The Symantec Endpoint Protection client Internet Email Auto-Protect actions must be explicitly configured at the top, Security Risks, level and not be overridden by the Hack Tool sub-level.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-42838	DTASEP104	SV-55566r1_rule		Medium

Description
Email has become one of the most frequently used methods of spreading malware, through embedded HTML code and attachments. User awareness and training, warning users to not open suspicious emails or email attachments and to not click hyperlinks, etc. from unknown or known senders, will not fully protect from email-borne malware. Mass mailing worms are similar to email-borne viruses but are self-contained rather than being designed to infect an existing file. Protecting from email-borne viruses and mass mailing worms by scanning email upon delivery mitigates the risk of infection via email.

Description

Email has become one of the most frequently used methods of spreading malware, through embedded HTML code and attachments. User awareness and training, warning users to not open suspicious emails or email attachments and to not click hyperlinks, etc. from unknown or known senders, will not fully protect from email-borne malware. Mass mailing worms are similar to email-borne viruses but are self-contained rather than being designed to infect an existing file. Protecting from email-borne viruses and mass mailing worms by scanning email upon delivery mitigates the risk of infection via email.

STIG	Date
Symantec Endpoint Protection 12.1 Local Client Antivirus STIG	2014-07-03

Details

Check Text ( C-49110r1_chk )
GUI check: Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Virus and Spyware Protection -> Select Configure Settings -> Under the Internet Email Auto-Protect tab -> Select the Actions tab -> Under Security Risks -> Select Hack Tool -> Ensure "Override actions configured for Security Risks" is NOT selected. Criteria: If "Override actions configured for Security Risks" is selected, this is a finding. On the machine use the Windows Registry Editor to navigate to the following key: 32 bit: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Storages\InternetMail\RealTimeScan\Expanded Criteria: If the value of FirstAction is not 3, this is a finding. If the value of FirstAction is 3, then check A. A must be compliant for the check to be not a finding. A - If the value of OverrideDefaultActions within HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Storages\InternetMail\RealTimeScan\Expanded\TCID-5 is 0 or the value is not there, this is not a finding. 64 bit: HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Storages\InternetMail\RealTimeScan\Expanded Criteria: If the value of FirstAction is not 3, this is a finding. If the value of FirstAction is 3, then check A. A must be compliant for the check to be not a finding. A - If the value of OverrideDefaultActions within HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Storages\InternetMail\RealTimeScan\Expanded\TCID-5 is 0 or the value is not there, this is not a finding.

Check Text ( C-49110r1_chk )

GUI check: Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Virus and Spyware Protection -> Select Configure Settings -> Under the Internet Email Auto-Protect tab -> Select the Actions tab -> Under Security Risks -> Select Hack Tool -> Ensure "Override actions configured for Security Risks" is NOT selected.

Criteria: If "Override actions configured for Security Risks" is selected, this is a finding.

On the machine use the Windows Registry Editor to navigate to the following key:
32 bit:
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Storages\InternetMail\RealTimeScan\Expanded

Criteria: If the value of FirstAction is not 3, this is a finding.
If the value of FirstAction is 3, then check A. A must be compliant for the check to be not a finding.
A - If the value of OverrideDefaultActions within HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Storages\InternetMail\RealTimeScan\Expanded\TCID-5 is 0 or the value is not there, this is not a finding.

64 bit:
HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Storages\InternetMail\RealTimeScan\Expanded

Criteria: If the value of FirstAction is not 3, this is a finding.
If the value of FirstAction is 3, then check A. A must be compliant for the check to be not a finding.
A - If the value of OverrideDefaultActions within HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Storages\InternetMail\RealTimeScan\Expanded\TCID-5 is 0 or the value is not there, this is not a finding.

Fix Text (F-48424r1_fix)
Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Virus and Spyware Protection -> Select Configure Settings -> Under the Internet Email Auto-Protect tab -> Select the Actions tab -> Under Security Risks -> Select Hack Tool -> Ensure "Override actions configured for Security Risks" is NOT selected.

Fix Text (F-48424r1_fix)

Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Virus and Spyware Protection -> Select Configure Settings -> Under the Internet Email Auto-Protect tab -> Select the Actions tab -> Under Security Risks -> Select Hack Tool -> Ensure "Override actions configured for Security Risks" is NOT selected.