Check: Exch-1-203
Exchange 2010 Client Access Server STIG:
Exch-1-203
(in version v1 r9)
Title
Encryption must be used for OWA access. (Cat II impact)
Discussion
This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including CAC enabled pre-authentication through an application firewall proxy. Failure to require secure connections on a web site increases the potential for unintended eavesdropping or data loss.
Check Content
Open the Windows PowerShell Modules and enter the following command: Import-module webadministration IIS: cd Sites cd “Default Web Site” cd owa PS IIS:\Sites\Default Web Site\owa> Get-WebConfigurationProperty -filter /system.webServer/security/access -name sslflags Review the result and verify only TLSv1.0 or higher is returned. If not, this is a finding.
Fix Text
Configure the OWA site to require SSL port 443.
Additional Identifiers
Rule ID: SV-44005r3_rule
Vulnerability ID: V-33585
Group Title: Exch-1-203
Expert Comments
CCIs
Number | Definition |
---|---|
No CCIs are assigned to this check |
Controls
Number | Title |
---|---|
No controls are assigned to this check |