Search filters the loaded procedure list locally. Separate terms must all match (use quotes for an exact phrase). Cached STIG Search results apply when you arrive from Search.
Objective ID
Severity
Discussion
V-272880
medium
Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.
Application communication sessions are protected using transport encryption protocols, such as TLS, which provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other.
This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and service-oriented architectures (SOAs).
This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/service-oriented architecture (SOA) will require the use of TLS mutual authentication (two-way/bidirectional).
Application communication sessions are protected using transport encryption protocols, such as TLS, which provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other.
This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and service-oriented architectures (SOAs).
This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/service-oriented architecture (SOA) will require the use of TLS mutual authentication (two-way/bidirectional).
V-272881
medium
Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.
Application communication sessions are protected using transport encryption protocols, such as TLS, which provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other.
This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and service-oriented architectures (SOAs).
This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/service-oriented architecture (SOA) will require the use of TLS mutual authentication (two-way/bidirectional).
Satisfies: SRG-APP-000142, SRG-APP-000383
Application communication sessions are protected using transport encryption protocols, such as TLS, which provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other.
This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and service-oriented architectures (SOAs).
This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/service-oriented architecture (SOA) will require the use of TLS mutual authentication (two-way/bidirectional).
Satisfies: SRG-APP-000142, SRG-APP-000383
V-272882
medium
Malicious code protection mechanisms include, but are not limited to, antivirus and malware detection software. To minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated.
Applications providing this capability must be able to perform actions in response to detected malware. Responses include blocking, quarantining, deleting, and alerting. Other technology- or organization-specific responses may also be employed to satisfy this requirement.
Malicious code includes viruses, worms, Trojan horses, and spyware.
This requirement applies to applications providing malicious code protection.
Satisfies: SRG-APP-000207, SRG-APP-000279, SRG-APP-000464, SRG-APP-000471, SRG-APP-000485, SRG-APP-000940
Applications providing this capability must be able to perform actions in response to detected malware. Responses include blocking, quarantining, deleting, and alerting. Other technology- or organization-specific responses may also be employed to satisfy this requirement.
Malicious code includes viruses, worms, Trojan horses, and spyware.
This requirement applies to applications providing malicious code protection.
Satisfies: SRG-APP-000207, SRG-APP-000279, SRG-APP-000464, SRG-APP-000471, SRG-APP-000485, SRG-APP-000940
V-272883
medium
Malicious code protection mechanisms include, but are not limited to, antivirus and malware detection software. To minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated.
Applications providing this capability must be able to perform actions in response to detected malware. Responses include blocking, quarantining, deleting, and alerting. Other technology- or organization-specific responses may also be employed to satisfy this requirement.
Malicious code includes viruses, worms, Trojan horses, and spyware.
This requirement applies to applications providing malicious code protection.
Satisfies: SRG-APP-000207, SRG-APP-000279, SRG-APP-000464, SRG-APP-000471, SRG-APP-000485, SRG-APP-000940
Applications providing this capability must be able to perform actions in response to detected malware. Responses include blocking, quarantining, deleting, and alerting. Other technology- or organization-specific responses may also be employed to satisfy this requirement.
Malicious code includes viruses, worms, Trojan horses, and spyware.
This requirement applies to applications providing malicious code protection.
Satisfies: SRG-APP-000207, SRG-APP-000279, SRG-APP-000464, SRG-APP-000471, SRG-APP-000485, SRG-APP-000940
V-272884
medium
The Safe Attachments feature will scan messages for attachments with malicious content. All messages with attachments not already flagged by anti-malware protections in EOP are downloaded to a Microsoft virtual environment for further analysis. Safe Attachments then uses machine learning and other analysis techniques to detect malicious intent. While Safe Attachments for Exchange Online is automatically configured in the preset policies, separate action is needed to enable it for other products.
Satisfies: SRG-APP-000209, SRG-APP-000112, SRG-APP-000206
Satisfies: SRG-APP-000209, SRG-APP-000112, SRG-APP-000206
V-272885
medium
Impersonation protection checks incoming emails to verify if the sender address is similar to the users or domains on an agency-defined list. If the sender address is significantly similar, as to indicate an impersonation attempt, the email is quarantined.
Satisfies: SRG-APP-000210, SRG-APP-000272
Satisfies: SRG-APP-000210, SRG-APP-000272
V-272886
medium
Application management functionality includes functions necessary for administration and requires privileged user access. Allowing nonprivileged users to access application management functionality capabilities increases the risk that nonprivileged users may obtain elevated privileges.
Using role-based access control (RBAC), roles and groups can be created within the security operations team to grant appropriate access to the MDE portal. Based on the roles and groups created, the capability will exist to have fine-grained control over what users with access to the portal can view and do.
Creation of Entra ID roles is a prerequisite to configuring RBAC within the MDE portal itself.
Defender for Endpoint RBAC is designed to support a role-based model and provides granular control over what roles can view, devices they can access, and actions they can take. The RBAC framework is centered around the following controls:
- Control who can take specific action.
- Create custom roles and control what Defender for Endpoint capabilities they can access with granularity.
- Control who can view information on specific device group or groups.
Satisfies: SRG-APP-000211, SRG-APP-000267
Using role-based access control (RBAC), roles and groups can be created within the security operations team to grant appropriate access to the MDE portal. Based on the roles and groups created, the capability will exist to have fine-grained control over what users with access to the portal can view and do.
Creation of Entra ID roles is a prerequisite to configuring RBAC within the MDE portal itself.
Defender for Endpoint RBAC is designed to support a role-based model and provides granular control over what roles can view, devices they can access, and actions they can take. The RBAC framework is centered around the following controls:
- Control who can take specific action.
- Create custom roles and control what Defender for Endpoint capabilities they can access with granularity.
- Control who can view information on specific device group or groups.
Satisfies: SRG-APP-000211, SRG-APP-000267
V-272887
medium
When first accessing the Microsoft Defender portal, either full access or read only access is granted. Full access rights are granted to users with the Security Administrator (or equivalent) role in Microsoft Entra ID. Read only access is granted to users with a Security Reader (or equivalent) role in Microsoft Entra ID.
The permission tiers available to assign to custom roles are as follows:
View data:
- Security Operations - View all security operations data in the portal.
- Defender Vulnerability Management - View Defender Vulnerability Management data in the portal.
Active remediation actions:
- Security Operations - Take response actions, approve or dismiss pending remediation actions, manage allowed/blocked lists for automation and indicators.
- Defender Vulnerability Management.
- Exception handling - Create new exceptions and manage active exceptions.
Defender Vulnerability Management - Remediation handling:
- Submit new remediation requests, create tickets, and manage existing remediation activities.
Defender Vulnerability Management - Application handling:
- Apply immediate mitigation actions by blocking vulnerable applications, as part of the remediation activity and manage the blocked apps and perform unblock actions
Security baselines:
- Defender Vulnerability Management.
- Manage security baselines assessment profiles.
- Create and manage profiles so users can assess if devices comply to security industry baselines.
Alerts investigation:
- Manage alerts, initiate automated investigations, run scans, collect investigation packages, manage device tags, and download only portable executable (PE) files.
Manage portal system settings:
- Configure storage settings, SIEM, and threat intel API settings (applies globally), advanced settings, automated file uploads, roles, and device groups.
Satisfies: SRG-APP-000211, SRG-APP-000267
The permission tiers available to assign to custom roles are as follows:
View data:
- Security Operations - View all security operations data in the portal.
- Defender Vulnerability Management - View Defender Vulnerability Management data in the portal.
Active remediation actions:
- Security Operations - Take response actions, approve or dismiss pending remediation actions, manage allowed/blocked lists for automation and indicators.
- Defender Vulnerability Management.
- Exception handling - Create new exceptions and manage active exceptions.
Defender Vulnerability Management - Remediation handling:
- Submit new remediation requests, create tickets, and manage existing remediation activities.
Defender Vulnerability Management - Application handling:
- Apply immediate mitigation actions by blocking vulnerable applications, as part of the remediation activity and manage the blocked apps and perform unblock actions
Security baselines:
- Defender Vulnerability Management.
- Manage security baselines assessment profiles.
- Create and manage profiles so users can assess if devices comply to security industry baselines.
Alerts investigation:
- Manage alerts, initiate automated investigations, run scans, collect investigation packages, manage device tags, and download only portable executable (PE) files.
Manage portal system settings:
- Configure storage settings, SIEM, and threat intel API settings (applies globally), advanced settings, automated file uploads, roles, and device groups.
Satisfies: SRG-APP-000211, SRG-APP-000267
V-272888
medium
Denial of service (DoS) is a condition in which a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.
Individuals of concern can include hostile insiders or external adversaries that have successfully breached the information system and are using the system as a platform to launch cyberattacks on third parties.
Applications and application developers must take the steps needed to ensure users cannot use an authorized application to launch DoS attacks against other systems and networks. For example, applications may include mechanisms that throttle network traffic so users are not able to generate unlimited network traffic via the application. Limiting system resources allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks.
The methods employed to counter this risk will be dependent upon the application layer methods that can be used to exploit it.
Satisfies: SRG-APP-000246, SRG-APP-000435
Individuals of concern can include hostile insiders or external adversaries that have successfully breached the information system and are using the system as a platform to launch cyberattacks on third parties.
Applications and application developers must take the steps needed to ensure users cannot use an authorized application to launch DoS attacks against other systems and networks. For example, applications may include mechanisms that throttle network traffic so users are not able to generate unlimited network traffic via the application. Limiting system resources allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks.
The methods employed to counter this risk will be dependent upon the application layer methods that can be used to exploit it.
Satisfies: SRG-APP-000246, SRG-APP-000435
V-272889
high
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Offloading is a common process in information systems with limited audit storage capacity.
Satisfies: SRG-APP-000515, SRG-APP-000086, SRG-APP-000108, SRG-APP-000125, SRG-APP-000181, SRG-APP-000358, SRG-APP-000745
Offloading is a common process in information systems with limited audit storage capacity.
Satisfies: SRG-APP-000515, SRG-APP-000086, SRG-APP-000108, SRG-APP-000125, SRG-APP-000181, SRG-APP-000358, SRG-APP-000745