Detections
Analytics

1.13 Set 'Display pictures and external content in HTML e- mail' to 'Enabled'

Information

This policy setting controls whether Outlook downloads untrusted pictures and external
content located in HTML e-mail messages without users explicitly choosing to download
them.
If you enable this policy setting, Outlook will not automatically download content from
external servers unless the sender is included in the Safe Senders list. Recipients can
choose to download external content from untrusted senders on a message-by-message
basis.
If you disable this policy setting, Outlook does not display pictures and external content in
HTML e-mail.
If you do not configure this policy setting, Outlook does not download external content in
HTML e-mail and RSS items unless the content is considered safe. Content that Outlook can
be configured to consider safe includes-

. Content in e-mail messages from senders and to recipients defined in the Safe
Senders and Safe Recipients lists.
. Content from Web sites in Internet Explorer's Trusted Sites security zone.
. Content in RSS items.
. Content from SharePoint Discussion Boards. Users can control what content is
considered safe by changing the options in the 'Automatic Download' section of the
Trust Center.If Outlook's default blocking configuration is overridden, in the Trust Center or by some
other method, Outlook will display external content in all HTML e-mail messages, including
any that include Web beacons. The recommended state for this setting is- Enabled.

*Rationale*

Malicious e-mail senders can send HTML e-mail messages with embedded Web beacons,
which are pictures and other content from external servers that can be used to track
whether specific recipients open the message. Viewing an e-mail message that contains a
Web beacon provides confirmation that the recipient's e-mail address is valid, which leaves
the recipient vulnerable to additional spam and harmful e-mail.
By default, Outlook does not download external content in HTML e-mail and RSS items
unless the content is considered safe. Content that Outlook 2010 can be configured to
consider safe includes-

. Content in e-mail messages from senders and to recipients defined in the Safe
Senders and Safe Recipients lists.
. Content from Web sites in Internet Explorer's Trusted Sites security zone.
. Content in RSS items.
. Content from SharePoint Discussion Boards.Users can control what content is considered safe by changing the options in the Automatic
Download section of the Trust Center. If Outlook's default blocking configuration is
overridden, in the Trust Center or by some other method, Outlook will display external
content in all HTML e-mail messages, including any that include Web beacons.

Solution

To implement the recommended configuration state, set the following Group Policy setting
to Enabled.


User Configuration\Administrative Templates\Microsoft Outlook 2010\Security\Automatic
Picture Download Settings\Display pictures and external content in HTML e-mail

Impact-Enabling this setting enforces the default configuration in Outlook 2010, and therefore is
unlikely to cause usability issues for most users.

See Also

https://workbench.cisecurity.org/files/530

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(3)

Plugin: Windows

Control ID: 1ac22f2df86dba94e3bd7d91fb70ad2ad7f8f6da2970b41cac60c3d7c9887b42