Exchange software must be monitored for unauthorized changes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-69915	EX13-EG-000300	SV-84537r1_rule		Medium

Description
Monitoring software files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.

STIG	Date
MS Exchange 2013 Edge Transport Server Security Technical Implementation Guide	2017-01-04

Details

Check Text ( C-70383r1_chk )
Review the Email Domain Security Plan (EDSP). Determine whether the site monitors system files (e.g., .exe, .bat, .com, .cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. If software files are not monitored for unauthorized changes on a weekly basis, this is a finding. Note: A properly configured HBSS Policy Auditor File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Check Text ( C-70383r1_chk )

Review the Email Domain Security Plan (EDSP).

Determine whether the site monitors system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis.

If software files are not monitored for unauthorized changes on a weekly basis, this is a finding.

Note: A properly configured HBSS Policy Auditor File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Fix Text (F-76145r1_fix)
Update the EDSP. Monitor the software files (e.g., .exe, .bat, .com, .cmd, and *.dll) on Exchange servers for unauthorized changes against a baseline on a weekly basis. Note: This can be done with the use of various monitoring tools.