Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Internet facing receive connectors must offer TLS before using basic authentication.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-33569 | Exch-2-724 | SV-43989r1_rule | ECSC-1 | Medium |
| Description |
|---|
| Sending unencrypted email over the Internet increases the risk that messages can be intercepted or altered. Transport Layer Security (TLS) is designed to protect confidentiality and data integrity by encrypting email messages between servers and thereby reducing the risk of eavesdropping, interception, and alteration. This setting forces Exchange to offer TLS before using basic authentication. |
| STIG | Date |
|---|---|
| MS Exchange 2010 Edge Transport Server STIG | 2019-01-02 |
Details
| Check Text ( C-41675r1_chk ) |
|---|
| Open the Exchange Management Shell and enter the following command: Get-ReceiveConnector -Identity <'ServerUnderReview\ReceiveConnector'> | Select AuthMechanism If the value of 'AuthMechanism' is not set to 'Tls, BasicAuth, BasicAuthRequireTLS', this is a finding. |
| Fix Text (F-37460r1_fix) |
|---|
| Open the Exchange Management Shell and enter the following command: Set-ReceiveConnector -Identity <'ReceiveConnector'> -AuthMechanism 'Tls, BasicAuth, BasicAuthRequireTLS' |