Microsoft Exchange 2013 Client Access Server STIG Version Comparison

There are 3 differences between versions v1 r2 (Jan. 25, 2019) (the "left" version) and v2 r1 (Dec. 15, 2021) (the "right" version).

Check EX13-CA-000010 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

Exchange must use Encryption for OWA access.

Check Content

Open a Windows PowerShell and enter the following command: Import-module webadministration At webadministration Enter cd “IIS:” At the IIS: prompt, enter cd Sites At the Sites: prompt, enter cd “Default Web Site” At the “Default Web Site”: prompt, enter cd owa At the IIS:\Sites\Default Web Site\owa>: prompt, enter Get-WebConfigurationProperty -filter /system.webServer/security/access -name sslflags If the value returned is not Ssl,Ssl128, this is a finding.

Discussion

This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including CAC enabled pre-authentication through an application firewall proxy. Failure to require secure connections on a web site increases the potential for unintended eavesdropping or data loss.

Fix

Configure the OWA site to require SSL port 443.