Exchange 2010 Client Access Server STIG

The Microsoft Exchange Server 2010 STIGs cover four of the five roles available with Microsoft Exchange Server 2010. The Email Services Policy STIG must also be reviewed for each site hosting email services. Also, for the Client Access server, the IIS guidance must be reviewed prior to the OWA checks. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]

Details

Version / Release: V1R7

Published: 2015-03-10

Updated At: 2018-09-23 02:40:47

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-43979r1_rule Exch-1-002 MEDIUM Encryption must be used for RPC client access. This setting controls whether client machines are forced to use secure channels to communicate with the server. If this feature is enabled, clients will only be able to communicate with the server over secure communication channels. Failure to require s
    SV-43982r1_rule Exch-1-005 MEDIUM The Microsoft Exchange IMAP4 service must be disabled. The IMAP4 protocol is not approved for use within the DoD. It uses a clear text based user name and password and does not support the DoD standard for PKI for email access. User name and password could easily be captured from the network allowing maliciou
    SV-43990r1_rule Exch-1-008 MEDIUM The Microsoft Exchange POP3 service must be disabled. The POP3 protocol is not approved for use within the DoD. It uses a clear text based user name and password and does not support the DoD standard for PKI for email access. User name and password could easily be captured from the network allowing malicious
    SV-43991r1_rule Exch-1-103 LOW The Public Folder virtual directory must be removed if not in use by the site. To reduce the vectors through which a server can be attacked, unneeded application components should be disabled or removed. By default, a virtual directory is installed for Public Folders. If an attacker were to intrude into an Exchange CA server and
    SV-44003r1_rule Exch-1-202 MEDIUM Web email must use standard ports protocols. PPSM standard defined ports and protocols must be used for all Exchange services. The standard port for HTTP connections is 80 and the standard port for HTTPS connections is 443. Changing the ports to non-standard values provides only temporary and li
    SV-44005r2_rule Exch-1-203 MEDIUM Encryption must be used for OWA access. This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting se
    SV-44008r1_rule Exch-1-205 MEDIUM Forms-based Authentication must not be enabled. Identification and Authentication provide the foundation for access control. Access to email services applications in the DoD require authentication using DoD Public Key Infrastructure (PKI) certificates. Authentication for Outlook Web App (OWA) is used
    SV-44026r1_rule Exch-2-817 MEDIUM Email Diagnostic log level must be set to lowest level. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Diagnostic logging, however, characteristically produces large volumes of data and requires care
    SV-44027r2_rule Exch-1-402 MEDIUM Outlook Anywhere (OA) clients must use NTLM authentication to access email. Identification and Authentication provide the foundation for access control. Access to email services applications require NTLM authentication. Outlook Anywhere, if authorized for use by the site, must use NTLM authentication when accessing email. Note
    SV-44028r2_rule Exch-2-820 MEDIUM The Send Fatal Errors to Microsoft must be disabled. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. This setting enables an automated log entry to be sent to Microsoft giving general details about
    SV-44029r2_rule Exch-2-823 MEDIUM Administrator audit logging must be enabled. Unauthorized or malicious data changes can compromise the integrity and usefulness of the data. Automated attacks or malicious users with elevated privileges have the ability to affect change using the same mechanisms as email administrators. Auditin
    SV-44030r1_rule Exch-1-603 LOW The Microsoft Active Sync directory must be removed. To reduce the vectors through which a server can be attacked, unneeded application components should be disabled or removed. By default, a virtual directory is installed for Active Sync, and the Exchange application default has Active Sync disabled.
    SV-44031r1_rule Exch-2-826 MEDIUM Audit data must be protected against unauthorized access. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive, and in need of protection. Audit data ava
    SV-44033r1_rule Exch-2-828 MEDIUM Exchange application directory must be protected from unauthorized access. Default product installations may provide more generous access permissions than are necessary to run the application. By examining and tailoring access permissions to more closely provide the least amount of privilege possible, attack vectors that align
    SV-44036r1_rule Exch-2-831 MEDIUM Exchange must not send Customer Experience reports to Microsoft. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. This setting enables an automated entry to be sent to Microsoft giving general details about how th
    SV-44037r2_rule Exch-2-833 LOW Audit record parameters must be set. Log files help establish a history of activities, and can be useful in detecting attack attempts. This item declares the fields that must be available in the audit log file in order to adequately research events that are logged. Audit records should in
    SV-44038r1_rule Exch-2-839 MEDIUM Audit data must be on separate partitions. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive, and in need of protection. Successful
    SV-44039r1_rule Exch-2-842 MEDIUM Queue monitoring must be configured with threshold and action. Monitors are automated 'process watchers' that respond to performance changes, and can be useful in detecting outages and alerting administrators where attention is needed. Exchange has built-in monitors that enable the administrator to generate alerts
    SV-44040r1_rule Exch-3-003 MEDIUM Email software must be monitored for change on INFOCON frequency schedule. The INFOCON system provides a framework within which the Commander USSTRATCOM regional commanders, service chiefs, base/post/camp/station/vessel commanders, or agency directors can increase the measurable readiness of their networks to match operational p
    SV-44041r1_rule Exch-3-006 MEDIUM Exchange software baseline copy must exist. Exchange software, as with other application software installed on a host system, must be included in a system baseline record and periodically reviewed; otherwise unauthorized changes to the software may not be discovered. This effort is a vital step to
    SV-44043r2_rule Exch-3-804 MEDIUM Services must be documented and unnecessary services must be removed or disabled. Unneeded, but running, services offer attackers an enhanced attack profile, and attackers are constantly watching to discover open ports with running services. By analyzing and disabling unneeded services, the associated open ports become unresponsive t
    SV-44045r2_rule Exch-3-807 MEDIUM Email application must not share a partition with another application. In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of ot
    SV-44046r2_rule Exch-2-014 MEDIUM Servers must use approved DoD certificates. Server certificates are required for many security features in Exchange; without them the server cannot engage in many forms of secure communication. Failure to implement valid certificates makes it virtually impossible to secure Exchange's communication
    SV-44049r3_rule Exch-3-814 MEDIUM The current, approved service pack must be installed. Failure to install the most current Exchange service pack leaves a system vulnerable to exploitation. Current service packs correct known security and system vulnerabilities. ECSC-1
    SV-44052r1_rule Exch-2-019 MEDIUM Local machine policy must require signed scripts. Scripts often provide a way for attackers to infiltrate a system, especially those downloaded from untrusted locations. By setting machine policy to prevent unauthorized script executions, unanticipated system impacts can be avoided. Failure to allow o
    SV-44065r2_rule Exch-1-208 MEDIUM HTTP authenticated access must be set to Integrated Windows Authentication only. This feature controls the authentication method used to connect to the OWA virtual directories. Ensure this is set to Integrated Windows Authentication only. Anonymous access provides for no access control. Basic Authentication transmits the password in
    SV-50983r2_rule Exch-1-502 MEDIUM Exchange ActiveSync (EAS) must only use certificate-based authentication to access email. Identification and Authentication provide the foundation for access control. For EAS to be used effectively on DoD networks, client certificate authentication must be used for communications between the MEM and email server. Additionally, the internal and
    SV-50988r2_rule Exch-1-505 MEDIUM IIS must map client certificates to an approved certificate server For EAS to be used effectively on DoD networks, client certificate authentication must be used for communications between the MEM and email server. Identification and Authentication provide the foundation for access control. IIS must be mapped to an appro