBrowsing warningsserver. - WhenA the "Block potentially dangerous downloads"file optiontype is chosen(e.g., all SWF downloads allowed,and exceptmany forEXE those that carry SafeBrowsing warnings of potentially dangerous downloads). Setting When the "Blockpolicy allblocks downloads"different optionsubsets isof chosenthese, alldepending downloadson areits blocked. Whenvalue: 0 this= policy is not set, (or the "No special restrictions". optionDefault. 1 is= chosen),Block themalicious downloads willand godangerous throughfile the usual security restrictions based on SafeBrowsing analysis resultstypes. Note2 that= theseBlock restrictionsmalicious apply to downloads triggered from web page content, asuncommon wellor asunwanted the 'download link...' context menu option. These restrictions do not apply to the save / download of the currently displayed pagedownloads, norand doesdangerous itfile apply to saving as PDF from the printing optionstypes. See https://developers.google.com/safe-browsing for more info on SafeBrowsing. 03 = No special restrictions 1 = Block dangerousall downloads. 24 = Block potentiallymalicious dangerous downloads 3. = Block all downloadsRecommended.

V-221588 in V2R11