4.4 Ensure 'Allow or deny audio capture' is set to 'Disabled'

Information

This setting allows administrators to set whether the end-user is prompted for access to audio capture devices.

Disabled (0): Turns off prompts and audio capture will only work for URLs configured in the AudioCaptureAllowedUrls list.

Enabled (1): With the exception of URLs set in the AudioCaptureAllowedUrls list, users get prompted for audio capture access.

NOTE: The setting affects all audio input (not just the built-in microphone).

The recommended state for this setting is: Disabled

Rationale:

The end-user having the ability to allow or deny audio capture for websites in Google Chrome could open an organization up to a malicious site that may capture proprietary information through the browser. By limiting or disallowing audio capture, it removes the end-user's discretion, leaving it up to the organization which sites are allowed to use this ability.

Impact:

If you disable this setting, users will not be prompted for audio devices when using websites which may need this access, such as a web-based conferencing system. If there are sites which access will be allowed, configuration of the AudioCaptureAllowedUrls setting will be necessary.

Solution

To establish the recommended configuration via Group Policy, set the following UI path to Disabled:

Computer Configuration\Administrative Templates\Google\Google Chrome\Allow or deny audio capture

Default Value:

Unset (Same as Enabled, but user can change)

See Also

https://workbench.cisecurity.org/benchmarks/8691

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8, CSCv7|4.8

Plugin: Windows

Control ID: 2a6ba2bb1d7d57ccc39a297e74dad6990608d01a95380d32d073ca330c8bc423