Need supportive evidence for Outlook OWA security issue

[Rowen24]

I am looking for some help convincing management that they made a bad discussion with regards to setting up Outlook 2003 to point to our webmail server.

I work for a global corporation were we have many virtual office users around the world. Recently, a decision was made to set up all laptops to have Outlook connect to the webmail server which would allow users to bypass our VPN and still get their email.

My problem as a security administrator, I am red flagging this situation because I wonder whether our remote users will ever need to access VPN if they just need email to do their job. I'm trying to create a managed organization and I think this decision will get us farther and farther away from that if I can't push any software or patches to anyone because they are not connected to our network for weeks or months at a time.

I'm fine with having webmail as an option to get their email without VPN but now we have educated our users that they can do this using their beloved Outlook.

Does anyone have any examples of why this was a bad idea or am I taking it personal because it makes my job harder to manage my users.

Thanks, any advise on this would be very appreciated.
Rosalyn

 

[Knackster]

Are you talking OWA or rpc over http(s) ??

All of my user have access to OWA and all of my laptop users have their Outlook set up with rpc/https.

If you do set up Outlook for rpc over http, spend the few extra dollars and get an SSL so they can do rpc over https.

In the long run, with a hardened network/firewall, I would not worry about rpc/https.

Chris
IT Manager
Houston, Texas