Approved plugins will be whitelisted.

Part of DTBC0047 - Enable approved plugins

Associated with IA controls: ECSC-1

Associated with: CCI-001588

SV-48107r1_rule Approved plugins will be whitelisted.

Vulnerability discussion

Allowing only approved plugins will reduce the attack surface of Google Chrome. It will also ensure unused features are turned off.

Check content

Universal method(Requires Chrome Browser v15 or later): 1. In the omnibox(address bar) type chrome://policy 2. If the policy "AllowPlugins" is not shown or is not set to "Shockwave Flash", "Chrome PDF Viewer", "Google Earth Plugin", "Silverlight", and "Java(TM)", then this is a finding. Windows: Start regedit Navigate to HKLM\Software\Policies\Google\Chrome\PluginsAllowedForUrls If this key does not exist or is not set to "Shockwave Flash", "Chrome PDF Viewer", "Google Earth Plugin", "Silverlight", and "Java(TM)" this is a finding.

Fix text

Valid for Chrome Browser version 11 or later. Windows Registry: Registry Path: HKLM\Software\Policies\Google\Chrome\ Value Name: PluginsAllowedForUrls Value Type: List of strings Value Data: "Shockwave Flash", "Chrome PDF Viewer", "Google Earth Plugin", "Silverlight", and "Java(TM)" Windows group policy: Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: "Allow plugins on these sites" Policy State: Enabled Policy Value: "Shockwave Flash", "Chrome PDF Viewer", "Google Earth Plugin", "Silverlight", and "Java(TM)",

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.