If I migrate from dovecot/imaps to exchange will I be less secure?

Question

I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - particularly because the client is a charity and gets Microsoft software almost for free.

There are a few things I'm worried about however because I have limited experience with Exchange:

• They have a lot of remote users including BlackBerry/iPhone connections
• The imaps password is currently different to their windows login - and I'd like it to stay that way if possible
• I've heard scare stories (a few years back) that Exchange is less secure

In principle is Exchange with imaps enabled any less secure than using dovecot? How about MAPI access with remote Outlook clients assuming that is possible)?

Answer 1

Of course, you'd have to do a detailed risk assessment to answer this question, but some points that may reassure you:

• Exchange always encrypts all RPC traffic, client-server and server-server. It relies on the OS for this, so the algorithm varies: I think it's typically RSA or CAST?
• And it always encrypts all internal HTTP traffic with TLS.
• By default, it always attempts to use TLS when talking to external mail hosts (and you can prevent it falling back to plain SMTP on a per-host basis)
• All remote clients connect over HTTPS.
• Exchange has hooks for tight integration to anti-malware, anti-spam, and backup systems, either from MS or other vendors.
• Exchange has tight BES integration for Blackberry; and iPhones use Microsoft ActiveSync for their push email - which was designed for Exchange.
• Exchange has topology options allowing you to put a limited functionality edge server in the DMZ.
• Exchange supports IRM and S/MIME for encrypting/signing individual messages.
• Exchange has pretty comprehensive resiliency/recoverability features
• Exchange has built-in compliance options (e.g. email retention and discovery)

For your specific Outlook question, Outlook has a feature called Outlook Anywhere which wraps it's RPC traffic in HTTPS. It's used automatically when the client detects it is not inside the network.

Exchange doesn't do any authentication itself though - it entirely depends on Active Directory, in fact there isn't really such as thing as an "Exchange account" - so having separate login and email passwords is not trivial. Some people do manage it, I believe, by having a separate AD domain for Exchange, but this means a lot of extra work.

Answer 2

Exchange security is top notch and is vetted by many large companies / governments... but like any product it is only as secure as the implementation.

Just be sure to cover the basics of security:

• Secure IMAP will still be possible with the AD Username/Password, though you may want to consider MAPI for a richer experience.

• Forefront Antispam / Phishing (you may want to see if you can get the hosted version Forefront cheaply from MSFT)

• Outlook 2010 + any necessary patches and service packs. A process called Autodiscover will automatically configure Outlook for secure remote access and on-LAN access

• OWA users should use the latest version of their browser to prevent generic browser exploits when a user clicks on a link in an email message

  • Note that Exchange 2010 defaults to "Encrypted MAPI" so only secure versions of Outlook can be used (Outlook 2007 or newer).

Miscellaneous information:

• If you're using Outlook on a Terminal Server, just be mindful that the entire mailbox may be downloaded locally if "Cached mode" is enabled.

  This may consume a lot of local drive space on the Termainal Server and possibly cause IO contention. For more information on this topic, you can ask questions on the following website http://serverfault.com