{"id":4580,"date":"2019-07-02T07:19:19","date_gmt":"2019-07-02T01:49:19","guid":{"rendered":"https:\/\/qadit.com\/blog\/?p=4580"},"modified":"2019-07-02T07:19:19","modified_gmt":"2019-07-02T01:49:19","slug":"how-to-audit-microsoft-exchange-2013-and-2016-with-cis-and-disa-guidance","status":"publish","type":"post","link":"https:\/\/qadit.com\/blog\/how-to-audit-microsoft-exchange-2013-and-2016-with-cis-and-disa-guidance\/","title":{"rendered":"How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance"},"content":{"rendered":"<div>\n<div>\n<div><img decoding=\"async\" alt=\"\" src=\"https:\/\/www.tenable.com\/sites\/drupal.dmz.tenablesecurity.com\/files\/images\/articles\/Tenable%20Research%20Release%20Highlights%202019.jpg\"><\/div>\n<\/div>\n<\/div>\n<div>\n<div>\n<div>\n<p>Tenable Research Release Highlights are posted for significant new releases or updates to existing plugins or audit files that are important for early customer notification. Here, we discuss new audit guidance for Microsoft Exchange.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"200\" alt=\"Tenable Research Release Highlights\" src=\"https:\/\/www.tenable.com\/sites\/drupal.dmz.tenablesecurity.com\/files\/images\/blog\/Tenable%20Research%20Release%20Highlights.png\" height=\"206\"><\/p>\n<p>Microsoft Exchange remains one of the most widely adopted email and calendar solutions. Establishing a secure baseline configuration for Exchange, based on industry leading guidance, is essential but the complexity in deployments can present a challenge. The Center for Internet Security (CIS) and Defense Information Systems Agency (DISA) have issued guidance on hardening and auditing these deployments. Tenable released plugin enhancements and audits to help customers implement this guidance on July 1.\u00a0<\/p>\n<h2>CIS Benchmarks for Microsoft Exchange<\/h2>\n<ul>\n<li><a rel=\"noopener noreferrer\" href=\"https:\/\/benchmarks.cisecurity.org\/tools2\/exchange\/CIS_Microsoft_Exchange_Server_2016_Benchmark_v1.0.0.pdf\" title=\"CIS Microsoft Exchange Server 2016 Benchmark v1.0.0\" target=\"_blank\">CIS Microsoft Exchange Server 2016 Benchmark v1.0.0<\/a><\/li>\n<li><a rel=\"noopener noreferrer\" href=\"https:\/\/benchmarks.cisecurity.org\/tools2\/exchange\/CIS_Microsoft_Exchange_Server_2013_Benchmark_v1.1.0.pdf\" title=\"CIS Microsoft Exchange Server 2013 Benchmark v1.1.0\" target=\"_blank\">CIS Microsoft Exchange Server 2013 Benchmark v1.1.0<\/a><\/li>\n<\/ul>\n<h2>DISA STIGs for Microsoft Exchange<\/h2>\n<ul>\n<li><a rel=\"noopener noreferrer\" href=\"https:\/\/dl.dod.cyber.mil\/wp-content\/uploads\/stigs\/zip\/U_MS_Exchange_2013_CAS_V1R2_STIG.zip\" title=\"Microsoft Exchange 2013 Client Access STIG - Ver 1, Rel 2\" target=\"_blank\">Microsoft Exchange 2013 Client Access STIG &#8211; Ver 1, Rel 2<\/a><\/li>\n<li><a rel=\"noopener noreferrer\" href=\"https:\/\/dl.dod.cyber.mil\/wp-content\/uploads\/stigs\/zip\/U_MS_Exchange_2013_Edge_V1R4_STIG.zip\" title=\"Microsoft Exchange 2013 Edge Transport Server STIG - Ver 1, Rel 5\" target=\"_blank\">Microsoft Exchange 2013 Edge Transport Server STIG &#8211; Ver 1, Rel 5<\/a><\/li>\n<li><a rel=\"noopener noreferrer\" href=\"https:\/\/dl.dod.cyber.mil\/wp-content\/uploads\/stigs\/zip\/U_MS_Exchange_2013_Edge_V1R4_STIG.zip\" title=\"Microsoft Exchange 2013 Mailbox STIG - Ver 1, Rel 4\" target=\"_blank\">Microsoft Exchange 2013 Mailbox STIG &#8211; Ver 1, Rel 4<\/a><\/li>\n<li><a rel=\"noopener noreferrer\" href=\"https:\/\/dl.dod.cyber.mil\/wp-content\/uploads\/stigs\/zip\/U_MS_Exchange_2016_Edge_Transport_Server_V1R1_STIG.zip\" title=\"Microsoft Exchange 2016 Edge Transport Server STIG Ver 1, Rel 2\" target=\"_blank\">Microsoft Exchange 2016 Edge Transport Server STIG Ver 1, Rel 2<\/a><\/li>\n<li><a rel=\"noopener noreferrer\" href=\"https:\/\/dl.dod.cyber.mil\/wp-content\/uploads\/stigs\/zip\/U_MS_Exchange_2016_Mailbox_Server_V1R2_STIG.zip\" title=\"Microsoft Exchange 2016 Mailbox Server STIG Ver 1, Rel 2\" target=\"_blank\">Microsoft Exchange 2016 Mailbox Server STIG Ver 1, Rel 2<\/a><\/li>\n<\/ul>\n<h2>Usage Overview<\/h2>\n<p>Tenable customers can audit an MS Exchange server with all of the same check types as in our Windows Compliance Plugin, as well as with a new check type, <strong>AUDIT_EXCHANGE<\/strong>. This new check type leverages the Exchange-specific cmdlets suggested for use in the audit steps of DISA and CIS recommendations.<\/p>\n<p>The following is an example check using AUDIT_EXCHANGE:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"1236\" alt=\"Adding CIS Benchmark and DISA STIG - Audits for MS Exchange 2013 and 2016\" src=\"https:\/\/www.tenable.com\/sites\/drupal.dmz.tenablesecurity.com\/files\/images\/blog\/How%20to%20Audit%20Microsoft%20Exchange%202013%20and%202016%20with%20CIS%20and%20DISA%20Guidance.png\" height=\"1005\"><\/p>\n<p>The powershell_args tag contains the core of the audit functionality, with the plugin itself connecting and exposing Exchange specific cmdlets. As a result, the EMS\/Exchange cmdlet import is seamless to the user, who can instead focus on writing good powershell.<\/p>\n<h2>How to get started<\/h2>\n<p>A byproduct of the session setup and cmdlet import is that we need to work with powershell credential objects. In order to avoid unintended disclosure of credential information via powershell logs, users are required to use a pregenerated encrypted password string for each target of the audit as part of what we require in the Exchange Auditing scan setup.<\/p>\n<h4>Password\/Secure String Generation<\/h4>\n<p>In order to generate an encrypted password for use with our Exchange audits, run the following powershell while logged in on the target with the account that will be used for scanning:<\/p>\n<h4>Read-Host -AsSecureString | ConvertFrom-SecureString<\/h4>\n<p>While logged into the account you\u2019ll be using to scan, type in the password for the account. The output will look like this:<\/p>\n<pre>01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ad58de852cc4646b0d9dfa96c67f2100000000002000000000003660000c0000000100<br><br>00000d8b09ba7e13918c19d776cc7dfcac82a0000000004800000a0000000100000003654a47ae8a4da017657d57f0706989e180000004acd2fe799<br><br>0e1243ed84c380e5d0e8a95a01f12f5662574714000000e5b4783976f1ad76065cf6f91a3b1bebbcf4b169<\/pre>\n<p><code><\/code><\/p>\n<p><code><\/code><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"975\" alt=\"Read-Host -AsSecureString | ConvertFrom-SecureString\" src=\"https:\/\/www.tenable.com\/sites\/drupal.dmz.tenablesecurity.com\/files\/images\/blog\/How%20to%20audit%20Microsoft%20Exchange%202013%20and%202016_Image1.png\" height=\"163\"><\/p>\n<p>Reminder: An encrypted password is required for each target being scanned.\u00a0<\/p>\n<p>After creating the string from the instructions, make sure to select the audit under the Windows category and populate the secure string variable (separating multiple targets with commas). The plugin will determine which string to use on which target. Add your usual credential information on the credential tab and save the policy.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"975\" alt=\"How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance\" src=\"https:\/\/www.tenable.com\/sites\/drupal.dmz.tenablesecurity.com\/files\/images\/blog\/How%20to%20Audit%20Microsoft%20Exchange%202013%20and%202016_Image2.png\" height=\"440\"><\/p>\n<p>Once the configuration is saved, run the scan and review the results.\u00a0<\/p>\n<h4>Example Scan output<\/h4>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"640\" alt=\"How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance\" src=\"https:\/\/www.tenable.com\/sites\/drupal.dmz.tenablesecurity.com\/files\/images\/blog\/How%20to%20audit%20microsoft%20exchange%202013%20and%202016_Image3.jpg\" height=\"216\"><\/p>\n<p>Below is a closer view of one of the results. This page shows:<\/p>\n<ul>\n<li>Pass\/fail status<\/li>\n<li>Remediation steps, if necessary<\/li>\n<li>Individual results from the systems scanned<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"975\" alt=\"How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance\" src=\"https:\/\/www.tenable.com\/sites\/drupal.dmz.tenablesecurity.com\/files\/images\/blog\/How%20to%20audit%20microsoft%20exchange%202013%20and%202014_Image4.png\" height=\"421\"><\/p>\n<h2>Summary<\/h2>\n<p>Auditing an Exchange Environment with Tenable.io and Nessus requires a little bit of extra setup but allows for a secure and automated method for evaluating your organization\u2019s compliance. Exposing Exchange specific cmdlets allows for much more accurate auditing of the environment, with a direct correlation to industry guidance. At Tenable, we regularly update our policy compliance audits to match the newest versions by CIS and DISA to ensure our customers are able to keep pace with the latest best practices.<\/p>\n<p><em>Follow <a href=\"https:\/\/community.tenable.com\/s\/group\/0F9f2000000UyQHCA0\/tenable-research-release-highlights\">Tenable Research Release Highlights<\/a> on the Tenable Community.<\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"1\" alt=\"\" src=\"http:\/\/feeds.feedburner.com\/~r\/tenable\/qaXL\/~4\/jR0xwGW_nQ0\" height=\"1\"><\/p>\n<p><b>Read the Full Article here: <a href=\"https:\/\/www.tenable.com\/blog-2016\">&gt;Tenable Network Security<\/a><\/b><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Tenable Research Release Highlights are posted for significant new releases or updates to existing plugins or audit files that are important for early customer notification. Here, we discuss new audit guidance for Microsoft Exchange. Microsoft Exchange remains one of the most widely adopted email and calendar solutions. Establishing a secure baseline configuration for Exchange, based &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/qadit.com\/blog\/how-to-audit-microsoft-exchange-2013-and-2016-with-cis-and-disa-guidance\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance&#8221;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[12],"tags":[293],"class_list":["post-4580","post","type-post","status-publish","format-standard","hentry","category-itsec","tag-wonder-information"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9AH7Q-1bS","_links":{"self":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/4580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/comments?post=4580"}],"version-history":[{"count":1,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/4580\/revisions"}],"predecessor-version":[{"id":4581,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/4580\/revisions\/4581"}],"wp:attachment":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/media?parent=4580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/categories?post=4580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/tags?post=4580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}