Detections
Analytics

MS.EXO.6.1v1 - Contact folders SHALL NOT be shared with all domains.

Information

Contact folders may contain information that should not be shared by default with all domains. Disabling sharing with all domains closes an avenue for data exfiltration while still allowing for specific legitimate use as needed.

Solution

To restrict sharing with all domains:

1. Sign in to the Exchange admin center.

2. On the left-hand pane under Organization, select Sharing.

3. Select Individual Sharing.

4. For all existing policies, select the policy, then select Manage domains.

5. For all sharing rules under all existing policies, ensure Sharing with all domains is not selected.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-3, 800-53|SC-7(10)

Plugin: microsoft_azure

Control ID: 358e253d817fdcfeb47e8b0ea86ad062f112eaa861fe5da2bd36997579608393