Skip to content
ATO Pathways
  Log In

Microsoft Office System 2013 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000141

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Office Telemetry Agent and Office applications must be configured to collect telemetry data.

    &lt;VulnDiscussion&gt;Office Telemetry is a new compatibility monitoring framework. When an Office document or solution is loaded, used, closed, or...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Documents must be configured to not open as Read Write when browsing.

    &lt;VulnDiscussion&gt;By default, when an Office 2013 document on a web server is opened using Internet Explorer, the appropriate application opens...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Relying on Vector markup Language (VML) for displaying graphics in browsers must be disallowed.

    &lt;VulnDiscussion&gt;When saving documents as web pages, Excel, PowerPoint, and Word can save vector-based graphics in Vector Markup Language (VML...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Automation Security to enforce macro level security in Office documents must be configured.

    &lt;VulnDiscussion&gt;When a separate program is used to launch Microsoft Office Excel, PowerPoint, or Word programmatically, any macros can run in...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ability to create an online presentation programmatically must be disabled.

    &lt;VulnDiscussion&gt;Allowing online presentations to be created programmatically allows for the capability of malicious content to become imbedde...
    Rule Medium Severity
    Show

  • SRG-APP-000231

    <GroupDescription></GroupDescription>
    Group
    Show

  • Document metadata for password protected files must be protected.

    &lt;VulnDiscussion&gt;When an Office Open XML document is protected with a password and saved, any metadata associated with the document is encrypt...
    Rule Medium Severity
    Show

  • SRG-APP-000231

    <GroupDescription></GroupDescription>
    Group
    Show

  • The encryption type for password protected Open XML files must be set.

    &lt;VulnDiscussion&gt;If unencrypted files are intercepted, sensitive information in the files can be compromised. To protect information confident...
    Rule Medium Severity
    Show

  • SRG-APP-000231

    <GroupDescription></GroupDescription>
    Group
    Show

  • The encryption type for password protected Office 97 thru Office 2003 must be set.

    &lt;VulnDiscussion&gt;If unencrypted files are intercepted, sensitive information in the files can be compromised. To protect information confident...
    Rule Medium Severity
    Show

  • SRG-APP-000231

    <GroupDescription></GroupDescription>
    Group
    Show

  • Passwords for secured documents must be enforced.

    &lt;VulnDiscussion&gt;If 2013 Office users add passwords to documents, other users can be prevented from opening the documents. This capability can...
    Rule Medium Severity
    Show

  • SRG-APP-000209

    <GroupDescription></GroupDescription>
    Group
    Show

  • Trust Bar notifications for Security messages must be enforced.

    &lt;VulnDiscussion&gt;The Message Bar in Office applications is used to identify security issues, such as unsigned macros or potentially unsafe add...
    Rule Medium Severity
    Show

  • SRG-APP-000209

    <GroupDescription></GroupDescription>
    Group
    Show

  • Load controls in forms3 must be disabled from loading.

    &lt;VulnDiscussion&gt;ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls ...
    Rule Medium Severity
    Show

  • SRG-APP-000131

    <GroupDescription></GroupDescription>
    Group
    Show

  • Users must be prevented from using or inserting apps that come from the Office Store.

    &lt;VulnDiscussion&gt;This policy setting allows users to be prevented from using or inserting apps that come from the Office Store. If this policy...
    Rule Medium Severity
    Show

  • SRG-APP-000328

    <GroupDescription></GroupDescription>
    Group
    Show

  • Changing permissions on rights managed content for users must be enforced.

    &lt;VulnDiscussion&gt;This setting controls whether Office 2013 users can change permissions for content that is protected with Information Rights ...
    Rule Medium Severity
    Show

  • SRG-APP-000328

    <GroupDescription></GroupDescription>
    Group
    Show

  • Office must be configured to not allow read with browsers.

    &lt;VulnDiscussion&gt;The Windows Rights Management Add-on for Internet Explorer provides a way for users who do not use the 2013 Office release to...
    Rule Medium Severity
    Show

  • SRG-APP-000340

    <GroupDescription></GroupDescription>
    Group
    Show

  • Connection verification of permissions must be enforced.

    &lt;VulnDiscussion&gt;Users are not required to connect to the network to verify permissions. If users do not need their licenses confirmed when at...
    Rule Medium Severity
    Show

  • SRG-APP-000488

    <GroupDescription></GroupDescription>
    Group
    Show

  • ActiveX control initialization must be disabled.

    &lt;VulnDiscussion&gt;ActiveX controls can adversely affect a computer directly. In addition, malicious code can be used to compromise an ActiveX c...
    Rule Medium Severity
    Show

  • SRG-APP-000488

    <GroupDescription></GroupDescription>
    Group
    Show

  • Hyperlink warnings for Office must be configured for use.

    &lt;VulnDiscussion&gt;Unsafe hyperlinks are links that might pose a security risk if users click them. Clicking an unsafe link could compromise the...
    Rule Medium Severity
    Show

  • SRG-APP-000488

    <GroupDescription></GroupDescription>
    Group
    Show

  • Document Information panel Beaconing must show UI.

    &lt;VulnDiscussion&gt;This policy setting controls whether users see a security warning when they open custom Document Information Panels that cont...
    Rule Medium Severity
    Show

  • SRG-APP-000429

    <GroupDescription></GroupDescription>
    Group
    Show

  • Rights managed Office Open XML files must be protected.

    &lt;VulnDiscussion&gt;When Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata associated w...
    Rule Medium Severity
    Show

  • SRG-APP-000429

    <GroupDescription></GroupDescription>
    Group
    Show

  • Encrypt document properties must be configured for OLE documents.

    &lt;VulnDiscussion&gt;This policy setting allows a document's properties to be encrypted. This applies to OLE documents (Office 97-2003 compatible...
    Rule Medium Severity
    Show

  • SRG-APP-000456

    <GroupDescription></GroupDescription>
    Group
    Show

  • Office automatic updates must be enabled for Office products installed via Click-to-Run and configured to use a Trusted site.

    &lt;VulnDiscussion&gt;This policy setting controls whether the Office automatic updates are enabled or disabled for all Office products installed v...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules