I'm working on implementing an Exchange 2010 solutions which includes Outlook Web Access, Exchange ActiveSync and Outlook Anywhere. These services use SSL and would be presented on the Internet so our users can access them externally. I'd obviously need to protect the server (CAS role) that these services operate on. My question is what threats are posed by SSL connections? If I were just to do a port forward on the SSL connection directly to the OWA and EAS server what risks are there? Do I need to do IDP on the encrypted traffic? Thanks
If your intrusion detection system sees anything worth reporting while looking at a SSL connection, then it is not SSL, or is very poorly implemented. By construction, SSL is meant to provide a tunnel for confidential data, i.e. it is very opaque from the outside.
Generally speaking, SSL is not a threat, it is a protection measure against threats. In particular, it prevents evil attackers from inspecting, measuring, eavesdropping on, tinkering with, and forging the data.
Some sysadmins get nervous in the presence of SSL because it prevents them from inspecting, measuring, eavesdropping on, tinkering with, and forging the data.
The external services of Exchange are designed to be exposed to the public at large, which is why they use SSL by default, as they should be.
An SSL connection is pretty much just like a normal connection in terms of what people can do with it. The only difference is that it blocks attackers that are external to the communication. You know that the client on the SSL tunnel is always the initiator of the SSL tunnel, but they can still send whatever they want over the tunnel, so you would still want to do IDS on the tunnel just like you would for an open HTTP connection.