Detections
Analytics

SHPT-00-000010 - SharePoint must maintain security attributes to stored information - 'Custom content types have been defined for Site'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

SHPT-00-000010 - SharePoint must maintain and support the use of organizationally defined security attributes to stored information - 'Custom content types have been defined for Site'
 Security attributes are metadata representing the basic properties of an entity with respect to safeguarding information. These attributes are typically associated with internal data structures within the application and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. Some examples of application security attributes include classified, For Official Use Only (FOUO), Personally Identifiable Information (PII), and sensitive.

The term security label is often used to associate a set of security attributes with a specific information object as part of the data structure for that object (e.g., user access privileges, nationality, affiliation as contractor).

A SharePoint information management policy or a third party Information Right Management (IRM) solution must be installed to implement this requirement. Although a 3rd party solution is recommended for a more robust solution, SharePoint can natively meet this requirement through combined use of information rights policy and defined content type. Content types must be defined which bind metadata to the content in storage and in process.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To define content types and metadata, perform the following for each desired application security attribute, such as PII or FOUO, as defined by organizational requirements.

1. On the site home page, click Site Actions and then click Site Settings.
2. On the Site Settings page, in the Galleries list, click Site content types.
3. Enter a name for the content type and click OK to view the advanced properties.
4. Scroll down this page and add the columns to prompt the user to enter as metadata or properties to collect when documents of this content type are added to SharePoint.

See Also

http://iasecontent.disa.mil/stigs/zip/Oct2015/U_Sharepoint_2010_V1R7_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-16, CAT|II, CCI|CCI-002272, Rule-ID|SV-36059r2_rule, STIG-ID|SHPT-00-000010, Vuln-ID|V-27968

Plugin: Windows

Control ID: fb31ae1fb4c3df1c88c5a4fc160543925920e36cc2d99f68032acd58ebddefc3