What changed in Microsoft Office System 2013 STIG V2R2V2R2 changes

Title

Office automatic updates must be enabled for Office products installed via Click-to-Run and configured to use a Trusted site.The version of Microsoft Office running on the system must be a supported version.

Check text

Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2013 (Machine)->Updates->"Enable Automatic Updates" is setno tolonger "Enabled". Verifysupported theby policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Updates -> "Specify intranet Microsoft update service location" is set to "Enabled" and the "Set the intranet update service for detecting updates:" and the "Set the intranet statistics server:" both point to an Intranet systemvendor. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1software1policies1Microsoft1office115.01common1officeupdate Criteria: If the valuesystem EnableAutomaticUpdates is REG_DWORDrunning =Microsoft 1,Office this is not a finding. If the registry key is missing2013, this is an Open finding. This setting is, by default, enabled and must be explicitly configured to be disabled. HKLM1software1policies1Microsoft1Windows1WindowsUpdate Criteria: If the value of WUServer and WUStatusServer are populated with an Intranet system, this is not a finding.

Fix text

SetUpgrade the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2013 (Machine)->Updates->"Enable Automatic Updates" to "Enabled". Seta thesupported policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Updates -> "Specify intranet Microsoft update service location" to "Enabled" and the "Set the intranet update service for detecting updates:" and the "Set the intranet statistics server:"to point to an Intranet systemversion.

Discussion

ThisSecurity policyflaws settingwith controlssoftware whetherapplications theare Officediscovered automaticdaily. updatesVendors are enabledconstantly orupdating disabledand forpatching alltheir Office products installedto viaaddress Click-newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-Runrelevant software updates (e.g., Thispatches, policyservice haspacks, noand effecthot onfixes). OfficeFlaws productsdiscovered installedduring viasecurity Windowsassessments, Installercontinuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. Organization-defined Iftime thisperiods policyfor settingupdating issecurity-relevant enabled,software Officemay periodicallyvary checksbased on a variety of factors including, for updates.example, Whenthe updatessecurity arecategory detectedof the information system or the criticality of the update (i.e., Officeseverity downloadsof the vulnerability related to the discovered flaw). This requirement will apply to software patch management solutions used to install patches across the enclave and appliesalso themto inapplications themselves that are not part of that patch management solution. For example, many browsers today provide the backgroundcapability to install their own patch software. IfPatch policycriticality, settingas iswell disabledas system criticality will vary. Therefore, Officethe tactical situations regarding the patch management process will notalso checkvary. This means that the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. The Withoutapplication receivingwill automaticbe updates,configured vulnerabilitiesto foundcheck for and install security-relevant software updates within an identified time period from the Officeavailability productsof willthe notupdate. The specific time period will be applieddefined by an authoritative source (e.g., leavingIAVM, theCTOs, vulnerabilitiesDTMs, exposedand STIGs).

V-228562 in V2R2