OWA - How secure is it?

[kevstar]

I am running Exchange 2000 with the OWA. I wanted to know how secure this is if we are using it accross the internet.

I had a fellow worker tell me that it really wasnt that secure and that a VPN solution across the internet was a better way forward.

When I say VPN I dont mean going out and purchasing loads of licences he said that the VPN that is built into windows when you add a new connection would suffice.

I am not so sure as you will only be authenticating on the firewall anyhow, so what is the difference and the Microsoft windows version of VPN doesnt (to my knowledge) run anything like SHA-1 or 3DES.

All in all could someone put my mind at ease as to how secure OWA is accross http traffic.

Thanks for your help

Kev

 

[anawrocki]

OWA over http is un-secure, but there are plenry of white papers out there regaurding using OWA over https. While it is not the most secure, it is secure enough for most scenarios if properly implimented and enforced.

VPN would be more secure but the ease of use factor is lost, and most end users I work with would not be able to set it up on there own and the traveling user may not be able to use it depending upon the configuration of the kiosk they are using.

 

[lgarner]

IIS isn't a particularly secure web server, but if you block port 80 to it and allow only 443 then you should have no trouble with virtually all the popular hacks and worms against it.

 

[tekistry]

Don't even bother to use OWA over the internet unless you have another exchange server in a DMZ.
Just take a look at the traffic passing between your exchange server and the the rest of your domain.

Also, I found out (a bit late) that you need Exchange Enterprise edition if you want an OWA front end server - this costs a lot more than standard.

Good luck.

---------------------------------------
save a life - visit:

http://www.thehungersite.com

 

[kevstar]

SO what we are saying is that OWA is not a lot of good and presumably using it accross the web is not secure and should be shut down?

Thanks for your help

 

[jonarden]

kevstar - You may find the links at

http://www.slipstick.com/exs/owa.htm

useful as a starting point in making your evaluation, and in determining the more secure OWA implementation options.

 

[cubec]

Here is a great link, if you know how to set up CA's. It took me about an hour to completely setup. Not bad for a little extra security.

http://www.microsoft.com/technet/tr...l=/technet/columns/security/5min/5min-301.asp