Details

If unencrypted files are intercepted, sensitive information in the files can be compromised. To protect information confidentiality, Office application files can be encrypted and password protected. Only users who know the correct password will be able to decrypt such files.

Solution

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2010 -> Security Settings ‘Encryption type for password protected Office Open XML files’ to ‘Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256)’.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_OfficeSystem_2010_V1R12_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Windows.

References

• 800-53|SC-28
• CAT|II
• CCI|CCI-001199
• Rule-ID|SV-33465r3_rule
• STIG-ID|DTOO189
• Vuln-ID|V-17619

Source

• Tenable.com/audits