The default message format must be set to use Plain Text.
An XCCDF Rule
Description
Outlook uses HTML as the default email format. HTML format poses a security risk by embedding information into the email itself, which could allow for release of sensitive information. If a user attempted to insert an HTML link into an email message, the link itself may direct to a malicious website. By sending emails in HTML format, the recipient could be subject to becoming infected by the malicious website.
- ID
- SV-251866r811197_rule
- Version
- DTOO314
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> Mail Format >> Internet Formatting >> Message Format "Set message format" to "Enabled: Plain Text".