STIGQter: STIG Summary: Microsoft Outlook 2013 STIG Version: 1 Release: 13 Benchmark Date: 26 Oct 2018:

Outlook minimum encryption key length settings must be set.

DISA Rule

SV-54064r1_rule

Vulnerability Number

V-26636

Group Title

DTOO316 - Minimum encryption settings

Rule Version

DTOO316

Severity

CAT II

CCI(s)

• CCI-002450 - The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Weight

10

Fix Recommendation

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Security -> Cryptography "Minimum encryption settings" to "Enabled: 168 bits".

Check Contents

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Security -> Cryptography "Minimum encryption settings" is set to "Enabled: 168 bits".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\15.0\outlook\security

Criteria: If the value MinEncKey is REG_DWORD = 168, this is not a finding.

Vulnerability Number

V-26636

Documentable

False

Rule Version

DTOO316

Severity Override Guidance

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Security -> Cryptography "Minimum encryption settings" is set to "Enabled: 168 bits".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\15.0\outlook\security

Criteria: If the value MinEncKey is REG_DWORD = 168, this is not a finding.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

2482

Comments