What changed in Microsoft Exchange 2016 Edge Transport Server STIG V2R7V2R7 changes

Title

Exchange servers must use approved DoDW certificates.

Check text

Open the Exchange Management Shell and enter the following command: Get-ExchangeCertificate | Select CertificateDomains, issuer If the value of "CertificateDomains" does not indicate it is issued by the DoDDoW, this is a finding.

Fix text

Remove the non-DoDW certificate and import the correct DoDW certificates.

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoDDoW-approved PKIs, all DoDDoW systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. This requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.

V-221203 in V2R7

Discussion

Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the maximum number of recipients who will receive a copy of a message at one time. This tunable value is related to throughput capacity and can enable the ability to optimize message delivery. Note: There are two types of default Receive connecters: "Client Servername" accepts SMTP connections from all non-MAPI clients, such as POP and IMAP. As POP and IMAP are not authorized for use in DoDDoW, these should not be present. Their default value for MaxRecipientsPerMessage is 200. IMAP Secure is not restricted and may be configured. "Default Servername" accepts connections from other mailbox servers and any Edge Transport servers. Their default value for MaxRecipientsPerMessage is 5000.

V-221229 in V2R7

Check text

This requirement is N/A for SIPR enclaves. This requirement is N/A if the organization subscribes to EEMSG or other similar DoDDoW enterprise protections for email services. Open the Exchange Management Shell and enter the following command: Get-SenderFilterConfig | Select Name, Action If the value of "Action" is not set to "Reject", this is a finding.

V-221232 in V2R7

Check text

This requirement is N/A for SIPR enclaves. This requirement is N/A if the organization subscribes to EEMSG or other similar DoDDoW enterprise protections for email services. Open the Exchange Management Shell and enter the following command: Get-SenderFilterConfig | Select Name, BlankSenderBlockingEnabled If the value of "BlankSenderBlockingEnabled" is not set to "True", this is a finding.

V-221233 in V2R7

Check text

This requirement is N/A for SIPR enclaves. This requirement is N/A if the organization subscribes to EEMSG or other similar DoDDoW enterprise protections for email services. Open the Exchange Management Shell and enter the following command: Get-SenderFilterConfig | Select Name, Enabled If the value of "Enabled" is not set to "True", this is a finding.

V-221248 in V2R7

Check text

Review the Email Domain Security Plan (EDSP) for an installed antispam product. Note: If using another DoDDoW-approved antispam product for email or a DoDDoW-approved Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable. Open the Exchange Management Shell and enter the following command: Get-ContentFilterConfig | Format-Table Name, Enabled If no value is returned, this is a finding.

V-221249 in V2R7

Check text

Review the Email Domain Security Plan (EDSP) for an installed antispam product. Note: If using another DoDDoW-approved antispam product for email or a DoDDoW-approved Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable. Open the Exchange Management Shell and enter the following command: Get-ContentFilterConfig | Format-Table Name, Enabled; Get-SenderFilterConfig | Format-Table Name, Enabled; Get-SenderIDConfig | Format-Table Name, Enabled; Get-SenderReputationConfig | Format-Table Name, Enabled If any of the following values returned are not set to "True", this is a finding: Set-ContentFilterConfig Set-SenderFilterConfig Set-SenderIDConfig Set-SenderReputationConfig

V-221250 in V2R7

Check text

Site should utilize an approved DoDDoW scanner as Exchange Malware software has a limited scanning capability. If an approved DoDDoW scanner is not being used, this is a finding.

Fix text

Following vendor best practice guidance, install and configure a DoDW approved scanner.

V-221251 in V2R7

Check text

Note: If using a DoDDoW-approved protection mechanism such as Cloud Based Internet Isolation (CBII), Bromium, Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), or other approved email sanitization solution that protects against untrusted URLs embedded in email, this is not applicable. Note: If system is on SIPRNet, this is not applicable. Review the Email Domain Security Plan (EDSP). Determine the name of the Transport Agent. Open the Windows PowerShell console and enter the following command: Get-TransportAgent -Name 'customAgent' | FL If the value does not return "customAgent", this is a finding. Note: "customAgent" is the name of the custom agent developed to render hyperlink email sources from non .mil domains as unclickable.

Fix text

Update the EDSP to reflect the name of the Transport Agent. Contact the DISA Enterprise Email Service Desk at disa.tinker.eis.mbx.dodDoW-enterprise-services-service-desk@mail.mil and request the Agent and installation procedures. or Contact DEE Engineering PMO and request the Agent and installation procedures.

Discussion

Active hyperlinks within an email are susceptible to attacks of malicious software or malware. The hyperlink could lead to a malware infection or redirect the website to another fraudulent website without the user's consent or knowledge. Exchange does not have a built-in message filtering capability. DoDDoW Enterprise Email (DEE) has created a custom resolution to filter messages from non-.mil users that have hyperlinks in the message body. The hyperlink within the messages will be modified, preventing end users from automatically clicking links.

V-221253 in V2R7

Check text

Site must utilize an approved DoDDoW third-party malicious code scanner. Consult with System Administrator to demonstrate the application being used to provide malicious code protection in the Exchange implementation. If System Administrator is unable to demonstrate a third-party malicious code protection application, this is a finding. If System Administrator is unaware of a third-party malicious code protection application, this is a finding.

V-221265 in V2R7

Check text

Site must utilize an approved DoDDoW third-party malicious code scanner. Consult with System Administrator to demonstrate the application being used to provide malicious code protection in the Exchange implementation. If System Administrator is unable to demonstrate a third-party malicious code protection application, this is a finding. If System Administrator is unaware of a third-party malicious code protection application, this is a finding.

V-221267 in V2R7

Check text

Site must utilize an approved DoDDoW third-party malicious code scanner. Consult with System Administrator to demonstrate the application being used to provide malicious code protection in the Exchange implementation. If System Administrator is unable to demonstrate a third-party malicious code protection application, this is a finding. If System Administrator is unaware of a third-party malicious code protection application, this is a finding.

V-221269 in V2R7

Discussion

Malicious code protection mechanisms include, but are not limited, to, anti-virus and malware detection software. In order to minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated. Malicious code includes viruses, worms, trojan horses, and spyware. It is not enough to simply have the software installed; this software must periodically scan the system to search for malware on an organization-defined frequency. Exchange's built-in Malware Agent is not designed to address all malicious code protection workloads. This workload is best handled by third-party anti-virus and intrusion prevention software. Site must utilize an approved DoDDoW scanner. Exchange Malware software has a limited scanning capability and does not scan files that are downloaded, opened, or executed.

V-221270 in V2R7