Site data must not be wiped on closing the browser

Part of DTBC0016 - prevent wiping site data on closing browser

Associated with IA controls: ECSC-1

Associated with: CCI-001588

SV-47050r2_rule Site data must not be wiped on closing the browser

Vulnerability discussion

"This policy is an override for the "Clear cookies and other site data when I close my browser" content settings option. When set to enabled Google Chrome will delete all locally stored data from the browser when it is shut down. If set to disabled site data will not be cleared on exit. If this policy is left not set Google Chrome will use the default which is to preserve site data on shut down and the user will be able to change this. If the "RestoreOnStartup" policy is set to restore URLs from previous sessions this policy will not clear cookies or other data relevant to restoring the previous browsing session completely." - Google Chrome Administrators Policy List The site data must be retained for forensics purposes. If a system is compromised, it is important to have as much information available as possible to ensure that it can be determined how the system was compromised.

Check content

Universal method(Requires Chrome Browser v15 or later): 1. In the omnibox(address bar) type chrome://policy 2. If the policy "ClearSiteDataOnExit" is not shown or it is not set to false, this is a finding. Windows: Start regedit Navigate to HKLM\Software\Policies\Google\Chrome\ClearSiteDataOnExit If this key does not exist or is not set to 0 this is a finding

Fix text

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.