STIGQter: STIG Summary: Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 30 Jan 2025:

Exchange messages with a blank sender field must be rejected.

DISA Rule

SV-259609r961161_rule

Vulnerability Number

V-259609

Group Title

SRG-APP-000261

Rule Version

EX19-ED-000123

Severity

CAT II

CCI(s)

• CCI-001308 - Automatically update spam protection mechanisms on an organization-defined frequency.

Weight

10

Fix Recommendation

Open the Exchange Management Shell and enter the following command:

Set-SenderFilterConfig -Action Reject

Check Contents

This requirement is Not Applicable for SIPR enclaves.

This requirement is Not Applicable if the organization subscribes to EEMSG or other similar DOD enterprise protections for email services.

Open the Exchange Management Shell and enter the following command:

Get-SenderFilterConfig | Select-Object -Property Name, Action

If the value of "Action" is not set to "Reject", this is a finding.

Note: "Reject" is the default value.

Vulnerability Number

V-259609

Documentable

False

Rule Version

EX19-ED-000123

Severity Override Guidance

This requirement is Not Applicable for SIPR enclaves.

This requirement is Not Applicable if the organization subscribes to EEMSG or other similar DOD enterprise protections for email services.

Open the Exchange Management Shell and enter the following command:

Get-SenderFilterConfig | Select-Object -Property Name, Action

If the value of "Action" is not set to "Reject", this is a finding.

Note: "Reject" is the default value.

Check Content Reference

M

Target Key

5579