Details
Clicking any link to the Internet poses a potential security risk. Malicious websites can transfer harmful content or silently gather data. Acrobat Reader documents can connect to websites which can pose a potential threat to DoD systems and that functionality must be blocked. However, PDF document workflows that are trusted (e.g., DoD-created) can benefit from leveraging legitimate website access with minimal risk. Therefore, the ISSO may approve of website access and accept the risk if the access provides benefit and is a trusted site or the risk associated with accessing the site has been mitigated.
Adobe Reader must block access to all websites that are not specifically allowed by ISSO risk acceptance.
Satisfies: SRG-APP-000112, SRG-APP-000206, SRG-APP-000207, SRG-APP-000209, SRG-APP-000210
Solution
Configure the following registry value:
Registry Hive: HKEY_LOCAL_MACHINE
Registry Path:
SoftwarePoliciesAdobeAcrobat Reader2015FeatureLockDowncDefaultLaunchURLPerms
Value Name: iURLPerms
Type: REG_DWORD
Value: 1
If configuring the system to allow access to websites, obtain documented ISSO approvals and risk acceptance and set ‘iURLPerms’ to ‘0’.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Windows.
References
- 800-53|SC-18(1)
- 800-53|SC-18(3)
- 800-53|SC-18(4)
- CAT|II
- CCI|CCI-001166
- CCI|CCI-001169
- CCI|CCI-001170
- CCI|CCI-001662
- CCI|CCI-001695
- Rule-ID|SV-213145r557349_rule
- STIG-ID|ARDC-CL-000025
- STIG-Legacy|SV-80257
- STIG-Legacy|V-65767
- Vuln-ID|V-213145