CriticalSolutionsNetwork / M365FoundationsCISReport

Automated assessment of 51 CIS 365 Foundations v3.0.0 benchmark safeguards.

https://criticalsolutionsnetwork.github.io/M365FoundationsCISReport/

Other

5 stars 1 forks source link

Rec: 7.3.1 - Validate Test-DisallowInfectedFilesDownload.ps1, ELevel: E5, ProfileLevel: L2, IG1: TRUE, IG2: TRUE, IG3: TRUE, Connection: SPO #59

Closed DrIOSX closed 1 month ago

DrIOSX commented 3 months ago

Validation for Test-DisallowInfectedFilesDownload.ps1

Recommendation Details

Recommendation: 7.3.1
Description: Ensure Office 365 SharePoint infected files are disallowed for download
ELevel: E5
Profile Level: L2
CIS Control: 10.1
CIS Description: Deploy and Maintain Anti-Malware Software
Implementation Group 1: TRUE
Implementation Group 2: TRUE
Implementation Group 3: TRUE
Automated: TRUE
Connection: SPO

Test-DisallowInfectedFilesDownload.ps1

Tasks

Validate test for a pass

[ ] Confirm that the automated test results align with the manual audit steps outlined in the CIS benchmark.
- Specific conditions to check:
- Condition A: The DisallowInfectedFileDownload setting is set to True.
- Condition B: The setting prevents users from downloading infected files as detected by Defender for Office 365.
- Condition C: Verification using the PowerShell command confirms that the setting is correctly configured.

Validate test for a fail

[ ] Confirm that the failure conditions in the automated test are consistent with the manual audit results.
- Specific conditions to check:
- Condition A: The DisallowInfectedFileDownload setting is not set to True.
- Condition B: The setting does not prevent users from downloading infected files.
- Condition C: Verification using the PowerShell command indicates that the setting is incorrectly configured.

Add notes and observations

[ ] Compare the automated audit results with the manual audit steps and provide detailed observations.
- Automated audit produced info consistent with the manual audit test results? (Yes/No)
- Without disclosing any sensitive information, document any discrepancies between the actual output and the expected output.
- Document any error messages, removing any sensitive information before submitting.
- Identify the specific function, line, or section of the script that failed, if known.
- Provide any additional context or observations that might help in troubleshooting.

If needed, the helpers folder in .\source\helpers contains a CSV to assist with locating the test definition.

DrIOSX commented 3 months ago

Base PowerShell Audit:

Get-SPOTenant | Select-Object DisallowInfectedFileDownload