STIGQter: STIG Summary: Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 30 Jan 2025:

Exchange must render hyperlinks from email sources from non-.mil domains as unclickable.

DISA Rule

SV-221253r961161_rule

Vulnerability Number

V-221253

Group Title

SRG-APP-000261

Rule Version

EX16-ED-000570

Severity

CAT I

CCI(s)

• CCI-001308 - Automatically update spam protection mechanisms on an organization-defined frequency.

Weight

10

Fix Recommendation

Update the EDSP to reflect the name of the Transport Agent.

Contact the DISA Enterprise Email Service Desk at disa.tinker.eis.mbx.dod-enterprise-services-service-desk@mail.mil and request the Agent and installation procedures.

or

Contact DEE Engineering PMO and request the Agent and installation procedures.

Check Contents

Note: If using a DoD-approved protection mechanism such as Cloud Based Internet Isolation (CBII), Bromium, Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), or other approved email sanitization solution that protects against untrusted URLs embedded in email, this is not applicable.

Note: If system is on SIPRNet, this is not applicable.

Review the Email Domain Security Plan (EDSP).

Determine the name of the Transport Agent.

Open the Windows PowerShell console and enter the following command:

Get-TransportAgent -Name 'customAgent' | FL

If the value does not return "customAgent", this is a finding.

Note: "customAgent" is the name of the custom agent developed to render hyperlink email sources from non .mil domains as unclickable.

Vulnerability Number

V-221253

Documentable

False

Rule Version

EX16-ED-000570

Severity Override Guidance

Note: If using a DoD-approved protection mechanism such as Cloud Based Internet Isolation (CBII), Bromium, Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), or other approved email sanitization solution that protects against untrusted URLs embedded in email, this is not applicable.

Note: If system is on SIPRNet, this is not applicable.

Review the Email Domain Security Plan (EDSP).

Determine the name of the Transport Agent.

Open the Windows PowerShell console and enter the following command:

Get-TransportAgent -Name 'customAgent' | FL

If the value does not return "customAgent", this is a finding.

Note: "customAgent" is the name of the custom agent developed to render hyperlink email sources from non .mil domains as unclickable.

Check Content Reference

M

Target Key

4079