What changed in Microsoft Exchange 2016 Mailbox Server STIG V2R7V2R7 changes

Title

Exchange servers must use approved DoDW certificates.

Check text

Open the Exchange Management Shell and enter the following command: Get-ExchangeCertificate | Select CertificateDomains, issuer If the value of "CertificateDomains" does not indicate it is issued by the DoDDoW, this is a finding.

Fix text

Remove the non-DoDW certificate and import the correct DoDW certificates.

V-228355 in V2R7

Discussion

IMAP4 is not approved for use within the DoDDoW. It uses a clear-text-based user name and password and does not support the DoDDoW standard for PKI for email access. User name and password could easily be captured from the network, allowing a malicious user to access other system features. Uninstalling or disabling the service will prevent the use of the IMAP4 protocol.

V-228371 in V2R7

Discussion

POP3 is not approved for use within the DoDDoW. It uses a clear-text-based user name and password and does not support the DoDDoW standard for PKI for email access. User name and password could easily be captured from the network, allowing a malicious user to access other system features. Uninstalling or disabling the service will prevent the use of POP3.

V-228372 in V2R7

Discussion

Auto-forwarded email accounts do not meet the requirement for digital signature and encryption of Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII) in accordance with DoDI 8520.2 (reference ee) and DoDDoW Director for Administration and Management memorandum, "Safeguarding Against and Responding to the Breach of Personally Identifiable Information". Use of forwarding set by an administrator interferes with nonrepudiation requirements that each end user be responsible for creation and destination of email data.

V-228377 in V2R7

Discussion

Auto-forwarded email accounts do not meet the requirement for digital signature and encryption of Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII) in accordance with DoDI 8520.2 (reference ee) and DoDDoW Director for Administration and Management memorandum, "Safeguarding Against and Responding to the Breach of Personally Identifiable Information". Use of forwarding set by an administrator interferes with nonrepudiation requirements that each end user be responsible for creation and destination of email data.

V-228378 in V2R7

Discussion

Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the maximum number of recipients who will receive a copy of a message at one time. This tunable value is related to throughput capacity and can enable the ability to optimize message delivery. Note: There are two types of default Receive connecters: Client Servername: Accepts SMTP connections from all non-MAPI clients, such as POP and IMAP. As POP and IMAP are not authorized for use in DoDDoW, these should not be present. Their default value for "MaxRecipientsPerMessage" is "200". Default Servername: Accepts connections from other Hub Transport servers and any Edge Transport servers. Their default value for "MaxRecipientsPerMessage" is "5000".

V-228383 in V2R7

Check text

Review the Email Domain Security Plan (EDSP). Note: If using another DoDDoW-approved antispam product for email or a DoDDoW-approved email gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable (NA). Open the Exchange Management Shell and enter the following command: Get-ContentFilterConfig | Format-Table Name,Enabled If no value is returned, this is a finding.

V-228393 in V2R7

Check text

Review the Email Domain Security Plan (EDSP). Note: If using another DoDDoW-approved anti-spam product for email or a DoDDoW-approved email gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable (NA). Open the Exchange Management Shell and enter the following command: Get-ContentFilterConfig | Format-Table Name,Enabled; Get-SenderFilterConfig | Format-Table Name,Enabled; Get-SenderIDConfig | Format-Table Name,Enabled; Get-SenderReputationConfig | Format-Table Name,Enabled If any of the following values returned are not set to "True", this is a finding: Set-ContentFilterConfig Set-SenderFilterConfig Set-SenderIDConfig Set-SenderReputationConfig

V-228394 in V2R7

Check text

Review the Email Domain Security Plan (EDSP). Note: If using another DoDDoW-approved antispam product for email or a DoDDoW-approved email gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable (NA). Determine the internal SMTP servers. Open the Exchange Management Shell and enter the following command: Get-TransportConfig | Format-List InternalSMTPServers If any internal SMTP server IP address returned does not reflect the list of accepted SMTP server IP addresses, this is a finding.

V-228395 in V2R7

Title

Exchange servers must have an approved DoDW email-aware virus protection software installed.

Check text

Review the Email Domain Security Plan (EDSP). Determine the anti-virus strategy. Verify the email-aware anti-virus scanner product is Exchange 2016 compatible and DoDDoW approved. If email servers are using an email-aware anti-virus scanner product that is not DoDDoW approved and Exchange 2016 compatible, this is a finding.

Fix text

Update the EDSP to specify the organization's anti-virus strategy. Install and configure a DoDDoW-approved compatible Exchange 2016 email-aware anti-virus scanner product.

V-228397 in V2R7

Check text

NOTE: For the purpose of this requirement, "remote" refers to those domains external to the DoDINDOWIN, whether classified or unclassified. NDRs between DoDINDOWIN networks is permitted. Open the Exchange Management Shell and enter the following command: Get-RemoteDomain | Select Name, Identity, NDREnabled If the value of "NDREnabled" is not set to "False", this is a finding.

V-228407 in V2R7

Title

The application must be configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Discussion

Configuring the application to implement organization-wide security implementation guides and security checklists ensures compliance with Federal standards and establishes a common security baseline across DoDDoW that reflects the most restrictive security posture consistent with operational requirements. Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.

V-228412 in V2R7

Discussion

Malicious code protection mechanisms include but are not limited to anti-virus and malware detection software. To minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated. Malicious code includes viruses, worms, trojan horses, and spyware. It is not enough to have the software installed; this software must periodically scan the system to search for malware on an organization-defined frequency. Exchange's built-in Malware Agent is not designed to address all malicious code protection workloads. This workload is best handled by third-party anti-virus and intrusion prevention software. Sites must use an approved DoDDoW scanner. Exchange Malware software has a limited scanning capability and does not scan files that are downloaded, opened, or executed.

V-228413 in V2R7

Discussion

Identification and Authentication provide the foundation for access control. Access to email services applications in the DoDDoW requires authentication using DoDDoW Public Key Infrastructure (PKI) certificates. Authentication for Outlook Web App (OWA) is used to enable web access to user email mailboxes and should assume that certificate-based authentication has been configured. This setting controls whether forms-based logon should be used by the OWA website. Because the DoDDoW requires Common Access Card (CAC)-based authentication to applications, OWA access must be brokered through an application proxy or other pre-authenticator, which performs CAC authentication prior to arrival at the CA server. The authenticated request is then forwarded directly to OWA, where authentication is repeated without requiring the user to repeat authentication steps. For this scenario to work, the Application Proxy server must have forms-based authentication enabled, and Exchange must have forms-based Authentication disabled. If forms-based Authentication is enabled on the Exchange CA server, it is evidence that the application proxy server is either not correctly configured, or it may be missing.

V-228417 in V2R7

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoDDoW-approved PKIs, all DoDDoW systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. This requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.

V-228418 in V2R7