What changed in Mozilla Firefox STIG V6R9V6R9 changes

Discussion

When a website asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DODDoW require user authentication for access, which increases security for DODDoW information. Access will be denied to the user if certificate management is not configured.

V-251547 in V6R9

Discussion

Firefox can be set to store passwords for sites visited by the user. These individual passwords are stored in a file and can be protected by a master password. Autofill of the password can then be enabled when the site is visited. This feature could also be used to autofill the certificate PIN, which could lead to compromise of DoDDoW information.

V-251552 in V6R9

Title

Firefox must have the DODoW root certificates installed.

Check text

Type "about:preferences#privacy" in the browser window. Scroll down to the bottom and select "View Certificates...". In the Certificate Manager window, select the "Authorities" tab. Scroll through the Certificate Name list to the U.S. Government heading. Look for the entries for DOD Root CA 3, DOD Root CA 45, and DOD Root CA 56. If there are entries for DOD Root CA 3, DOD Root CA 45, and DOD Root CA 56, select them individually. Click "View". Verify the issuer name is "US Government". If there are no entries for the appropriate DODDoW root certificates, this is a finding. If other AO-approved certificates are used, this is not a finding. If SIPRNet-specific certificates are used, this is not a finding. Note: In a Windows environment, use of policy setting "security.enterprise_roots.enabled=true" will point Firefox to the Windows Trusted Root Certification Authority Store. This is not a finding. It can also be set via the policy Certificates >> ImportEnterpriseRoots, which can be verified via "about:policies".

Fix text

Install the DODDoW root certificates. Other AO-approved certificates may also be used. Certificates designed for SIPRNet may be used as appropriate. On Windows, import certificates from the operating system by using Certificates >> Import Enterprise Roots (Certificates) via policy or Group Policy Object (GPO).

Discussion

The DODoW root certificates will ensure that the trust chain is established for server certificates issued from the DODoW Certificate Authority (CA).

V-251560 in V6R9

Discussion

DNS over HTTPS has generally not been adopted in the DoDDoW. DNS is tightly controlled. It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essentialnonessential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.

V-251577 in V6R9

Discussion

Studies try out different features and ideas before they are released to all Firefox users. Testing beta software is not in the DoDW user's mission.

V-252909 in V6R9