STIGQter: STIG Summary: Microsoft Outlook 2010 STIG Version: 1 Release: 13 Benchmark Date: 27 Apr 2018:

Outlook minimum encryption key length settings must be set.

DISA Rule

SV-34107r1_rule

Vulnerability Number

V-26636

Group Title

DTOO316 - Minimum encryption settings

Rule Version

DTOO316 - Outlook

Severity

CAT II

CCI(s)

• CCI-002450 - The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Weight

10

Fix Recommendation

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Security -> Cyrptography “Minimum encryption settings” to “Enabled: 168 bits".

Check Contents

The policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Security -> Cyrptography “Minimum encryption settings” must be set to “Enabled: 168 bits".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\14.0\outlook\security

Criteria: If the value MinEncKey is REG_DWORD = 168, this is not a finding.

Vulnerability Number

V-26636

Documentable

False

Rule Version

DTOO316 - Outlook

Severity Override Guidance

The policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Security -> Cyrptography “Minimum encryption settings” must be set to “Enabled: 168 bits".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\14.0\outlook\security

Criteria: If the value MinEncKey is REG_DWORD = 168, this is not a finding.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

2024

Comments