What changed in Mozilla Firefox for Linux SCAP Benchmark V6R8V6R8 changes

Check text

AND - security.default_personal_cert Value set to Ask Every Time textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^(?i)\\{\\s*\"policies\":\\s*\\{[\\s\\S]*?(?=\"Preferences\")\"Preferences\":\\s*\\{[\\s\\S]*?(?=\"security\\.default_personal_cert\")\"security\\.default_personal_cert\":\\s*\\{\\s*[^}]+(?=[^\"])Value\":\\s*([^,}]+),*?\\s*"; path equals ""; filename equals "policies.json"; instance equals "1" state textfilecontent54_state: subexpression pattern match "\"Ask Every Time\"" - security.default_personal_cert Status set to locked textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^(?i)\\{\\s*\"policies\":\\s*\\{[\\s\\S]*?(?=\"Preferences\")\"Preferences\":\\s*\\{[\\s\\S]*?(?=\"security\\.default_personal_cert\")\"security\\.default_personal_cert\":\\s*\\{\\s*[^}]+(?=[^\"])Status\":\\s*([^,}]+),*?\\s*"; path equals ""; filename equals "policies.json"; instance equals "1" state textfilecontent54_state: subexpression pattern match "\"locked\"" Type "about:policies" in the browser address bar. If "Preferences" is not displayed under Policy Name and the Policy Value does not include "security.default_personal_cert" with a value of "Ask Every Time" and status of "locked", this is a finding.

Discussion

When a website asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DODDoW require user authentication for access, which increases security for DODDoW information. Access will be denied to the user if certificate management is not configured.

V-251547 in V6R8

Discussion

Firefox can be set to store passwords for sites visited by the user. These individual passwords are stored in a file and can be protected by a master password. Autofill of the password can then be enabled when the site is visited. This feature could also be used to autofill the certificate PIN, which could lead to compromise of DoDDoW information.

V-251552 in V6R8

Discussion

DNS over HTTPS has generally not been adopted in the DoDDoW. DNS is tightly controlled. It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essentialnonessential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.

V-251577 in V6R8

Discussion

Studies try out different features and ideas before they are released to all Firefox users. Testing beta software is not in the DoDW user's mission.

V-252909 in V6R8