| V-28066 | High | Applications must support organizational requirements to employ cryptographic mechanisms to protect information in storage. | When data is written to digital media there is risk of data loss and data compromise. An organizational assessment of risk guides the selection of media and associated information contained on... |
| V-30290 | Medium | SharePoint must protect audit information from unauthorized deletion of trace log files. | If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.
To ensure the... |
| V-28170 | Medium | When configuring Central Administration, the port number selected must comply with DoD Ports and Protocol Management (PPSM) program requirements.
| During the installation of Microsoft SharePoint, the Central Administration Web site is established on a randomly-assigned TCP port by default. Allowing a randomly-assigned default may result in... |
| V-29301 | Medium | SharePoint sites must not use NTLM. | An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to... |
| V-28114 | Medium | SharePoint must allow designated organizational personnel to select which auditable events are to be audited by specific components of the system. | Without auditing enabled, individual system accesses cannot be tracked and malicious activity cannot be detected and traced back to an individual account. |
| V-29363 | Medium | The “Automatically delete the site collection if use is not confirmed” property must not be enabled for web applications. | Automatic deletion is an administrative feature that can delete unused sites without administrative intervention and without a backup mechanism. Automatic deletion permanently removes all content... |
| V-29306 | Medium | SharePoint farm service account (Database Access account) must be configured with minimum privileges in Active Directory (AD). | Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to... |
| V-28177 | Medium | Backup of SharePoint system level files for critical systems must be performed when identified as required by the owning organization. | Information system backup is a critical step in maintaining data assurance and availability. System-level information includes: system-state information, operating system and application software,... |
| V-28119 | Medium | The Central Administration Web Application must use Kerberos as the authentication provider. | An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.
Techniques used to... |
| V-28217 | Medium | For environments requiring an Internet-facing capability, the SharePoint application server upon which Central Administration is installed, must not be installed in the DMZ. | Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and... |
| V-28138 | Medium | SharePoint managed service accounts must be set to enable automatic password change. | Passwords need to be changed at specific policy based intervals. Any password no matter how complex can eventually be compromised.
One method of minimizing this risk is to use complex passwords... |
| V-28071 | Medium | SharePoint must terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. | This requirement applies to both internal and external networks. Terminating network connections associated with communications sessions include, de-allocating associated TCP/IP address/port pairs... |
| V-28252 | Medium | SharePoint clients must be configured to display an approved system use notification message or banner before granting access to the system. | Applications are required to display an approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with... |
| V-27974 | Medium | SharePoint must allow authorized users to associate security attributes with information. | Security attributes are metadata representing the basic properties of an entity with respect to safeguarding information. These attributes are typically associated with internal data structures... |
| V-28256 | Medium | SharePoint must be configured to display the banner, when appropriate, before granting further access. | Applications are required to display the following information:
(i) displays the system use information when appropriate, before granting further access;
(ii) displays references, if any, to... |
| V-28097 | Medium | SharePoint must protect audit tools from unauthorized access. | Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Depending upon the log format and application, system and application log tools may... |
| V-28254 | Medium | SharePoint must retain the notification message or banner on the screen until users take explicit actions to log on to or further access. | To establish acceptance of system usage policy, a click-through banner at application logon is required. The banner shall prevent further activity on the application unless and until the user... |
| V-30282 | Medium | SharePoint must protect audit information from unauthorized access to the trace data log files. | If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult. To ensure the veracity of audit... |
| V-30287 | Medium | SharePoint must protect audit information from unauthorized modification to trace data logs. | If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.
To ensure the... |
| V-29339 | Medium | SharePoint-specific malware, (i.e., anti-virus), software must be integrated and configured. | Configuring anti-virus settings ensures documents will be scanned for viruses upon download from and upload to the SharePoint server. Anti-virus settings are not configured by default, therefore... |
| V-29338 | Medium | The Online Web Part Gallery must be configured for limited access. | Web Part galleries are groupings of Web Parts. There are four Web Part galleries: Closed Web Parts, Site Name Gallery, Server Gallery, and Online Gallery. The Online Gallery is a collection of... |
| V-28145 | Medium | SharePoint must support the enforcement of logical access restrictions associated with changes to application configuration. | When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system and/or... |
| V-28144 | Medium | SharePoint must support the requirement that privileged access is further defined between audit-related privileges and other privileges. | Protection of audit records and audit data is of critical importance. Care must be taken to ensure privileged users cannot circumvent audit protections put in place. Auditing might not be reliable... |
| V-28169 | Medium | To support the requirements and principles of least functionality; SharePoint must support the organizational requirement to provide only essential capabilities. | Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential... |
| V-28281 | Medium | Central Administrator site must not be accessible from Extranet or Internet connections. | SharePoint must prevent the presentation of information system management-related functionality at an interface utilized by general, (i.e., non-privileged), users.
The Central Administrator is... |
| V-28026 | Medium | SharePoint must identify potentially security-relevant error conditions. | The error messages and usage data to be monitored should be carefully considered. The extent to which the application is able to identify and handle error conditions is guided by organizational... |
| V-30365 | Medium | The SharePoint Setup User domain account must be configured with the minimum privileges in SQL server.
| Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to... |
| V-30366 | Medium | The SharePoint Setup User domain account must be configured with the minimum privileges for the local server. | Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to... |
| V-27965 | Medium | SharePoint must support the requirement to initiate a session lock after an organization defined time period of system or application inactivity has transpired. | A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the... |
| V-28207 | Medium | SharePoint must implement security functions as largely independent modules to avoid unnecessary interactions between modules. | Microsoft recommends separate Application Pools (and security accounts) for site collections with authenticated and anonymous content; to isolate applications storing security or management... |
| V-29367 | Medium | Access to Central Administration site must be limited to authorized users and groups. | SharePoint must prevent the presentation of information system management-related functionality at an interface utilized by general, (i.e., non-privileged), users administrative interfaces to... |
| V-29372 | Medium | The privilege to edit group membership must be restricted to authorized individuals. | Adding and removing group members may have security implications for the sites the group has access. Inadvertent addition or deletion of members to/from groups may endanger the security of the... |
| V-30368 | Medium | SharePoint farm service account (Database Access account) must be configured with minimum privileges on the SQL server.
| Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to... |
| V-29374 | Medium | "Who can view the membership of the group?" must be set to [Group Members] when creating new site groups. | The alternative to this recommendation is to allow everyone to view the members of the group. In some situations, however, knowing the membership of a group can reveal other sensitive information.... |
| V-28241 | Medium | SharePoint must enforce organizational requirements to implement separation of duties through assigned information access authorizations. | Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to... |
| V-28089 | Medium | SharePoint must protect audit information from unauthorized modification of usage and health data collection logs. | If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.
To ensure the... |
| V-29399 | Medium | The SharePoint Setup User domain account must be configured with the minimum privileges in Active Directory. | Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to... |
| V-29398 | Medium | SharePoint Service accounts must be configured for separation of duties. | Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to... |
| V-28249 | Medium | Timer job retries for automatic password change on Managed Accounts must meet DoD password retry policy. | When an authentication method is exposed to allow for the utilization of an application, there is a risk that attempts will be made to obtain unauthorized access. To defeat these attempts,... |
| V-28094 | Medium | SharePoint must protect audit information from unauthorized deletion of usage and health logs. | If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.
To ensure the... |
| V-28087 | Medium | SharePoint must protect audit information from unauthorized access to the usage and health logs. | If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult. To ensure the veracity of audit... |
| V-29373 | Low | A secondary site collection administrator must be defined when creating a new site collection. | If a site reaches its maximum size, users will be denied access until an administrator fixes the problem. Having a secondary administrator reduces the risk of having a Denial-of-Service on a site.... |
| V-28184 | Low | To support audit review, analysis, and reporting, SharePoint must integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities. | Successful incident response and auditing relies on timely, accurate system information and analysis in order to allow the organization to identify and respond to potential incidents in a... |
