Microsoft Office 365 ProPlus Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Protection from zone elevation must be enabled in all Office programs.
<VulnDiscussion>Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local compute...Rule Medium Severity -
SRG-APP-000488
<GroupDescription></GroupDescription>Group -
ActiveX installation restriction must be enabled in all Office programs.
<VulnDiscussion>Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within...Rule Medium Severity -
SRG-APP-000112
<GroupDescription></GroupDescription>Group -
File Download Restriction must be enabled in all Office programs.
<VulnDiscussion>Disabling this setting allows websites to present file download prompts via code without the user specifically initiating the...Rule Medium Severity -
SRG-APP-000210
<GroupDescription></GroupDescription>Group -
The Save from URL feature must be enabled in all Office programs.
<VulnDiscussion>Typically, when Internet Explorer loads a web page from a Universal Naming Convention (UNC) share that contains a Mark of the...Rule Medium Severity -
SRG-APP-000112
<GroupDescription></GroupDescription>Group -
Scripted Windows Security restrictions must be enabled in all Office programs.
<VulnDiscussion>Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site t...Rule Medium Severity -
SRG-APP-000488
<GroupDescription></GroupDescription>Group -
Flash player activation must be disabled in all Office programs.
<VulnDiscussion>This policy setting controls whether the Adobe Flash control can be activated by Office documents. Note that activation block...Rule Medium Severity -
SRG-APP-000210
<GroupDescription></GroupDescription>Group -
Trusted Locations on the network must be disabled in Excel.
<VulnDiscussion>This policy setting controls whether trusted locations on the network can be used. If you enable this policy setting, users ...Rule Medium Severity -
SRG-APP-000141
<GroupDescription></GroupDescription>Group -
VBA Macros not digitally signed must be blocked in Excel.
<VulnDiscussion>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are pr...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
The SIP security mode in Lync must be enabled.
<VulnDiscussion>When Lync connects to the server, it supports various authentication mechanisms. This policy allows the user to specify wheth...Rule Medium Severity -
SRG-APP-000219
<GroupDescription></GroupDescription>Group -
The HTTP fallback for SIP connection in Lync must be disabled.
<VulnDiscussion>Prevents from HTTP being used for SIP connection in case TLS or TCP fail.</VulnDiscussion><FalsePositives></Fa...Rule Medium Severity -
SRG-APP-000575
<GroupDescription></GroupDescription>Group -
Dynamic Data Exchange (DDE) server launch in Excel must be blocked.
<VulnDiscussion>This policy setting allows you to control whether Dynamic Data Exchange (DDE) server launch is allowed. By default, DDE serv...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Dynamic Data Exchange (DDE) server lookup in Excel must be blocked.
<VulnDiscussion>This policy setting allows you to control whether Dynamic Data Exchange (DDE) server lookup is allowed. By default, DDE serv...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of dBase III / IV format files must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Dif and Sylk format files must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 2 macrosheets and add-in files must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 2 worksheets must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 3 macrosheets and add-in files must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 3 worksheets must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 4 macrosheets and add-in files must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 4 workbooks must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 4 worksheets must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 95 workbooks must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Excel 95-97 workbooks and templates must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
The default file block behavior must be set to not open blocked files in Excel.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group -
Open/save of Web pages and Excel 2003 XML spreadsheets must be blocked.
<VulnDiscussion>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified...Rule Medium Severity -
SRG-APP-000207
<GroupDescription></GroupDescription>Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.