Default message format must be set to use Plain Text.
An XCCDF Rule
Description
Outlook uses HTML as the default email format. HTML format poses a security risk by embedding information into the email itself, which could allow for release of sensitive information. If a user attempted to insert an HTML link into an email message, the link itself may direct to a malicious website. By sending in that format, the recipient would be subject to becoming infected by the malicious website.
Property | Value |
---|---|
Responsibility | System Administrator |
- ID
- SV-54062r1_rule
- Version
- DTOO314
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Outlook Options -> Mail Format -> Internet Formatting -> Message Format "Set message format" to "Enabled: Plain Text".