Enhancing OWA security beyond SSL? 1

[rpast]

Hello all –

I’m wondering if anyone knows of a more secure OWA construction than just enhancing it with SSL. My current plan for our small company is to have one Exchange server on the inside lan to which I will allow OWA over the Internet using SSL. I’ve tested this and it works fine. But it has occurred to me that Internet hackers might conceivably go to town trying to get into the machine, and our lan. Of course these attempts will be logged, but I’d like to anticipate a situation where there might be so many hack attempts that I'd want to take security a step further. So my question is twofold:

a) SSL obviously is meant to provide server authentication for the client. But is there any mechanism for requiring the client PCs to also have a certificate? In other words, two-way authentication using certificates? I’m concerned – maybe unjustifiably – that a focused hacker might succeed in providing the correct User ID and password to get to the inside server. Since we have only a handful of prospective OWA users, an extra certificate would be easy to administer.
b) An alternative to the above would be to ask if there is a way to limit the number of allowed logon attempts to OWA, similar to how Windows locks out a user after several unsuccessful tries. I know that many on-line billing sites have the ability to lock out a User in this way.. But I didn’t see any setting for this in IIS.

Any thoughts on this would be appreciated.

 

[asktheman]

If you have port 443 only routing to your owa server which in w2k3 should be iside your LAN you should be ok. This has been designed to be secure...

 

[rpast]

Thanks. But does anybody see the logic of what I'm asking? Clients are protected with SSL, but what about the servers? Even if we dismiss the idea of two-way certificates, just a user lockout policy would seem reasonable. As I was saying, On-line billing sites have the ability to lock you out if you try and fail 5 times. Maybe this is just paranoia, but I can't believe no one has considered this before, especially if their log shows 500 failed logon attempts in a 20 minute span. I know it would make me a little nervous.

 

[NickFerrar]

Lock-outs aren't good security practice, if you're password requirements are good enough you be far more at risk from denial of service attacks locking out accounts than you would from a hacker guessing the password.

As you have the logs if you see a number of determined attacks just block that IP (it would likely just some victim's PC but it's also highly unlikely it would be one of your OWA user's PCs so it shouldn't matter).

You should also make sure users don't save session information on untrusted PC, this is the easiest route in for a hacker.

I'm sure there are 3rd party tools out there (and maybe ways with ISA2004/Exchange 2003) to secure it further but I don't really see the need myself.

 

[rpast]

Sounds reassuring enough. Thanks.