Microsoft Office System 2013 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000141
Group -
The ability to automatically hyperlink screenshots within Word, PowerPoint, Excel and Outlook must be disabled.
The ability to automatically bind hyperlink to a screenshot inserted through the Insert Screenshot tool introduces the possibility of a malicious URL or website being imbedded in the Word, PowerPoi...Rule Medium Severity -
SRG-APP-000141
Group -
The prompt to save to OneDrive (formerly SkyDrive) must be disabled.
OneDrive (formerly SkyDrive) is a cloud based storage feature that introduces the capability for users to save documents to locations outside of protected enclaves. This feature introduces the risk...Rule Medium Severity -
SRG-APP-000141
Group -
Office Presentation Service must be removed as an option for presenting PowerPoint and Word online.
The Office Presentation Service is a free, public service that allows others to follow along in a web browser. Allowing this feature could result in presentations with DoD FOUO, PII and other prot...Rule Medium Severity -
SRG-APP-000141
Group -
The Office Feedback tool must be disabled.
The "Office Feedback" tool, also called "Send-a-Smile", allows a user to click on an icon and send feedback to Microsoft. Applications used by DoD users should not be able to provide feedback to co...Rule Medium Severity -
SRG-APP-000141
Group -
SRG-APP-000141
Group -
The ability of the Office Telemetry Agent to periodically upload telemetry data to a shared folder must be disabled.
Office Telemetry is a new compatibility monitoring framework. When an Office document or solution is loaded, used, closed, or raises an error in certain Office 2013 applications, the Office Telemet...Rule Medium Severity -
SRG-APP-000141
Group -
SRG-APP-000210
Group -
Documents must be configured to not open as Read Write when browsing.
By default, when an Office 2013 document on a web server is opened using Internet Explorer, the appropriate application opens the file in read-only mode. However, if the default configuration is ch...Rule Medium Severity -
SRG-APP-000210
Group -
Relying on Vector markup Language (VML) for displaying graphics in browsers must be disallowed.
When saving documents as web pages, Excel, PowerPoint, and Word can save vector-based graphics in Vector Markup Language (VML), which enables Internet Explorer to display them smoothly at any resol...Rule Medium Severity -
SRG-APP-000210
Group -
SRG-APP-000210
Group -
The ability to create an online presentation programmatically must be disabled.
Allowing online presentations to be created programmatically allows for the capability of malicious content to become imbedded in those programmatically created presentations.Rule Medium Severity -
SRG-APP-000231
Group -
Document metadata for password protected files must be protected.
When an Office Open XML document is protected with a password and saved, any metadata associated with the document is encrypted along with the rest of the document's contents. If this configuration...Rule Medium Severity -
SRG-APP-000231
Group -
SRG-APP-000231
Group -
The encryption type for password protected Office 97 thru Office 2003 must be set.
If unencrypted files are intercepted, sensitive information in the files can be compromised. To protect information confidentiality, Microsoft Office application files can be encrypted and password...Rule Medium Severity -
SRG-APP-000231
Group -
SRG-APP-000209
Group -
SRG-APP-000209
Group -
Load controls in forms3 must be disabled from loading.
ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls can access the local file system and change the registry settings of the...Rule Medium Severity -
SRG-APP-000131
Group -
SRG-APP-000328
Group -
Changing permissions on rights managed content for users must be enforced.
This setting controls whether Office 2013 users can change permissions for content that is protected with Information Rights Management (IRM). The Information Rights Management feature of Office 20...Rule Medium Severity -
SRG-APP-000328
Group -
Office must be configured to not allow read with browsers.
The Windows Rights Management Add-on for Internet Explorer provides a way for users who do not use the 2013 Office release to view, but not alter, files with restricted permissions. By default, IRM...Rule Medium Severity -
SRG-APP-000340
Group -
SRG-APP-000488
Group -
SRG-APP-000488
Group -
Hyperlink warnings for Office must be configured for use.
Unsafe hyperlinks are links that might pose a security risk if users click them. Clicking an unsafe link could compromise the security of sensitive information or harm the computer. Links that Offi...Rule Medium Severity -
SRG-APP-000488
Group -
Document Information panel Beaconing must show UI.
This policy setting controls whether users see a security warning when they open custom Document Information Panels that contain a web beaconing threat. Web beacons can be used to contact an exter...Rule Medium Severity -
SRG-APP-000429
Group -
Rights managed Office Open XML files must be protected.
When Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata associated with the document is not encrypted. This configuration could allow potent...Rule Medium Severity -
SRG-APP-000429
Group -
Encrypt document properties must be configured for OLE documents.
This policy setting allows a document's properties to be encrypted. This applies to OLE documents (Office 97-2003 compatible) if the application is configured for CAPI RC4. Disabling this setting...Rule Medium Severity -
SRG-APP-000456
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.