Browsers STIGs

CAT II 29

Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability or integrity.

1. FFOX-00-000003 CAT II V-251547 · SRG-APP-000177

   Firefox must be configured to ask which certificate to present to a website when a certificate is required.

   Maps to IA-5(2) via CCI-000187
   Check

   Type "about:policies" in the browser address bar. If "Preferences" is not displayed under Policy Name and the Policy Value does not include "security.default_personal_cert" with a value of "Ask Every Time" and status of "locked", this is a finding.

   Fix

   Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Preferences Policy State: Enabled Policy Value: { "security.default_personal_cert": { "Value": "Ask Every Time", "Status": "locked" } } macOS "plist" file: Add the following: Preferences security.default_personal_cert Value Ask Every Time Status locked Linux "policies.json" file: Add the following in the policies section: "Preferences": { "security.default_personal_cert": { "Value": "Ask Every Time", "Status": "locked" } }

2. FFOX-00-000004 CAT II V-251548 · SRG-APP-000141

   Firefox must be configured to not automatically check for updated versions of installed search plugins.

   Maps to CM-7 via CCI-000381
   Check

   Type "about:policies" in the browser address bar. If "Preferences" is not displayed under Policy Name or the Policy Value does not include "browser.search.update" with a value of "false" and status of "locked", this is a finding.

   Fix

   Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Preferences Policy State: Enabled Policy Value: { "browser.search.update": { "Value": false, "Status": "locked" } } macOS "plist" file: Add the following: Preferences browser.search.update Value Status locked Linux "policies.json" file: Add the following in the policies section: "Preferences": { "browser.search.update": { "Value": false, "Status": "locked" } }

3. FFOX-00-000005 CAT II V-251549 · SRG-APP-000141

   Firefox must be configured to not automatically update installed add-ons and plugins.

   Maps to CM-7 via CCI-000381
   Check

   Type "about:policies" in the browser window. If "ExtensionUpdate" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.

   Fix

   Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Extensions Policy Name: Extension Update Policy State: Disabled macOS "plist" file: Add the following: ExtensionUpdate Linux "policies.json" file: Add the following in the policies section: "ExtensionUpdate": false

4. FFOX-00-000006 CAT II V-251550 · SRG-APP-000278

   Firefox must be configured to not automatically execute or download MIME types that are not authorized for auto-download.

   Maps to SI-3 via CCI-001242
   Check

   Type "about:preferences" in the browser address bar. Type "Applications" in the Find bar in the upper-right corner. Determine if any of the following file extensions are listed: HTA, JSE, JS, MOCHA, SHS, VBE, VBS, SCT, WSC, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, DOS, BAT, PS, EPS, WCH, WCM, WB1, WB3, WCH, WCM, AD. If the entry exists and the "Action" is "Save File" or "Always Ask", this is not a finding. If an extension exists and the entry in the Action column is associated with an application that does/can execute the code, this is a finding.

   Fix

   Remove any unauthorized extensions from the auto-download list.

5. FFOX-00-000007 CAT II V-251551 · SRG-APP-000141

   Firefox must be configured to disable form fill assistance.

   Maps to CM-7 via CCI-000381
   Check

   Type "about:policies" in the browser window. If "DisableFormHistory" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.

   Fix

   Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: Disable Form History Policy State: Enabled macOS "plist" file: Add the following: DisableFormHistory Linux "policies.json" file: Add the following in the policies section: "DisableFormHistory": true

6. FFOX-00-000008 CAT II V-251552 · SRG-APP-000141

   Firefox must be configured to not use a password store with or without a master password.

   Maps to CM-7 via CCI-000381
   Check

   Type "about:policies" in the browser window. If "PasswordManagerEnabled" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.

   Fix

   Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: PasswordManager Policy State: Disabled macOS "plist" file: Add the following: PasswordManagerEnabled Linux "policies.json" file: Add the following in the policies section: "PasswordManagerEnabled": false

7. FFOX-00-000009 CAT II V-251553 · SRG-APP-000141

   Firefox must be configured to block pop-up windows.

   Maps to CM-7 via CCI-000381
   Check

   Type "about:policies" in the browser address bar. If "PopupBlocking" is not displayed under Policy Name or the Policy Value is not "Default" "true", this is a finding. If "PopupBlocking" is not displayed under Policy Name or the Policy Value is not "Locked" "true", this is a finding. "PopupBlocking" "Enabled" may be used to specify an allowlist of sites where pop-ups are desired, this is optional.

   Fix

   Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Popups Policy Name: Block pop-ups from websites Policy State: Enabled Policy Name: Do not allow preferences to be changed Policy State: Enabled Optional: Policy Name: Allowed Sites Policy State: Enabled Click "Show..." and enter a list of websites to be allowlisted. macOS "plist" file: Add the following: PopupBlocking Allow http://example.mil http://example.gov Default Locked Linux "policies.json" file: Add the following in the policies section: "PopupBlocking": { "Allow": ["http://example.mil/", "http://example.gov/"], "Default": true, "Locked": true}

8. FFOX-00-000010 CAT II V-251554 · SRG-APP-000141

   Firefox must be configured to prevent JavaScript from moving or resizing windows.

   Maps to CM-7 via CCI-000381
   Check

   Type "about:policies" in the browser address bar. If "Preferences" is not displayed under Policy Name or the Policy Value does not include "dom.disable_window_move_resize" with a value of "true" and status of "locked", this is a finding.

   Fix

   Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Preferences Policy State: Enabled Policy Value: { "dom.disable_window_move_resize": { "Value": true, "Status": "locked" } } macOS "plist" file: Add the following: Preferences dom.disable_window_move_resize Value Status locked Linux "policies.json" file: Add the following in the policies section: "Preferences": { "dom.disable_window_move_resize": { "Value": true, "Status": "locked" } }

9. FFOX-00-000011 CAT II V-251555 · SRG-APP-000141

   Firefox must be configured to prevent JavaScript from raising or lowering windows.

   Maps to CM-7 via CCI-000381
   Check

   Type "about:policies" in the browser address bar. If "Preferences" is not displayed under Policy Name or the Policy Value does not include "dom.disable_window_flip" with a value of "true" and status of "locked", this is a finding.

   Fix

   Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Preferences Policy State: Enabled Policy Value: { "dom.disable_window_flip": { "Value": true, "Status": "locked" } } macOS "plist" file: Add the following: Preferences dom.disable_window_flip Value Status locked Linux "policies.json" file: Add the following in the policies section: "Preferences": { "dom.disable_window_flip": { "Value": true, "Status": "locked" } }

10. FFOX-00-000013 CAT II V-251557 · SRG-APP-000141

    Firefox must be configured to disable the installation of extensions.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "InstallAddonsPermission" is not displayed under Policy Name or the Policy Value is not "Default" "false", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Addons Policy Name: Allow add-on installs from websites Policy State: Disabled macOS "plist" file: Add the following: InstallAddonsPermission Linux "policies.json" file: Add the following in the policies section: "InstallAddonsPermission": { "Default": false }

11. FFOX-00-000014 CAT II V-251558 · SRG-APP-000141

    Background submission of information to Mozilla must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser window. If "DisableTelemetry" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: Disable Telemetry Policy State: Enabled macOS "plist" file: Add the following: DisableTelemetry Linux "policies.json" file: Add the following in the policies section: "DisableTelemetry": true

12. FFOX-00-000016 CAT II V-251560 · SRG-APP-000175

    Firefox must have the DoW root certificates installed.

    Maps to IA-5(2) via CCI-000185
    Check

    Type "about:preferences#privacy" in the browser window. Scroll down to the bottom and select "View Certificates...". In the Certificate Manager window, select the "Authorities" tab. Scroll through the Certificate Name list to the U.S. Government heading. Look for the entries for DOD Root CA 3, DOD Root CA 5, and DOD Root CA 6. If there are entries for DOD Root CA 3, DOD Root CA 5, and DOD Root CA 6, select them individually. Click "View". Verify the issuer name is "US Government". If there are no entries for the appropriate DoW root certificates, this is a finding. If other AO-approved certificates are used, this is not a finding. If SIPRNet-specific certificates are used, this is not a finding. Note: In a Windows environment, use of policy setting "security.enterprise_roots.enabled=true" will point Firefox to the Windows Trusted Root Certification Authority Store. This is not a finding. It can also be set via the policy Certificates >> ImportEnterpriseRoots, which can be verified via "about:policies".

    Fix

    Install the DoW root certificates. Other AO-approved certificates may also be used. Certificates designed for SIPRNet may be used as appropriate. On Windows, import certificates from the operating system by using Certificates >> Import Enterprise Roots (Certificates) via policy or Group Policy Object (GPO).

13. FFOX-00-000017 CAT II V-252881 · SRG-APP-000141

    Firefox must be configured to not delete data upon shutdown.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "SanitizeOnShutdown" is not displayed under Policy Name or the Policy Value does not have {"Cache":false,"Cookies":false,"Downloads":false,"FormData":false,"Sessions":false,"History":false,"OfflineApps":false,"SiteSettings":false,"Locked":true}, this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Clear data when browser is closed Policy Name: Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences, Offline Website Data Policy State: Disabled Policy Name: Locked Policy State: Enabled macOS "plist" file: Add the following: SanitizeOnShutdown Cache Cookies Downloads FormData History Sessions SiteSettings OfflineApps Locked Linux "policies.json" file: Add the following in the policies section: "SanitizeOnShutdown": { "Cache": false, "Cookies": false, "Downloads": false, "FormData": false, "History": false, "Sessions": false, "SiteSettings": false, "OfflineApps": false, "Locked": true }

14. FFOX-00-000018 CAT II V-251562 · SRG-APP-000326

    Firefox must prevent the user from quickly deleting data.

    Maps to AU-10 via CCI-000166
    Check

    Enter "about:policies" in the browser address bar. If "DisableForgetButton" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration >> Administrative Templates >> Mozilla >> Firefox. Policy Name: Disable Forget Button Policy State: Enabled macOS "plist" file: Add the following: DisableForgetButton Linux "policies.json" file: Add the following in the policies section: "DisableForgetButton": true

15. FFOX-00-000019 CAT II V-251563 · SRG-APP-000141

    Firefox private browsing must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser window. If "DisablePrivateBrowsing" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: Disable Private Browsing Policy State: Enabled macOS "plist" file: Add the following: DisablePrivateBrowsing Linux "policies.json" file: Add the following in the policies section: "DisablePrivateBrowsing": true

16. FFOX-00-000020 CAT II V-251564 · SRG-APP-000141

    Firefox search suggestions must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser window. If "SearchSuggestEnabled" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Search Policy Name: Search Suggestions Policy State: Disabled macOS "plist" file: Add the following: SearchSuggestEnabled Linux "policies.json" file: Add the following in the policies section: "SearchSuggestEnabled": false

17. FFOX-00-000022 CAT II V-251566 · SRG-APP-000141

    Firefox network prediction must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser window. If "NetworkPrediction" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: Network Prediction Policy State: Disabled macOS "plist" file: Add the following: NetworkPrediction Linux "policies.json" file: Add the following in the policies section: "NetworkPrediction": false

18. FFOX-00-000023 CAT II V-251567 · SRG-APP-000141

    Firefox fingerprinting protection must be enabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "EnableTrackingProtection" is not displayed under Policy Name or the Policy Value is not "Fingerprinting" with a value of "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Tracking Protection Policy Name: Fingerprinting Policy State: Enabled macOS "plist" file: Add the following: EnableTrackingProtection Fingerprinting Linux "policies.json" file: Add the following in the policies section: "EnableTrackingProtection": { "Fingerprinting": true }

19. FFOX-00-000024 CAT II V-251568 · SRG-APP-000141

    Firefox cryptomining protection must be enabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "EnableTrackingProtection" is not displayed under Policy Name or the Policy Value is not "Cryptomining" with a value of "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Tracking Protection Policy Name: Cryptomining Policy State: Enabled macOS "plist" file: Add the following: EnableTrackingProtection Cryptomining Linux "policies.json" file: Add the following in the policies section: "EnableTrackingProtection": { "Cryptomining": true }

20. FFOX-00-000025 CAT II V-251569 · SRG-APP-000141

    Firefox Enhanced Tracking Protection must be enabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "Preferences" is not displayed under Policy Name or the Policy Value does not include "browser.contentblocking.category" with a value of "strict" and status of "locked", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Preferences Policy State: Enabled Policy Value: { "browser.contentblocking.category": { "Value": "strict", "Status": "locked" } } macOS "plist" file: Add the following: Preferences browser.contentblocking.category Value strict Status locked Linux "policies.json" file: Add the following in the policies section: "Preferences": { "browser.contentblocking.category": { "Value": "strict", "Status": "locked" } }

21. FFOX-00-000026 CAT II V-251570 · SRG-APP-000141

    Firefox extension recommendations must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "Preferences" is not displayed under Policy Name and the Policy Value does not include "extensions.htmlaboutaddons.recommendations.enabled" with a value of "false" and status of "locked", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Preferences Policy State: Enabled Policy Value: { "extensions.htmlaboutaddons.recommendations.enabled": { "Value": false, "Status": "locked" } } macOS "plist" file: Add the following: Preferences extensions.htmlaboutaddons.recommendations.enabled Value Status locked Linux "policies.json" file: Add the following in the policies section: "Preferences": { "extensions.htmlaboutaddons.recommendations.enabled": { "Value": false, "Status": "locked" },

22. FFOX-00-000027 CAT II V-251571 · SRG-APP-000141

    Firefox deprecated ciphers must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "DisabledCiphers" is not displayed under Policy Name or the Policy Value is not "TLS_RSA_WITH_3DES_EDE_CBC_SHA" with a value of "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Disabled Ciphers Policy Name: TLS_RSA_WITH_3DES_EDE_CBC_SHA Policy State: Enabled macOS "plist" file: Add the following: DisabledCiphers TLS_RSA_WITH_3DES_EDE_CBC_SHA Linux "policies.json" file: Add the following in the policies section: "DisabledCiphers": { "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true }

23. FFOX-00-000028 CAT II V-251572 · SRG-APP-000141

    Firefox must not recommend extensions as the user is using the browser.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "UserMessaging" is not displayed under Policy Name or the Policy Value is not "ExtensionRecommendations" with a value of "false", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\User Messaging Policy Name: Extension Recommendations Policy State: Disabled macOS "plist" file: Add the following: UserMessaging ExtensionRecommendations Linux "policies.json" file: Add the following in the policies section: "UserMessaging": { "ExtensionRecommendations": false }

24. FFOX-00-000029 CAT II V-251573 · SRG-APP-000141

    The Firefox New Tab page must not show Top Sites, Sponsored Top Sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Search" with a value of "false", this is a finding. If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "TopSites" with a value of "false", this is a finding. If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "SponsoredTopSites" with a value of "false", this is a finding. If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Pocket" with a value of "false", this is a finding. If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "SponsoredPocket" with a value of "false", this is a finding. If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Highlights" with a value of "false", this is a finding. If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Snippets" with a value of "false", this is a finding. If "FirefoxHome" is not displayed under Policy Name or the Policy Value does not have "Locked" with a value of "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: Customize Firefox Home Policy State: Enabled Policy Value: Uncheck "Search" Policy Value: Uncheck "Top Sites" Policy Value: Uncheck "Sponsored Top Sites" Policy Value: Uncheck "Recommended by Pocket" Policy Value: Uncheck "Sponsored Pocket Stories" Policy Value: Uncheck "Download History" Policy Value: Uncheck "Snippets" Policy Value: Check "Do not allow settings to be changed" macOS "plist" file: Add the following: FirefoxHome Search TopSites SponsoredTopSites Pocket SponsoredPocket Highlights Snippets Locked Linux "policies.json" file: Add the following in the policies section: "FirefoxHome": { "Search": false, "TopSites": false, "SponsoredTopSites": false, "Pocket": false, "SponsoredPocket": false, "Highlights": false, "Snippets": false, "locked": true }

25. FFOX-00-000033 CAT II V-251577 · SRG-APP-000141

    Firefox must be configured so that DNS over HTTPS is disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "DNSOverHTTPS" is not displayed under Policy Name or the Policy Value does not have "Enabled" with a value of "false", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\DNS Over HTTPS Policy Name: Enabled Policy State: Disabled macOS "plist" file: DNSOverHTTPS Enabled Linux "policies.json" file: Add the following in the policies section: "DNSOverHTTPS": {"Enabled": false}

26. FFOX-00-000034 CAT II V-251578 · SRG-APP-000141

    Firefox accounts must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "DisableFirefoxAccounts" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Disable Firefox Accounts Policy State: Enabled macOS "plist" file: DisableFirefoxAccounts Linux "policies.json" file: Add the following in the policies section: "DisableFirefoxAccounts": true

27. FFOX-00-000036 CAT II V-251580 · SRG-APP-000141

    Firefox feedback reporting must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "DisableFeedbackCommands" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Disable Feedback Commands Policy State: Enabled macOS "plist" file: DisableFeedbackCommands Linux "policies.json" file: Add the following in the policies section: "DisableFeedbackCommands": true

28. FFOX-00-000037 CAT II V-251581 · SRG-APP-000141

    Firefox encrypted media extensions must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "EncryptedMediaExtensions" is not displayed under Policy Name or the Policy Value does not have "Enabled" set to "false" or the Policy Value does not have "Locked" set to "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Encrypted Media Extensions Policy Name: Enable Encrypted Media Extensions Policy State: Disabled Policy Name: Lock Encrypted Media Extensions Policy State: Enabled macOS "plist" file: EncryptedMediaExtensions Enabled Locked Linux "policies.json" file: Add the following in the policies section: "EncryptedMediaExtensions": { "Enabled": false, "Locked": true }

29. FFOX-00-000039 CAT II V-252909 · SRG-APP-000141

    Firefox Studies must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Type "about:policies" in the browser address bar. If "DisableFirefoxStudies" is not displayed under Policy Name or the Policy Value does not have a value of "true", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: Disable Firefox Studies Policy State: Enabled macOS "plist" file: DisableFirefoxStudies Linux "policies.json" file: Add the following in the policies section: "DisableFirefoxStudies": true