Require users to authenticate before OWA and RWW login

How do I require users to login before they see the standard OWA or RWW login screen?
To get PCI Compliance certified securitymetrics says I need a “login page before the owa and rww login page.” They say that the rww and owa logins are vulnerable to attack.

SBS 2003 SP2
Exchange SP2

Thanks!