STIGQter: STIG Summary: Microsoft Exchange 2013 Mailbox Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

Exchange services must be documented and unnecessary services must be removed or disabled.

DISA Rule

SV-207326r615936_rule

Vulnerability Number

V-207326

Group Title

SRG-APP-000383

Rule Version

EX13-MB-000300

Severity

CAT II

CCI(s)

• CCI-001762 - The organization disables organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure.

Weight

10

Fix Recommendation

Update the EDSP with the services required for the system to function.

Remove or disable any services that are not required.

Check Contents

Review the Email Domain Security Plan (EDSP).

Note: Required services will vary between organizations and will vary depending on the role of the individual system. Organizations will develop their own list of services, which will be documented and justified with the ISSO. The site’s list will be provided for any security review. Services that are common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system.

Open a Windows PowerShell and enter the following command:

Get-Service | Where-Object {$_.status -eq 'running'}

Note: The command returns a list of installed services and the status of that service.

If the services required are not documented in the EDSP or undocumented or unnecessary services are running, this is a finding.

If any undocumented or unnecessary services are running, this is a finding.

Vulnerability Number

V-207326

Documentable

False

Rule Version

EX13-MB-000300

Severity Override Guidance

Review the Email Domain Security Plan (EDSP).

Note: Required services will vary between organizations and will vary depending on the role of the individual system. Organizations will develop their own list of services, which will be documented and justified with the ISSO. The site’s list will be provided for any security review. Services that are common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system.

Open a Windows PowerShell and enter the following command:

Get-Service | Where-Object {$_.status -eq 'running'}

Note: The command returns a list of installed services and the status of that service.

If the services required are not documented in the EDSP or undocumented or unnecessary services are running, this is a finding.

If any undocumented or unnecessary services are running, this is a finding.

Check Content Reference

M

Target Key

2923

Comments