Skip to content
ATO Pathways
  Log In

Microsoft Outlook 2016 Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Read EMail as plain text must be enforced.

    <VulnDiscussion>Outlook can display email messages and other items in three formats: plain text, Rich Text Format (RTF), and HTML. By default...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Read signed email as plain text must be enforced.

    &lt;VulnDiscussion&gt;Outlook can display email messages and other items in three formats: plain text, Rich Text Format (RTF), and HTML. By default...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000112

    <GroupDescription></GroupDescription>
    Group
    Show

  • Enabling IE Bind to Object functionality must be present.

    &lt;VulnDiscussion&gt;Internet Explorer performs a number of safety checks before initializing an ActiveX control. It will not initialize a control...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Saved from URL mark to assure Internet zone processing must be enforced.

    &lt;VulnDiscussion&gt;Typically, when Internet Explorer loads a web page from a Universal Naming Convention (UNC) share that contains a Mark of the...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Navigation to URLs embedded in Office products must be blocked.

    &lt;VulnDiscussion&gt;To protect users from attacks, Internet Explorer usually does not attempt to load malformed URLs. This functionality can be c...
    Rule Medium Severity
    Show

  • SRG-APP-000112

    <GroupDescription></GroupDescription>
    Group
    Show

  • Scripted Window Security must be enforced.

    &lt;VulnDiscussion&gt;Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site t...
    Rule Medium Severity
    Show

  • SRG-APP-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • Add-on Management functionality must be allowed.

    &lt;VulnDiscussion&gt;Internet Explorer add-ons are pieces of code, run in Internet Explorer, to provide additional functionality. Rogue add-ons ma...
    Rule Medium Severity
    Show

  • SRG-APP-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • Links that invoke instances of Internet Explorer from within an Office product must be blocked.

    &lt;VulnDiscussion&gt;The Pop-up Blocker feature in Internet Explorer can be used to block most unwanted pop-up and pop-under windows from appearin...
    Rule Medium Severity
    Show

  • SRG-APP-000209

    <GroupDescription></GroupDescription>
    Group
    Show

  • File Downloads must be configured for proper restrictions.

    &lt;VulnDiscussion&gt;Disabling this setting allows websites to present file download prompts via code without the user specifically initiating the...
    Rule Medium Severity
    Show

  • SRG-APP-000112

    <GroupDescription></GroupDescription>
    Group
    Show

  • Protection from zone elevation must be enforced.

    &lt;VulnDiscussion&gt;Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local compute...
    Rule Medium Severity
    Show

  • SRG-APP-000488

    <GroupDescription></GroupDescription>
    Group
    Show

  • ActiveX Installs must be configured for proper restriction.

    &lt;VulnDiscussion&gt;Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Publishing calendars to Office Online must be prevented.

    &lt;VulnDiscussion&gt;This policy setting controls whether Outlook users can publish their calendars to the Office.com Calendar Sharing Service. If...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Publishing to a Web Distributed and Authoring (DAV) server must be prevented.

    &lt;VulnDiscussion&gt;This policy setting controls whether Outlook users can publish their calendars to a DAV server. If you enable this policy set...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Level of calendar details that a user can publish must be restricted.

    &lt;VulnDiscussion&gt;This policy setting controls the level of calendar details that Outlook users can publish to the Microsoft Outlook Calendar S...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Access restriction settings for published calendars must be configured.

    &lt;VulnDiscussion&gt;This policy setting determines what restrictions apply to users who publish their calendars on Office.com or third-party Worl...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Outlook Object Model scripts must be disallowed to run for shared folders.

    &lt;VulnDiscussion&gt;This policy setting controls whether Outlook executes scripts associated with custom forms or folder home pages for shared fo...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Outlook Object Model scripts must be disallowed to run for public folders.

    &lt;VulnDiscussion&gt;This policy setting controls whether Outlook executes scripts that are associated with custom forms or folder home pages for ...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • ActiveX One-Off forms must be configured.

    &lt;VulnDiscussion&gt;By default, third-party ActiveX controls are not allowed to run in one-off forms in Outlook. You can change this behavior so ...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Add-In Trust Level must be configured.

    &lt;VulnDiscussion&gt;All installed trusted COM addins can be trusted. Exchange Settings for the addins still override if present and this option ...
    Rule Medium Severity
    Show

  • SRG-APP-000400

    <GroupDescription></GroupDescription>
    Group
    Show

  • The remember password for internet e-mail accounts must be disabled.

    &lt;VulnDiscussion&gt;Use this option to hide your user's ability to cache passwords locally in the computer's registry. When configured, this poli...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Users customizing attachment security settings must be prevented.

    &lt;VulnDiscussion&gt;This policy setting prevents users from overriding the set of attachments blocked by Outlook. If you enable this policy setti...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Outlook Security Mode must be configured to use Group Policy settings.

    &lt;VulnDiscussion&gt;This policy setting controls which set of security settings are enforced in Outlook. If you enable this policy setting, you c...
    Rule Medium Severity
    Show

  • SRG-APP-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ability to display level 1 attachments must be disallowed.

    &lt;VulnDiscussion&gt;This policy setting controls whether Outlook blocks potentially dangerous attachments designated Level 1. Outlook uses two le...
    Rule Medium Severity
    Show

  • SRG-APP-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • Level 1 file extensions must be blocked and not removed.

    &lt;VulnDiscussion&gt;This policy setting controls which types of attachments (determined by file extension) Outlook prevents from being delivered....
    Rule Medium Severity
    Show

  • SRG-APP-000207

    <GroupDescription></GroupDescription>
    Group
    Show

  • Level 2 file extensions must be blocked and not removed.

    &lt;VulnDiscussion&gt;This policy setting controls which types of attachments (determined by file extension) must be saved to disk before users can...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules