Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removed 1.2 and 3.2 from the Calendar Baseline per Issue 133 #134

Merged
merged 15 commits into from
Jan 17, 2024
Merged
Show file tree
Hide file tree
Changes from 7 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -43,16 +43,6 @@ External Sharing Options for Primary Calendars SHALL be configured to "Only free
- Prevent data leakage by restricting the amount of information that is externally viewable when a user shares their calendar with someone external to your organization.
- Last Modified: July 10, 2023

- MITRE ATT&CK TTP Mapping
- [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)

#### GWS.CALENDAR.1.2v0.1
External sharing options for primary calendars between multiple components within an organization MAY be configured.

- Rationale
- Prevent data leakage by restricting the information viewable by internal users when a user shares their calendar by configuring additional settings on shared information between components.
- Last Modified: November 14, 2023

- MITRE ATT&CK TTP Mapping
- [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)

Expand All @@ -76,9 +66,6 @@ To configure the settings for External Sharing in Primary Calendar:
4. Select **Only free/busy information (hide event details)**.
5. Select **Save**.

#### GWS.CALENDAR.1.2v0.1 Instructions
1. There is no implementation for this policy

## 2. External Invitations Warnings

This section determines whether users are warned when inviting one or more guests from outside of their domain.
Expand Down Expand Up @@ -133,17 +120,6 @@ External sharing options for secondary calendars SHALL be configured to "Only fr
- Prevent data leakage by restricting the amount of information that is externally viewable when a user shares their calendar with someone external to your organization.
- Last Modified: July 10, 2023

- MITRE ATT&CK TTP Mapping
- [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)

#### GWS.CALENDAR.3.2v0.1

External sharing options for secondary calendars between multiple components within an organization MAY be configured.

- Rationale
- Prevent data leakage by restricting the information viewable by internal users when a user shares their calendar by configuring additional settings on shared information between components.
- Last Modified: July 10, 2023

- MITRE ATT&CK TTP Mapping
- [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)

Expand All @@ -168,10 +144,6 @@ To configure the settings for External Sharing in secondary calendars:
4. Select **Only free/busy information (hide event details)**.
5. Select **Save**.

#### GWS.CALENDAR.3.2v0.1 Instructions

1. There is no implementation for this policy

## 4. Calendar Interop Management

This section determines whether Microsoft Exchange and Google Calendar can be configured to work together to allow users in both systems to share their availability status so they can view each other's schedules. The availability and event information that will be shared between Exchange and Calendar include availability for users, group or team calendars, and calendar resources (such as meeting rooms). Calendar Interop respects event-level privacy settings from either Exchange or Calendar.
Expand Down
2 changes: 0 additions & 2 deletions drift-rules/GWS Drift Monitoring Rules - Calendar.csv
Original file line number Diff line number Diff line change
@@ -1,9 +1,7 @@
PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
GWS.CALENDAR.1.1v0.1,"External Sharing Options for Primary Calendars SHALL be configured to ""Only free/busy information (hide event details)” to restrict information sharing and prevent data leakage.",Admin Log Event,Change Calendar Setting,SHARING_OUTSIDE_DOMAIN,SHOW_ONLY_FREE_BUSY_INFORMATION,rules/00gjdgxs1clzmpm,JK 07-28-23 @ 12:08
GWS.CALENDAR.1.2v0.1,External sharing options for primary calendars between multiple components within an organization MAY be configured.,N/A,N/A,N/A,N/A,N/A,Not Alertable
GWS.CALENDAR.2.1v0.1,External invitations warnings SHALL be enabled to prompt users before sending invitations.,Admin Log Event,Change Calendar Setting,ENABLE_EXTERNAL_GUEST_PROMPT,true,rules/00gjdgxs26jpj72,JK 07-28-23 @ 12:20
GWS.CALENDAR.3.1v0.1,"External sharing options for secondary calendars SHALL be configured to ""Only free/busy information (hide event details)” to restrict information sharing and prevent data leakage.",Admin Log Event,Change Calendar Setting,SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR,SHOW_ONLY_FREE_BUSY_INFORMATION,rules/00gjdgxs3ob14fv,JK 07-28-23 @ 12:32
GWS.CALENDAR.3.2v0.1,External sharing options for secondary calendars between multiple components within an organization MAY be configured.,N/A,N/A,N/A,N/A,N/A,Not Alertable
GWS.CALENDAR.4.1v0.1,Calendar Interop SHOULD be disabled unless agency mission fulfillment requires collaboration between users internal and external to an organization who use both Microsoft Exchange and Google Calendar.,Admin Log Event,Change Calendar Setting,ENABLE_EWS_INTEROP,false,rules/00gjdgxs3yipjmt,JK 07-28-23 @ 14:42
GWS.CALENDAR.4.2v0.1,OAuth 2.0 SHALL be used in lieu of basic authentication to establish connectivity between tenants or organizations in cases where Calendar Interop is deemed necessary for agency mission fulfillment.,N/A,N/A,N/A,N/A,N/A,"Not able to create rule due to bug in rule wizard. Applicable log event exists, but is not selectable within rule wizard."
GWS.CALENDAR.5.1v0.1,Appointment Schedule with Payments SHALL be disabled.,Admin Log Event,Change Application Setting,CalendarAppointmentSlotAdminSettingsProto payments_enabled,false,rules/00gjdgxs3oppjwl,JK 09-08-23 @ 10:47