Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Exchange receive connectors must control the number of recipients per message.
Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the maximum number of recipients who will receive a copy of a ...Rule Low Severity -
SRG-APP-000247
Group -
Exchange message size restrictions must be controlled on send connectors.
Email system availability depends in part on best practice strategies for setting tuning configurations. For message size restrictions, multiple places exist to set or override inbound or outbound ...Rule Low Severity -
SRG-APP-000247
Group -
The Exchange global inbound message size must be controlled.
Email system availability depends in part on best practice strategies for setting tuning configurations. Message size limits should be set to 10 MB at most but often are smaller, depending on the o...Rule Low Severity -
SRG-APP-000247
Group -
SRG-APP-000247
Group -
SRG-APP-000247
Group -
SRG-APP-000261
Group -
Exchange servers must have an approved DOD email-aware virus protection software installed.
With the proliferation of trojans, viruses, and spam attaching themselves to email messages (or attachments), it is necessary to have capable email-aware antivirus (AV) products to scan messages an...Rule High Severity -
SRG-APP-000261
Group -
SRG-APP-000261
Group -
Exchange external/internet-bound automated response messages must be disabled.
Spam originators, in an effort to refine mailing lists, sometimes monitor transmissions for automated bounce-back messages. Automated messages include such items as "Out of Office" responses, nonde...Rule Medium Severity -
SRG-APP-000261
Group -
SRG-APP-000261
Group -
Exchange must have anti-spam filtering enabled.
Originators of spam messages are constantly changing their techniques to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. A manual up...Rule Medium Severity -
SRG-APP-000261
Group -
SRG-APP-000261
Group -
Exchange must not send automated replies to remote domains.
Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Remote use...Rule Medium Severity -
SRG-APP-000261
Group -
SRG-APP-000272
Group -
Exchange antimalware agent must be enabled and configured.
Microsoft Exchange 2019 offers built-in antimalware protection for messages going through the transport pipeline. When enabled, the default settings are configured to automatically update. Exchang...Rule Medium Severity -
SRG-APP-000272
Group -
SRG-APP-000295
Group -
The Exchange receive connector timeout must be limited.
Email system availability depends in part on best practice strategies for setting tuning. This configuration controls the number of idle minutes before the connection is dropped. It works in conjun...Rule Low Severity -
SRG-APP-000340
Group -
SRG-APP-000378
Group -
The Exchange application directory must be protected from unauthorized access.
Default product installations may provide more generous access permissions than are necessary to run the application. By examining and tailoring access permissions to provide the least amount of pr...Rule Medium Severity -
SRG-APP-000380
Group -
An Exchange software baseline copy must exist.
Exchange software, as with other application software installed on a host system, must be included in a system baseline record and periodically reviewed; otherwise, unauthorized changes to the soft...Rule Medium Severity -
SRG-APP-000381
Group -
Exchange software must be monitored for unauthorized changes.
Monitoring software files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.Rule Medium Severity -
SRG-APP-000383
Group -
SRG-APP-000391
Group -
Exchange Outlook Anywhere clients must use NTLM authentication to access email.
Identification and authentication provide the foundation for access control. Access to email services applications require NTLM authentication. Outlook Anywhere, if authorized for use by the site, ...Rule Medium Severity -
SRG-APP-000431
Group -
SRG-APP-000435
Group -
Exchange must not send delivery reports to remote domains.
Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Ensure tha...Rule Medium Severity -
SRG-APP-000435
Group -
SRG-APP-000435
Group -
SRG-APP-000435
Group -
Exchange internal send connectors must use an authentication level.
The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. Several controls work together to provide security between internal server...Rule Medium Severity -
SRG-APP-000435
Group -
SRG-APP-000439
Group -
SRG-APP-000456
Group -
Exchange must use encryption for Outlook Web App (OWA) access.
This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicat...Rule Medium Severity -
Exchange must have forms-based authentication enabled.
Identification and Authentication provide the foundation for access control. Access to email services applications in the DOD requires authentication using DOD Public Key Infrastructure (PKI) certi...Rule Medium Severity -
Exchange must have authenticated access set to integrated Windows authentication only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., networks, web servers, and web porta...Rule Medium Severity -
Exchange auto-forwarding email to remote domains must be disabled or restricted.
Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Verify Aut...Rule Medium Severity -
Exchange connectivity logging must be enabled.
A connectivity log is a record of the SMTP connection activity of the outbound message delivery queues to the destination Mailbox server, smart host, or domain. Connectivity logging is available on...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.