Microsoft Excel 2013 Security Technical Implementation Guide

The Microsoft Excel 2013 Security Technical Implementation Guide (V1 R8) has 48 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

48STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R8

CurrentPublished Wed Jul 24 2024

Add-ins to Office applications must be signed by a Trusted Publisher.

Microsoft Excel 2013 Security Technical Implementation Guide

Assessment Title

Rule Text

Add-ins to Office applications must be signed by a Trusted Publisher.

Description

Discussion Text

Office 2013 applications do not, by default, check the digital signature on application add-ins before opening them. Disabling or not configuring this setting may allow an application to load a dangerous add-in. As a result, malicious code could become active on user computers or the network.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-242350

Rule

SV-242350r960954_rule

Severity

medium

Rule Version

DTOO127

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Security -> Trust Center "Require that application add-ins are signed by Trusted Publisher" is set to "Enabled".

Procedure: Use the Windows Registry Editor to navigate to the following key: 

HKCU\Software\Policies\Microsoft\Office\15.0\excel\security

Criteria: If the value RequireAddinSig is REG_DWORD = 1, this is not a finding.

Implementation Procedure

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Security -> Trust Center "Require that application add-ins are signed by Trusted Publisher" to "Enabled".

STIG check 22 of 48 in the Microsoft Excel 2013 STIG checklist

← Previous · V-242349Add-on Management functionality must be allowed.Next · V-242351 →Links that invoke instances of Internet Explorer from within an Office product must be blocked.