Mailbox access control mechanisms are not audited for changes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-19186	EMG2-863 Exch2K3	SV-21025r1_rule	ECAT-1	Medium

Description
Unauthorized or malicious data changes can compromise the integrity and usefulness of the data, Automated attacks or malicious users with elevated privileges have the ability to affect change using the same mechanisms as E-mail administrators. Auditing changes to access mechanisms supports accountability and non-repudiation for those authorized to define the environment but also enables investigation of changes made by others who may not be authorized.

Description

Unauthorized or malicious data changes can compromise the integrity and usefulness of the data, Automated attacks or malicious users with elevated privileges have the ability to affect change using the same mechanisms as E-mail administrators. Auditing changes to access mechanisms supports accountability and non-repudiation for those authorized to define the environment but also enables investigation of changes made by others who may not be authorized.

STIG	Date
Microsoft Exchange Server 2003	2014-08-19

Details

Check Text ( C-23052r1_chk )
Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server] >> [storage group] >> Mailbox Store >> Properties >> Security tab >> Advanced button >> Audit tab All listed items must be selected for “change permissions”, “take ownership”, “add/remove self”, and “write properties”. Criteria: If all items are selected for “change permissions”, “take ownership”, “add/remove self”, and “write properties”, this is not a finding.

Check Text ( C-23052r1_chk )

Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server] >> [storage group] >> Mailbox Store >> Properties >> Security tab >> Advanced button >> Audit tab

All listed items must be selected for “change permissions”, “take ownership”, “add/remove self”, and “write properties”.

Criteria: If all items are selected for “change permissions”, “take ownership”, “add/remove self”, and “write properties”, this is not a finding.

Fix Text (F-19803r1_fix)
Ensure that access control mechanisms are audited. Procedure: Exchange System Manager >> Administrative Groups >> [administrative group] >> Servers >> [server] >> [storage group] >> Mailbox Store >> Properties >> Security tab >> Advanced button >> Audit tab Select “change permissions”, “take ownership”, “add/remove self”, and “write properties”.