Detections
Analytics

MS.EXO.11.1v1 - Impersonation protection checks SHOULD be used.

Information

Users might not be able to reliably identify phishing emails, especially if the `FROM` address is nearly indistinguishable from that of a known entity. By automatically identifying senders who appear to be impersonating known senders, the risk of a successful phishing attempt can be reduced.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Any product meeting the requirements outlined in this baseline policy may be
used. If the agency uses Microsoft Defender, see the following
implementation steps for
[enabling impersonation protection](./defender.md#msdefender21v1-instructions).

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8

Plugin: microsoft_azure

Control ID: a375990d0aac9f68c17d8a863ca403f7acb8ecac8f74c671723c27193163fafa