Details

If unencrypted files are intercepted, sensitive information in the files can be compromised. To protect information confidentiality, Microsoft Office application files can be encrypted and password protected. Only users who know the correct password will be able to decrypt such files. Since some encryption types are less secure and easier to breach, Microsoft Enhanced RSA and AES Cryptographic Provider, AES-256, 256-bit should be used when encrypting documents.

Solution

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2013 -> Security Settings ‘Encryption type for password protected Office Open XML files’ to ‘Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256)’.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_OfficeSystem_2013_V2R1_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Windows.

References

• 800-53|SC-28
• CAT|II
• CCI|CCI-001199
• Rule-ID|SV-228548r508020_rule
• STIG-ID|DTOO189
• STIG-Legacy|SV-52726
• STIG-Legacy|V-17619
• Vuln-ID|V-228548

Source

• Tenable.com/audits