Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - particularly because the client is a charity and gets Microsoft software almost for free.

There are a few things I'm worried about however because I have limited experience with Exchange:

  • They have a lot of remote users including BlackBerry/iPhone connections
  • The imaps password is currently different to their windows login - and I'd like it to stay that way if possible
  • I've heard scare stories (a few years back) that Exchange is less secure

In principle is Exchange with imaps enabled any less secure than using dovecot? How about MAPI access with remote Outlook clients assuming that is possible)?

share|improve this question
    
Still vulnerable to spear-phishing techniques. Tighten your spam guards constantly against new variants. –  user9248 Apr 20 '12 at 14:55
    
follow-up question here –  Jack Douglas Sep 7 '12 at 8:29
add comment

2 Answers 2

up vote 2 down vote accepted

Of course, you'd have to do a detailed risk assessment to answer this question, but some points that may reassure you:

  • Exchange always encrypts all RPC traffic, client-server and server-server. It relies on the OS for this, so the algorithm varies: I think it's typically RSA or CAST?
  • And it always encrypts all internal HTTP traffic with TLS.
  • By default, it always attempts to use TLS when talking to external mail hosts (and you can prevent it falling back to plain SMTP on a per-host basis)
  • All remote clients connect over HTTPS.
  • Exchange has hooks for tight integration to anti-malware, anti-spam, and backup systems, either from MS or other vendors.
  • Exchange has tight BES integration for Blackberry; and iPhones use Microsoft ActiveSync for their push email - which was designed for Exchange.
  • Exchange has topology options allowing you to put a limited functionality edge server in the DMZ.
  • Exchange supports IRM and S/MIME for encrypting/signing individual messages.
  • Exchange has pretty comprehensive resiliency/recoverability features
  • Exchange has built-in compliance options (e.g. email retention and discovery)

For your specific Outlook question, Outlook has a feature called Outlook Anywhere which wraps it's RPC traffic in HTTPS. It's used automatically when the client detects it is not inside the network.

Exchange doesn't do any authentication itself though - it entirely depends on Active Directory, in fact there isn't really such as thing as an "Exchange account" - so having separate login and email passwords is not trivial. Some people do manage it, I believe, by having a separate AD domain for Exchange, but this means a lot of extra work.

share|improve this answer
    
Yes, this is reassuring. Is it possible to use a different password for remote access than access within the LAN? –  Jack Douglas Apr 20 '12 at 15:03
    
@JackDouglas Look at Forefront Threat Management Gateway (TMG), or Unified Access Gateway (UAG) to provide additional security to remote connections. –  makerofthings7 Apr 20 '12 at 15:21
    
@JackDouglas I added an extra paragraph to address this. –  Graham Hill Apr 23 '12 at 10:06
add comment

Exchange security is top notch and is vetted by many large companies / governments... but like any product it is only as secure as the implementation.

Just be sure to cover the basics of security:

  • Secure IMAP will still be possible with the AD Username/Password, though you may want to consider MAPI for a richer experience.

  • Forefront Antispam / Phishing (you may want to see if you can get the hosted version Forefront cheaply from MSFT)

  • Outlook 2010 + any necessary patches and service packs. A process called Autodiscover will automatically configure Outlook for secure remote access and on-LAN access

  • OWA users should use the latest version of their browser to prevent generic browser exploits when a user clicks on a link in an email message

    • Note that Exchange 2010 defaults to "Encrypted MAPI" so only secure versions of Outlook can be used (Outlook 2007 or newer).

Miscellaneous information:

  • If you're using Outlook on a Terminal Server, just be mindful that the entire mailbox may be downloaded locally if "Cached mode" is enabled.

    This may consume a lot of local drive space on the Termainal Server and possibly cause IO contention. For more information on this topic, you can ask questions on the following website http://serverfault.com

share|improve this answer
    
Thanks for the helpful info. We have the latest versions of everything so that is not a problem (and I don't think we'll implement OWA at all) - total email size ~ 20GB which is pretty small for 30 odd users, and Exchange will be on the Terminal Server itself, so "cached mode" will be off. –  Jack Douglas Apr 20 '12 at 15:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.