Check: O365-OU-000013
Microsoft Office 365 ProPlus STIG:
O365-OU-000013
(in versions v3 r1 through v1 r2)
Title
Outlook must be configured to allow retrieving of Certificate Revocation Lists (CRLs) always when online. (Cat II impact)
Discussion
This policy setting controls how Outlook retrieves Certificate Revocation Lists to verify the validity of certificates. Certificate revocation lists (CRLs) are lists of digital certificates that have been revoked by their controlling certificate authorities (CAs), typically because the certificates were issued improperly or their associated private keys were compromised. If you enable this policy setting, you can choose from three options to govern how Outlook uses CRLs: - Use system Default. Outlook relies on the CRL download schedule that is configured for the operating system. - When online always retrieve the CRL. This option is the default configuration in Outlook. - Never retrieve the CRL. Outlook will not attempt to download the CRL for a certificate, even if it is online. This option can reduce security. If you disable or do not configure this policy setting, when Outlook handles a certificate that includes a URL from which a CRL can be downloaded, Outlook will retrieve the CRL from the provided URL if Outlook is online.
Check Content
Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Status dialog box >> Retrieving CRLs (Certificate Revocation Lists) is set to "Enabled" "When online always retrieve the CRL". Use the Windows Registry to navigate to the following key: HKCU\software\policies\microsoft\office\16.0\outlook\security If the value for usecrlchasing is set to REG_DWORD = 1, this is not a finding.
Fix Text
Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Cryptography >> Signature Status dialog box >> Retrieving CRLs (Certificate Revocation Lists) to "Enabled" "When online always retrieve the CRL".
Additional Identifiers
Rule ID: SV-223358r961893_rule
Vulnerability ID: V-223358
Group Title: SRG-APP-000605
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000185 |
For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information. |
Controls
Number | Title |
---|---|
IA-5(2) |
Pki-based Authentication |