Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would prevent or degrade an attacker's ability to lock out everyone once the userid pattern is known?
There are a variety of ways that this can be mitigated, but here are a couple.
- Two-factor authentication : something you have (a SecurID fob for instance) and something you know (a password)
- A PowerShell script to parse logs and add firewall rules based on a number of failed login attempts located in the Event Viewer
- A product such as Messageware OWA Guard which will monitor your OWA instance and identify potential risks in real-time (full disclosure : I have no experience with this product and cannot vouch for its effectiveness)
If you are using Office 365, then you can consider Azure Multi-Factor Authentication, which you can simply turn on with Office 365. It has options such as requiring phone-based response before accepting a sign-in. You can also integrate it with your on-premises applications.