Microsoft Office System 2010 Security Technical Implementation Guide

The Microsoft Office System 2010 Security Technical Implementation Guide (V1 R13) has 37 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

37STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R13

CurrentPublished Wed Jul 24 2024

Rights managed Office Open XML files must be protected.

Microsoft Office System 2010 Security Technical Implementation Guide

Assessment Title

Rule Text

Rights managed Office Open XML files must be protected.

Description

Discussion Text

When Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata associated with the document is not encrypted. This configuration could allow potentially sensitive information such as the document author and hyperlink references to be exposed to unauthorized people.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-241940

Rule

SV-241940r961602_rule

Severity

medium

Rule Version

DTOO187 - Office System

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office 2010 -> Security Settings "Protect document metadata for rights managed Office Open XML Files" must be set to "Enabled".

Procedure: Use the Windows Registry Editor to navigate to the following key: 

HKCU\Software\Policies\Microsoft\Office\14.0\common\security

Criteria: If the value DRMEncryptProperty is REG_DWORD = 1, this is not a finding.

Implementation Procedure

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2010 -> Security Settings "Protect document metadata for rights managed Office Open XML Files" to "Enabled".

STIG check 10 of 37 in the Microsoft Office System 2010 STIG checklist

← Previous · V-241939Trust Bar notifications for Security messages must be enforced.Next · V-241941 →Document metadata for password protected files must be protected.