DTOO418 - WEBSERVICE functions must be disabled.

Information

The WEBSERVICE function option, when used in an Excel spreadsheet, returns data from a web service on the Internet or Intranet. If allowed to be used, security is significantly reduced by allowing information disclosure to third party web services and could potentially introduce malicious content to the local network. The WEBSERVICE function must be disabled in Excel and configured to notify user if a WEBSERVICE function is present in an Excel spreadsheet.

Solution

Set policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel Options -> Security -> ' WEBSERVICE Function Notification Settings' is set to 'Enabled: Disable all with notifications'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Excel_2013_V1R8_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(1), CAT|II, CCI|CCI-001662, Rule-ID|SV-242373r961086_rule, STIG-ID|DTOO418, STIG-Legacy|SV-53841, STIG-Legacy|V-41344, Vuln-ID|V-242373

Plugin: Windows

Control ID: 14ab4ed3f0ca534e26d451d0361dd1ccfbb87555826935003bcdede74833501b