SharePoint must validate the integrity of security attributes exchanged between systems.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-59973	SP13-00-000105	SV-74403r1_rule		High

Description
When data is exchanged between information systems, the security attributes associated with said data need to be maintained. Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. Security attributes may be explicitly or implicitly associated with the information contained within the information system.

Description

When data is exchanged between information systems, the security attributes associated with said data need to be maintained. Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. Security attributes may be explicitly or implicitly associated with the information contained within the information system.

STIG	Date
MS SharePoint 2013 Security Technical Implementation Guide	2018-04-02

Details

Check Text ( C-60663r1_chk )
Review the SharePoint server configuration to ensure the integrity of security attributes exchanged between systems is validated. An IRM must be enabled in SharePoint. The Windows Rights Management Services (RMS) (or a comparable IRM product) can either be located through Active Directory or specified. In Central Administration, click on Security. On the Security page, in the Information policy list, click "Configure information rights management". If "Do not use IRM on this server" is selected, or if a configuration error message is displayed (such as "... IRM will not work until the client is configured properly"), this is a finding.

Check Text ( C-60663r1_chk )

Review the SharePoint server configuration to ensure the integrity of security attributes exchanged between systems is validated.

An IRM must be enabled in SharePoint. The Windows Rights Management Services (RMS) (or a comparable IRM product) can either be located through Active Directory or specified.

In Central Administration, click on Security.

On the Security page, in the Information policy list, click "Configure information rights management".

If "Do not use IRM on this server" is selected, or if a configuration error message is displayed (such as "... IRM will not work until the client is configured properly"), this is a finding.

Fix Text (F-65383r1_fix)
Configure the SharePoint server to validate the integrity of security attributes exchanged between systems. In Central Administration, click on Security. On the Security page, in the Information policy list, click "Configure information rights management". Select "Use the default RMS server specified in Active Directory", or identify a specific server by selecting "Use this RMS server:" and entering the server name. Configure information management policies in accordance with the system security plan requirements.

Fix Text (F-65383r1_fix)

Configure the SharePoint server to validate the integrity of security attributes exchanged between systems.

In Central Administration, click on Security.

On the Security page, in the Information policy list, click "Configure information rights management".

Select "Use the default RMS server specified in Active Directory", or identify a specific server by selecting "Use this RMS server:" and entering the server name.

Configure information management policies in accordance with the system security plan requirements.