Restrict level of calendar details that a user can publish

Restrict level of calendar details that a user can publish - Outlook.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17776	DTOO218 - Outlook	SV-18990r1_rule	ECSC-1	Medium

Description
By default, Outlook 2007 users can share their calendars with selected others by publishing them to the Microsoft Office Outlook Calendar Sharing Service. Users can choose from three levels of detail: • Availability only. Authorized visitors will see the user's time marked as Free, Busy, ntative, or Out of Office, but will not be able to see the subjects or details of calendar items. • Limited details. Authorized visitors can see the user's availability and the subjects of calendar items only. They will not be able to view the details of calendar items. Optionally, users can allow visitors to see the existence of private items. • Full details. Authorized visitors can see the full details of calendar items. Optionally, users can allow visitors to see the existence of private items and to access attachments within calendar items. If users are allowed to publish limited or full details, sensitive information in their calendars could become exposed to parties who are not authorized to have that information.

Description

By default, Outlook 2007 users can share their calendars with selected others by publishing them to the Microsoft Office Outlook Calendar Sharing Service. Users can choose from three levels of detail: • Availability only. Authorized visitors will see the user's time marked as Free, Busy, ntative, or Out of Office, but will not be able to see the subjects or details of calendar items. • Limited details. Authorized visitors can see the user's availability and the subjects of calendar items only. They will not be able to view the details of calendar items. Optionally, users can allow visitors to see the existence of private items. • Full details. Authorized visitors can see the full details of calendar items. Optionally, users can allow visitors to see the existence of private items and to access attachments within calendar items. If users are allowed to publish limited or full details, sensitive information in their calendars could become exposed to parties who are not authorized to have that information.

STIG	Date
Microsoft Outlook 2007	2015-09-17

Details

Check Text ( C-19039r1_chk )
The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Preferences -> Calendar Options -> Microsoft Office Online Sharing Service “Restrict level of calendar details users can publish” will be set to “Enabled (Disables ‘Full details’ and ‘Limited details’)”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\PubCal Criteria: If the value PublishCalendarDetailsPolicy is REG_DWORD = 4000 (hex) or 16384 (Decimal), this is not a finding.

Check Text ( C-19039r1_chk )

The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Preferences -> Calendar Options -> Microsoft Office Online Sharing Service “Restrict level of calendar details users can publish” will be set to “Enabled (Disables ‘Full details’ and ‘Limited details’)”.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Options\PubCal

Criteria: If the value PublishCalendarDetailsPolicy is REG_DWORD = 4000 (hex) or 16384 (Decimal), this is not a finding.

Fix Text (F-17675r1_fix)
The policy value for User Configuration -> Administrative Templates -> Microsoft Office Outlook 2007 -> Tools \ Options -> Preferences -> Calendar Options -> Microsoft Office Online Sharing Service “Restrict level of calendar details users can publish” will be set to “Enabled (Disables ‘Full details’ and ‘Limited details’)”.