Exchange 2010 Mailbox Server STIG

The Microsoft Exchange Server 2010 STIGs cover four of the five roles available with Microsoft Exchange Server 2010. The Email Services Policy STIG must also be reviewed for each site hosting email services. Also, for the Client Access server, the IIS guidance must be reviewed prior to the OWA checks. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]

Details

Version / Release: V1R10

Published: 2017-07-05

Updated At: 2018-09-23 19:13:04

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-43993r1_rule Exch-1-106 LOW Public Store storage quota must be limited. This setting controls the maximum sizes of a Public Folder and the system’s response if these limits are exceeded. There are two available controls and the system response when the quota has been exceeded. The first control sends an email warning to F
    SV-43997r1_rule Exch-1-109 LOW The Public Folder Stores must mount at startup. Administrator responsibilities include the ability to react to unplanned maintenance tasks or emergency situations that may require Public Folder Store data manipulation. Occasionally, there may be a need to start the server with 'unmounted' data stores,
    SV-44000r1_rule Exch-1-112 MEDIUM Public Folder stores must be retained until backups are complete. Backup and recovery procedures are an important part of overall system availability and integrity. Complete backups reduce the chance of accidental deletion of important information, and make it possible to have complete recoveries. It is not uncom
    SV-44002r1_rule Exch-1-115 LOW Public Folder database must not be overwritten by a restore. Email system availability depends in part on best practices strategies for setting tuning configurations. Unauthorized or accidental restoration of public folder data risks data loss or corruption. This setting controls whether the public folder store
    SV-44011r2_rule Exch-1-301 LOW Mail quota settings must not restrict receiving mail. Mail quota settings control the maximum sizes of a user’s mailbox and the system’s response if these limits are exceeded. Mailbox data that is not monitored against a quota increases the risk of mail loss due to filled disk space, which can also ren
    SV-44013r1_rule Exch-1-303 LOW Mail Store storage quota must limit send. Mail quota settings control the maximum sizes of a user’s mailbox and the system’s response if these limits are exceeded. Mailbox data that is not monitored against a quota increases the risk of mail loss due to filled disk space, which can also ren
    SV-44015r1_rule Exch-1-306 LOW Mail Store storage quota must issue a warning. Mail quota settings control the maximum sizes of a user’s mailbox and the system’s response if these limits are exceeded. Mailbox data that is not monitored against a quota increases the risk of mail loss due to filled disk space, which can also ren
    SV-44017r1_rule Exch-1-309 LOW The Mailbox Stores must mount at startup. Administrator responsibilities include the ability to react to unplanned maintenance tasks or emergency situations that may require Mailbox data manipulation. Occasionally, there may be a need to start the server with 'unmounted' data stores, if manual
    SV-44020r1_rule Exch-1-312 MEDIUM Mailboxes must be retained until backups are complete. Backup and recovery procedures are an important part of overall system availability and integrity. Complete backups reduce the chance of accidental deletion of important information, and make it possible to have complete recoveries. It is not uncom
    SV-44022r1_rule Exch-1-315 LOW Mailbox database must not be overwritten by a restore. Email system availability depends in part on best practices strategies for setting tuning configurations. Unauthorized or accidental restoration of mailbox data risks data loss or corruption. This setting controls whether the mailbox store can be o
    SV-44024r1_rule Exch-1-318 MEDIUM Mailbox databases must reside on a dedicated partition. In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of ot
    SV-44025r2_rule Exch-1-321 MEDIUM Email forwarding must be restricted. Auto-forwarded email accounts do not meet the requirement for digital signature and encryption of CUI and PII IAW DoDI 8520.2 (reference ee) and DoD Director for Administration and Management memorandum, 'Safeguarding Against and Responding to the Breach
    SV-44026r2_rule Exch-2-817 MEDIUM Email Diagnostic log level must be set to low or lowest level. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Diagnostic logging, however, characteristically produces large volumes of data and requires care in
    SV-44028r2_rule Exch-2-820 MEDIUM The Send Fatal Errors to Microsoft must be disabled. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. This setting enables an automated log entry to be sent to Microsoft giving general details about
    SV-44029r2_rule Exch-2-823 MEDIUM Administrator audit logging must be enabled. Unauthorized or malicious data changes can compromise the integrity and usefulness of the data. Automated attacks or malicious users with elevated privileges have the ability to affect change using the same mechanisms as email administrators. Auditin
    SV-44031r1_rule Exch-2-826 MEDIUM Audit data must be protected against unauthorized access. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive, and in need of protection. Audit data ava
    SV-44032r2_rule Exch-1-802 LOW Circular Logging must be disabled. Logging provides a history of events performed, and can also provide evidence of tampering or attack. Failure to create and preserve logs adds to the risk that suspicious events may go unnoticed, or the raise the potential that insufficient history will b
    SV-44033r1_rule Exch-2-828 MEDIUM Exchange application directory must be protected from unauthorized access. Default product installations may provide more generous access permissions than are necessary to run the application. By examining and tailoring access permissions to more closely provide the least amount of privilege possible, attack vectors that align
    SV-44034r1_rule Exch-1-805 MEDIUM Email Subject Line logging must be disabled. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. When “message tracking” is enabled, only the sender, recipients, time, and other delivery info
    SV-44035r1_rule Exch-1-808 MEDIUM Message Tracking Logging must be enabled. A message tracking log provides a detailed log of all message activity as messages are transferred to and from a computer running Exchange. If events are not recorded it may be difficult or impossible to determine the root cause of system problems or the
    SV-44036r1_rule Exch-2-831 MEDIUM Exchange must not send Customer Experience reports to Microsoft. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. This setting enables an automated entry to be sent to Microsoft giving general details about how th
    SV-44037r2_rule Exch-2-833 LOW Audit record parameters must be set. Log files help establish a history of activities, and can be useful in detecting attack attempts. This item declares the fields that must be available in the audit log file in order to adequately research events that are logged. Audit records should in
    SV-44038r1_rule Exch-2-839 MEDIUM Audit data must be on separate partitions. Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive, and in need of protection. Successful
    SV-44039r3_rule Exch-2-842 MEDIUM Queue monitoring must be configured with threshold and action. Monitors are automated “process watchers” that respond to performance changes, and can be useful in detecting outages and alerting administrators where attention is needed. Exchange has built-in monitors that enable the administrator to generate alert
    SV-44040r1_rule Exch-3-003 MEDIUM Email software must be monitored for change on INFOCON frequency schedule. The INFOCON system provides a framework within which the Commander USSTRATCOM regional commanders, service chiefs, base/post/camp/station/vessel commanders, or agency directors can increase the measurable readiness of their networks to match operational p
    SV-44041r1_rule Exch-3-006 MEDIUM Exchange software baseline copy must exist. Exchange software, as with other application software installed on a host system, must be included in a system baseline record and periodically reviewed; otherwise unauthorized changes to the software may not be discovered. This effort is a vital step to
    SV-44043r2_rule Exch-3-804 MEDIUM Services must be documented and unnecessary services must be removed or disabled. Unneeded, but running, services offer attackers an enhanced attack profile, and attackers are constantly watching to discover open ports with running services. By analyzing and disabling unneeded services, the associated open ports become unresponsive t
    SV-44045r3_rule Exch-3-807 MEDIUM Email application must not share a partition with another application. In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of ot
    SV-44046r2_rule Exch-2-014 MEDIUM Servers must use approved DoD certificates. Server certificates are required for many security features in Exchange; without them the server cannot engage in many forms of secure communication. Failure to implement valid certificates makes it virtually impossible to secure Exchange's communication
    SV-44048r1_rule Exch-3-811 HIGH Email servers must have Email aware virus protection. With the proliferation of trojans, viruses, and SPAM attaching themselves to email messages (or attachments), it is necessary to have capable email Aware Anti-Virus (AV) products to scan messages and identify any resident malware. Because email messages a
    SV-44049r3_rule Exch-3-814 MEDIUM The current, approved service pack must be installed. Failure to install the most current Exchange service pack leaves a system vulnerable to exploitation. Current service packs correct known security and system vulnerabilities.
    SV-44052r1_rule Exch-2-019 MEDIUM Local machine policy must require signed scripts. Scripts often provide a way for attackers to infiltrate a system, especially those downloaded from untrusted locations. By setting machine policy to prevent unauthorized script executions, unanticipated system impacts can be avoided. Failure to allow o
    SV-50976r1_rule Exch-1-324 MEDIUM Email forwarding SMTP domains must be restricted. Auto-forwarded email accounts do not meet the requirement for digital signature and encryption of CUI and PII IAW DoDI 8520.2 (reference ee) and DoD Director for Administration and Management memorandum, 'Safeguarding Against and Responding to the Breach