1

We have our Exchange server in a remote site administered by an external provider. We would like to avoid the possibility of provider employees to access the email and calendar of critical accounts in this Exchange server.

The inmediate solution we see is using PGP in Outlook but the problem is that we would like to protect also emails that the sender does not send encrypted.

For example, there exist a module in Exchange that inmediately encrypt an email when is received, store it encrypted and only the receiver may access the email unencrypted?

Another possibility is not using an Exchange server but use some solution in the cloud but in that case it is neccessary to blindly believe the provider when he says that their employees are unable to access the emails...

3

You cannot truly protect mail from the Exchange admin if they have Exchange Domain Org/Enterprise access. If their intent is malicious, they can bypass delivery methods, and impersonate users, bypassing transport encryption.

PGP would work for receipt only and in the case the sender is also honoring the PGP methods needed. An admin could email the person back as the user and say "my PGP is screwed up, can you send that unenecrypted" and 9 out of 10 times, the sender would comply.

Any cloud method is going to fall into this category as well. In order to effectively administer most systems like they, the admin will have keys to the kingdom. You can have auditing in place that would at least monitor administrative abilities so you could see other people accessing mailboxes or impersonating users and then you can require access to these functions. Exchange 2013's DLP (data loss prevention) has gone a long way since 2010.

https://technet.microsoft.com/en-us/library/jj150527(v=exchg.150).aspx

I would start there so IF someone was trying to be malicious, you could track it. But again.... if they wanted to, they can turn this off and be on their way before the other admins find out. You either have to have strict contracts in place that give you massive legal repercussions against the hosting provider, OR choose a provider that is complying with compliance requirements. They have to have auditing and process control in place that would make it MUCH harder for admins to carry out malicious duties.

TLDR;

There's no perfect method to prevent a full admin from being malicious for most mail applications.

  • It seems that Exchange's DLP is aimed to search patterns in emails and prevent data leaks but it seems not useful for registering administrator actions in Exchange. – Eloy Roldán Paredes Nov 10 '15 at 12:57
  • I would add the possibility of activating auditing in Microsoft Exchange. This way is possible to find mailboxes that have been accessed by someone other than the person who owns the mailbox, to search for changes made to administrator role groups or view entries from the administrator audit log. – Eloy Roldán Paredes Nov 10 '15 at 15:35
  • 1
    Absolutely. If you do this, use a 3rd party tool like ManangeEngine's AD Audit. Turning on mbx auditing can saturate your event viewer and will make it difficult to browse. 3rd party tools like AD Audit or Splunk (if you have tons of money) allow for easy reporting and search functionality. It can also alert when it sees suspicious activity. – user89449 Nov 10 '15 at 17:23
2

We have our Exchange server in a remote site administered by an external provider.

Another possibility is not using an Exchange server but use some solution in the cloud but in that case it is neccessary to blindly believe the provider when he says that their employees are unable to access the emails...

There is no difference in trust between cloud and some other kind of external provider. That means that either you have full trust or you don't. If you don't then host the mail server where only yourself or some other trusted person has full control.

Note that if you don't trust some external provider than you can also not use a virtual machine somewhere on the internet (no matter if you call it cloud or not) to host your exchange server because these can be easily copied and analyzed by the provider. And even dedicated hardware can probably be accessed and mirrored during some (simulated) outage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.