Microsoft Exchange 2016 Mailbox Server STIG Version Comparison

There are 1 differences between versions v2 r4 (July 23, 2021) (the "left" version) and v2 r6 (Jan. 24, 2024) (the "right" version).

Check EX16-MB-000590 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

Exchange software must be monitored for unauthorized changes.

Check Content

Review the Email Domain Security Plan (EDSP). Determine whether the site monitors system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. If software files are not monitored for unauthorized changes, this is a finding. finding. Note: A properly configured HBSS Policy Auditor File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Discussion

Monitoring software files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.

Fix

Update the EDSP to specify that the organization monitors system files on servers for unauthorized changes against a baseline on a weekly basis or verify that this information is documented by the organization. Monitor the software files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on Exchange servers for unauthorized changes against a baseline on a weekly basis. Note: This can be done with the use of various monitoring tools.