STIGQter STIGQter: STIG Summary:

Microsoft Outlook 2010 STIG

Version: 1

Release: 13 Benchmark Date: 27 Apr 2018

SV-75853r1_ruleDisable user name and password syntax from being used in URLs
SV-33390r1_ruleEnabling IE Bind to Object functionality must be present.
SV-33419r1_ruleSaved from URL mark to assure Internet zone processing must be enforced.
SV-33412r1_ruleNavigation to URL's embedded in Office products must be blocked.
SV-33398r1_ruleLinks that invoke instances of IE from within an Office product must be blocked.
SV-33558r2_rulePermit download of content from safe zones must be configured.
SV-33513r1_ruleAccess restriction settings for published calendars must be configured.
SV-33520r1_ruleRecipients of sent email must be unable to be added to the safe sender's list.
SV-33523r1_ruleActive X One-Off forms must be configured.
SV-33586r1_ruleScripts in One-Off Outlook forms must be disallowed.
SV-33540r1_ruleIE Trusted Zones assumed 'trusted' must be blocked.
SV-33932r1_ruleThe Add-In Trust Level must be configured.
SV-33588r1_ruleObject Model Prompt behavior for programmatic address books must be configured.
SV-33578r1_ruleAction to demote an EMail Level 1 attachment to Level 2 must be configured.
SV-33589r1_ruleObject Model Prompt behavior for accessing User Property Formula must be configured.
SV-33592r1_ruleObject Model Prompt behavior for the SaveAs method must be configured.
SV-33593r1_ruleObject Model Prompt behavior for programmatic access of user address data must be configured.
SV-33594r1_ruleObject Model Prompt behavior for Meeting and Task Responses must be configured.
SV-33595r1_ruleObject Model Prompt for programmatic email send behavior must be configured.
SV-33596r1_ruleTrusted add-ins behavior for eMail must be configured.
SV-33506r1_ruleDial-up and Hang up Options for Outlook must be configured.
SV-33507r1_ruleOutlook Dial-up options to Warn user before allowing switch in dial-up access must be configured.
SV-33524r1_ruleThe "remember password" for internet e-mail accounts must be disabled.
SV-33581r1_ruleLevel 1 attachment close behaviors must be configured.
SV-33582r1_rulePrompting behavior for Level 1 attachments on sending must be configured.
SV-33500r1_ruleDisabling download full text of articles as HTML must be configured.
SV-33597r1_ruleHyperlinks in suspected phishing e-mail messages must be disallowed.
SV-33493r1_ruleRPC encryption between Outlook and Exchange server must be enforced.
SV-33521r1_ruleJunk Mail UI must be configured.
SV-33561r2_ruleInternet with Safe Zones for Picture Download must be disabled.
SV-33562r2_ruleIntranet with Safe Zones for automatic picture downloads must be configured.
SV-33580r1_ruleThe ability to display level 1 attachments must be disallowed.
SV-33548r2_ruleExternal content and pictures in HTML eMail must be displayed.
SV-33504r1_ruleDigital signatures must be allowed.
SV-33509r1_ruleFolders in non-default stores, set as folder home pages, must be disallowed.
SV-33510r1_ruleOutlook Object Model scripts must be disallowed to run for public folders.
SV-33511r1_ruleOutlook Object Model scripts must be disallowed to run for shared folders.
SV-33499r1_ruleDo not include Internet Calendar Integration in Outlook must be enforced.
SV-33572r1_ruleAttachments using generated name for secure temporary folders must be configured.
SV-33486r1_ruleAuthentication with Exchange Server must be required.
SV-33487r2_ruleAutomatically configure user profile based on Active Directory primary SMTP address must be enforced.
SV-33496r1_ruleAutomatic download of Internet Calendar appointment attachments must be disallowed.
SV-33529r1_ruleAutomatic download content for email in Safe Senders list must be disallowed.
SV-33508r1_ruleOutlook must be enforced as the default email, calendar, and contacts program.
SV-33563r1_ruleMessage formats must be set to use SMime.
SV-33574r2_ruleMissing Root Certificates warning must be enforced.
SV-33577r1_ruleOutlook Security Mode must be configured to use Group Policy settings.
SV-33505r2_rulePlain Text Options for outbound email must be configured.
SV-33514r1_rulePublishing to a Web Distributed and Authoring (DAV) server must be prevented.
SV-33515r1_rulePublishing calendars to Office Online must be prevented.
SV-33525r1_ruleUsers customizing attachment security settings must be prevented.
SV-33518r1_ruleRead EMail as plain text must be enforced.
SV-33519r1_ruleRead signed email as plain text must be enforced.
SV-33583r1_ruleLevel 1 file extensions must be blocked and not removed.
SV-33585r1_ruleLevel 2 file extensions must be blocked and not removed.
SV-33516r1_ruleLevel of calendar details that a user can publish must be restricted.
SV-33517r1_ruleUpload method for publishing calendars to Office Online must be restricted.
SV-33880r1_ruleRetrieving of CRL data must be set for online action.
SV-33565r1_ruleRun in FIPS compliant mode must be enforced.
SV-33566r1_ruleS/Mime interoperability with external clients for message handling must be configured.
SV-33568r1_ruleAutomatic sending s/Mime receipt requests must be disallowed.
SV-33598r1_ruleAlways warn on untrusted macros must be enforced.
SV-33570r1_ruleAll signed messages as clear signed messages must be configured.
SV-33587r1_ruleCustom Outlook Object Model (OOM) action execution prompts must be configured.
SV-33571r1_ruleWarning about invalid signatures must be enforced.
SV-33501r1_ruleRSS feed synchronization with Common Feed List must be disallowed.
SV-33522r1_ruleTrust EMail from senders in receiver's contact list must be enforced.
SV-33502r1_ruleRSS Feeds must be disallowed.
SV-33512r1_ruleDragging Unicode eMail messages to file system must be disallowed.
SV-33503r1_ruleUser Entries to Server List must be disallowed.
SV-33782r1_ruleAdd-on Management functionality must be allowed.
SV-33790r1_ruleProtection from zone elevation must be enforced.
SV-33793r1_ruleActiveX Installs must be configured for proper restriction.
SV-33800r1_ruleFile Downloads must be configured for proper restrictions.
SV-33806r1_ruleScripted Window Security must be enforced.
SV-33857r1_ruleData Execution Prevention must be enforced.
SV-34101r1_ruleAutomatically downloading enclosures on RSS must be disallowed.
SV-34103r1_ruleOutlook Rich Text options must be set for converting to plain text format.
SV-34105r1_ruleDefault message format must be set to use Plain Text.
SV-34106r1_ruleOutlook must be configured not to prompt users to choose security settings if default settings fail.
SV-34107r1_ruleOutlook minimum encryption key length settings must be set.
SV-34109r1_ruleReplies or forwards to signed/encrypted messages must be signed/encrypted.
SV-34110r1_ruleCheck e-mail addresses against addresses of certificates being used must be disallowed.
SV-55984r2_ruleText in Outlook that represents Internet and network paths must not be automatically turned into hyperlinks.