Block list service provider must be identified.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
Exch-ED-237	Exch-ED-237	Exch-ED-237_rule		Medium

Description
Block List filtering is a sanitization process performed on email messages prior to their arrival at the destination mailbox. By performing this process at the email perimeter, threats can be eliminated outside the enclave, where there is less risk they can do harm. Block List Services (sometimes called Reputation Data Services) are fee based data providers that collect the IP addresses of known Spammers and other malware purveyors. Block List Service Subscribers benefit from more effective SPAM elimination, which has been estimated as comprising up to 90% of inbound mail volume. Failure to specify a Block List provider risks that manual email Administration effort would be needed to maintain and update larger block lists than a single email site administrator could conveniently or accurately maintain. The 'Block List' Services vendor provides a value for this field usually the DNS suffix for their domain.

Description

Block List filtering is a sanitization process performed on email messages prior to their arrival at the destination mailbox. By performing this process at the email perimeter, threats can be eliminated outside the enclave, where there is less risk they can do harm. Block List Services (sometimes called Reputation Data Services) are fee based data providers that collect the IP addresses of known Spammers and other malware purveyors. Block List Service Subscribers benefit from more effective SPAM elimination, which has been estimated as comprising up to 90% of inbound mail volume. Failure to specify a Block List provider risks that manual email Administration effort would be needed to maintain and update larger block lists than a single email site administrator could conveniently or accurately maintain. The 'Block List' Services vendor provides a value for this field usually the DNS suffix for their domain.

STIG	Date
Microsoft Exchange 2010 Edge Transport Server Role	2012-05-31

Details

Check Text ( C-_chk )
Obtain the Email Domain Security Plan (EDSP) and locate the "Block List Service Providers" names. Open the Exchange Management Shell and enter the following command. Get-IPBlockListProvider \| Select Name, Identity If the value of "IPBlockListProviderConfig" does not return a list of Providers or are not listed in the ESDP, this is a finding.

Fix Text (F-_fix)
Obtain the names of the block list service providers from the EDSP document and update the system as indicated below. Open the Exchange Management Shell and enter the following command. Add-IPBlockListProvider -Name <'ListProvider'> -LookupDomain <'Domain.com'> -BitMaskMatch <'127.0.0.1'>