Skip to content

Microsoft Exchange 2013 Mailbox Server Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000261

    Group
  • SRG-APP-000261

    Group
  • Exchange external/Internet-bound automated response messages must be disabled.

    Spam originators, in an effort to refine mailing lists, sometimes monitor transmissions for automated bounce-back messages. Automated messages include such items as "Out of Office" responses, nonde...
    Rule Medium Severity
  • SRG-APP-000261

    Group
  • Exchange must have antispam filtering installed.

    Originators of spam messages are constantly changing their techniques in order to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. A ...
    Rule Medium Severity
  • SRG-APP-000261

    Group
  • SRG-APP-000261

    Group
  • Exchange must have antispam filtering configured.

    Originators of spam messages are constantly changing their techniques in order to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. A ...
    Rule Medium Severity
  • SRG-APP-000261

    Group
  • Exchange must not send automated replies to remote domains.

    Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Remote use...
    Rule Medium Severity
  • SRG-APP-000261

    Group
  • SRG-APP-000261

    Group
  • The Exchange Global Recipient Count Limit must be set.

    Email system availability depends in part on best practice strategies for setting tuning configurations. The Global Recipient Count Limit field is used to control the maximum number of recipients t...
    Rule Low Severity
  • SRG-APP-000295

    Group
  • The Exchange Receive connector timeout must be limited.

    Email system availability depends in part on best practice strategies for setting tuning. This configuration controls the number of idle minutes before the connection is dropped. It works in conjun...
    Rule Low Severity
  • SRG-APP-000367

    Group
  • SRG-APP-000378

    Group
  • The Exchange application directory must be protected from unauthorized access.

    Default product installations may provide more generous access permissions than are necessary to run the application. By examining and tailoring access permissions to more closely provide the least...
    Rule Medium Severity
  • SRG-APP-000380

    Group
  • An Exchange software baseline copy must exist.

    Exchange software, as with other application software installed on a host system, must be included in a system baseline record and periodically reviewed; otherwise, unauthorized changes to the soft...
    Rule Medium Severity
  • SRG-APP-000381

    Group
  • Exchange software must be monitored for unauthorized changes.

    Monitoring software files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.
    Rule Medium Severity
  • SRG-APP-000383

    Group
  • SRG-APP-000391

    Group
  • Exchange Outlook Anywhere (OA) clients must use NTLM authentication to access email.

    Identification and authentication provide the foundation for access control. Access to email services applications require NTLM authentication. Outlook Anywhere, if authorized for use by the site, ...
    Rule Medium Severity
  • SRG-APP-000431

    Group
  • SRG-APP-000435

    Group
  • Exchange must not send delivery reports to remote domains.

    Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Ensure tha...
    Rule Medium Severity
  • SRG-APP-000435

    Group
  • Exchange must not send nondelivery reports to remote domains.

    Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Ensure tha...
    Rule Medium Severity
  • SRG-APP-000435

    Group
  • SRG-APP-000435

    Group
  • Exchange must provide Mailbox databases in a highly available and redundant configuration.

    To protect Exchange Server mailbox databases and the data they contain by configuring Mailbox servers and databases for high availability and site resilience. A database availability group (DAG) i...
    Rule Medium Severity
  • SRG-APP-000456

    Group
  • Exchange must have the most current, approved service pack installed.

    Failure to install the most current Exchange service pack leaves a system vulnerable to exploitation. Current service packs correct known security and system vulnerabilities.
    Rule Medium Severity
  • SRG-APP-000516

    Group
  • SRG-APP-000278

    Group
  • The applications built-in Malware Agent must be disabled.

    Malicious code protection mechanisms include, but are not limited, to, anti-virus and malware detection software. In order to minimize potential negative impact to the organization that can be caus...
    Rule Medium Severity
  • SRG-APP-000278

    Group
  • A DoD-approved third party Exchange-aware malicious code protection application must be implemented.

    Malicious code protection mechanisms include, but are not limited, to, anti-virus and malware detection software. In order to minimize potential negative impact to the organization that can be caus...
    Rule Medium Severity

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules