Securing OWA - Exchange 2010

Hi all,

Recently, we have had some issues regarding someone's email getting compromised. One of the examples was that someone logged in from a library computer and he cached in the password with the browser and didnt close the browser before leaving. Now my company wants to disable use of OWA externally or on Non company devices, unless we come up with a different approach to tackle such kinds of issues. Any ideas ?
LVL 3
Exchange UserSystems AdministratorAsked:
Who is Participating?
 
David Johnson, CD, MVPOwnerCommented:
You cannot protect yourself from stupid users. It is like the story that you can't make something idiot proof as idiots are so ingenuous.

2FA will not protect you from the scenario you described as the session is already established. The libraries and internet cafe's that I've frequented over the years have a very short screen saver time and the user has to re-enter their logon password to regain access and if the session times out or the user closes the session the computer is reset to a default state aka using Deep Freeze or a network boot.

Thanks Amit, you are absolutely right. Many things need to be taught to the users but not everyone is careful enough and we always have these little incidents.
 Then managment and HR have to be involved in the process.  Doing something like you described could also bring significant disciplinary action.  The down side is that employees will be very reluctant to disclose their mistake. After a few people get fired or demoted then security will become the standard practice (it may not be well liked but you need the support of management and HR)
0
 
AmitIT ArchitectCommented:
This is more education issue, rather technical issue. You need to educate your user about cyber security. In my company, we do it every 3 months.
0
 
IvanSystem EngineerCommented:
Hi,

You can try changing time-out session. That will help, but still will not be ultra secure.
More on that: https://technet.microsoft.com/en-us/library/cc995140.aspx

I would suggest using 2F authentication (2 factor), which would require users to have mobile application to generate key, or via sms. That way, even if someone would get users password, it would not do him any good.

I have tested eset 2f authentication last year, and it worked quite well.
https://www.eset.com/us/products/secure-authentication/

There are some other solutions, regarding 2FA, but I did not try them.

Regards,
Ivan.
1
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
Exchange UserSystems AdministratorAuthor Commented:
Thanks Amit, you are absolutely right. Many things need to be taught to the users but not everyone is careful enough and we always have these little incidents.

Ivan, can I setup this 2 factor authentication only for OWA ?
0
 
Adam BrownSr Solutions ArchitectCommented:
http://www.messageware.com/the-public-vs-private-dilemma-in-owa/ has a lot of good information here. If you aren't willing to accept the risk of this type of thing ever happening again, then disable OWA or disable External access to OWA (http://www.expta.com/2013/09/how-to-block-owa-2010-and-2013-for.html)

However, it's important to note that there is no way to completely secure OWA in a way that will prevent an unauthorized user from accessing it if an employee leaves their browser open while logged in to OWA on a public computer. This is a situation where you have to determine whether the costs associated with not allowing OWA access (in convenience for your employees) outweighs the costs associated with unauthorized email disclosure.
0
 
AmitIT ArchitectCommented:
I have seen one my client using Microsoft Forefront Threat Management Gateway for 2 factor authentication. However MS now stopped it. Other way not to publish OWA externally.
0
 
IvanSystem EngineerCommented:
Hi,

yes, 2FA can be setup only for OWA.
0
 
Exchange UserSystems AdministratorAuthor Commented:
Thanks guys.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.