Title

SharePoint must validate the integrity of security attributes exchanged between systems. (Cat II impact)

Discussion

When data is exchanged between information systems, the security attributes associated with said data need to be maintained. Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. Security attributes may be explicitly or implicitly associated with the information contained within the information system.

Check Content

Note: If no data is exchanged between systems, and has been documented by the Data Owner, IRM is not required. This requirement is Not Applicable. Review the SharePoint server configuration to ensure the integrity of security attributes exchanged between systems is validated. An IRM must be enabled in SharePoint. The Windows Rights Management Services (RMS) (or a comparable IRM product) can either be located through Active Directory or specified. In Central Administration, click Security. On the Security page, in the Information policy list, click "Configure information rights management". If "Do not use IRM on this server" is selected, or if a configuration error message is displayed (such as "... IRM will not work until the client is configured properly"), this is a finding.

Fix Text

Configure the SharePoint server to validate the integrity of security attributes exchanged between systems. In Central Administration, click Security. On the Security page, in the Information policy list, click "Configure information rights management". Select "Use the default RMS server specified in Active Directory", or identify a specific server by selecting "Use this RMS server:" and entering the server name. Configure information management policies in accordance with the system security plan requirements.

Additional Identifiers

Rule ID: SV-74403r2_rule

Vulnerability ID: V-59973

Group Title: SRG-APP-000204

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.