Sec 306 Security in Exchange 2003 and Beyond

Sec 306 Security in Exchange 2003 and Beyond Fred Baumhardt Infrastructure Team Sasa Juratovic Messaging Team Technology Services Group – Microsoft UK

Session Agenda Microsoft Tw. C – and Security Framework Exchange 2003 Security enhancements Core O/S – what improves in Win 2003 Core Exchange security functionality Anti-virus, Anti-spam & content filtering Client Communications and OWA Exchange Security Architecture .

The No BS version of Trustworthy Computing Focused – Intensive - Ongoing effort NOT A MARKETING CAMPAIGN Extensive developer training and focus Improved test & attack tools, and dedicated security testing Architectural Review for all components and features – very strict feature triage criteria Cross-component functional and security analysis.

Microsoft’s SD 3+C Model Secure by Design Security aware features and architecture Reduce vulnerabilities in the code Exchange – OWA – IIS – Spam &AV – FE/BE Secure by Default Reduce attack surface area Features default off and with minimum privilege Exchange- STMP Relay – IIS – lower privilege srv Secure in Deployment Communication. Protect, Defend, Recover and Manage Process: How To’s, Guidance, MSA. ISA People: Training, Templates, Job Aids, Help MS. COM: MSRC, /Security, /Tech. Net PR: Proactive, Reactive Community building

Windows 2003 Improvements Core OS is Radically more secure Reduced surface area (40% of NT 4 lines code) IIS extensively hardened and improved Improvements in all areas IPsec failover RPC over HTTP NLB Wider Kerberos support AD improved with: Cross-forest trust and authentication Group usage and replication improved SID filtering on trusts and blocking There are tradeoffs to running Exchange 2003 on Windows 2000.

Core Exchange Security Improvements Many secure-by-default settings More restrictive permissions New transport features New Internet Connection Wizard simplifies SMTP configuration Cross-forest authentication support NOTE: 1 forest still = 1 Exchange organization

Core Exchange Security Secure by Default Relaying always off Default 10 MB message limit for send, receive, and PF Deny logon ACE for Domain Users on Exchange 2003 servers POP 3, IMAP 4, NNTP off by default for new installs (not Upgrade) OMA off by default on all installs OWA password changes off by default

Core Exchange Security More Restrictive Permissions Services run as Local. Service Tighter permissions on Exchange Domain Servers group May break Ex. Merge or other apps that use EDS group Fix for cluster reinstall permissions problem Installing add’l servers requires EFA at admin group, not org level No default top-level PF creation No longer granted when adding servers

Anti-Virus Improvements VS API 2. 5 Improved support for scanners with all outbound messages guaranteed scan More MAPI properties exposed and status Can be used on store-less (FE) servers and gives ability to use anti-spam and AV together VS API 2. 0 -based scanners can’t run on storeless front-end servers

Anti-Spam Improvements Spam is a large problem Volume growing rapidly Volume – capacity – “noise” that must be scanned Several ways to deal with spam Offload to clients w/ client or 3 rd party software Server app that blocks on message heuristics Inbound relay protection and RBLs like ORDB .

Anti-Spam Improvements Exchange Perimeter Blocking Real-time DNS-based block or allow lists If DNS record for sender’s IP exists, block it Use third-party block lists or roll your own Safe list allows mail based on a match Bastions can invalidate these systems If bastion was last IP that relayed – DNS internal Place on edge – or use another system .

Anti-Spam Improvements Other Improvements Filter inbound mail by address or domain With blank senders or unresolvable addresses Turning this on may allow address enumeration attacks Drop the connection after 20 unresolvable attempts Outlook 2003 and OWA 2003 Block attachments, Strip scripts, and beacons Allow user to maintain Trusted and Junk Senders lists and can store on server.

Networking Security Securing the network transport between servers and clients critical Outlook Clients (OWA, 2003) can natively use encryption –RPC - SSL .

COMSEC Improvements RPC over HTTP Most places disallow raw RPC traffic to/from Internet Example: Comm. Net! Leads to “feature” of using VPNs or tunneling for Outlook to bypass firewalls Heavy connection setup/teardown penalty ISA’s RPC publishing one popular alternative. Still requires that RPC ports be opened

RPC over HTTP Windows 2003 can tunnel RPC over HTTP Uses TCP 80 (Universal Firewall Bypass Protocol) Can also use TCP 443 SSL – UFBP encrypted Full Outlook functionality New mail notification Synchronization Public folders Free/Busy Password changes Requires Windows 2003, Exchange 2003, Outlook 2003, Windows XP SP 1+hotfix ISA adds value – terminate SSL and scan it – check HTTP syntax – OR use the native RPC filter and avoid the above system requirements.

demo RPC over HTTP mailbox access

COMSEC Improvements IPsec for clusters Clustered IPsec SAs don’t have 5 -minute expiry Allows efficient use of IPsec between FE and clustered BE* Kerberos for MAPI connections Keeps less-secure NTLM data off the wire . *And clustering now rocks

OWA Security Improvements S/MIME access Privacy enhancement Attachment control Cookie-based authentication

OWA S/MIME is a terrific technology Large Microsoft customers wanted to make it portable Basic problem of certificate/key access You don’t want your private key on the server Signing/decrypting with the server’s own keys is basically useless

OWA Security Improvements Privacy Enhancements Automatic stripping of web beacons HTML images aren’t automatically downloaded Redirector allows admin control over which links are accessible

OWA Security Improvements Cookie Authentication E 2 K-style authentication User logs in Credentials cached by browser As long as browser’s running, user can log in This is undesirable… No way to time out sessions No way to prevent toilet-seat attacks Solution: go back to the future

demo Cookie Authentication

OWA Security Improvements Cookie Authentication User logs in to logon form ASP on server requests authentication If it fails, user can’t log in If it succeeds, cookie sent to user browser OWA requests cookie for each page Server can expire cookie on demand Cookie has finite shelf life

Other Security Improvements Real-Time Collaboration security Client-server sessions can now use SSL Information Rights Management Goal is to let information creator control Lifetime of information What can be done with it Who can do it Examples Don’t allow this email to be forwarded Make this document expire on 1 January

Best Practices - Infrastructure Exchange Security is 50% Exchange – 50% Infrastructure – 50% Planning Defense in depth is key Layer 7 firewalls, encryption, authentication, and physical security, infrastructure like AD Don’t forget IDS – and its limitations Have a response plan – and a plan for the plan Secure Anything your Exchange relies on: DNS poisoning and spoofing Domain Controller Do. S – and attacks Firewall and Router ACLs tightly controlled.

Best Practices - Thinking Think like a hacker What sensitive data exists, What’s it worth? How can I get to it, Will I get caught ? Operate securely – know what to do if: You have been hacked (if you know) Your server collapses (for any reason) A major virus or Do. S is discovered Do –your colleagues know – think before it happens- can they recover ? .

Best Practices Content Stop spam Reduce it – the less there is coming in- the less your AV has to scan and process Kill authenticated relay and Guest account should be disabled Investigate spam-blockers and RBLs – Bastion relays can invalidate RBLs Secure your OWA Require SSL (mindful of impact on IDS) Terminate SSL and inspect before FE – preauthenticate OWA with ISA FP 1 Deploy S/MIME where appropriate.

Best Practices- Clients Secure your OWA Require SSL (mindful of impact on IDS) Terminate SSL and inspect before FE Pre-authenticate OWA with ISA FP 1 Deploy S/MIME where appropriate Plan RPC/HTTP – assess the impacts of people using it OUT of your organisation Start transitioning away from legacy client protocols like POP if you can – the less to worry about the better. .

Community Resources http: //www. microsoft. com/communities/default. mspx Most Valuable Professional (MVP) http: //www. mvp. support. microsoft. com/ Newsgroups Converse online with Microsoft Newsgroups, including Worldwide http: //www. microsoft. com/communities/newsgroups/default. mspx User Groups Meet and learn with your peers http: //www. microsoft. com/communities/usergroups/default. mspx

Suggested Reading And Resources The tools you need to put technology to work! TITLE Microsoft® Exchange Server 2003 Administrator's Companion: 0 -7356 -1979 -4 Available 9/24/03 Microsoft Press books are 20% off at the Tech. Ed Bookstore Also buy any TWO Microsoft Press books and get a FREE T-Shirt

evaluations