Security Solutions: Secure remote users

No OWA??

If you do all your stripping and checking before the message arrives in the users inbox anyway...what do you have to worry about?

If I have remote users that only need access to mail, why would I give them VPN access to the network? As long as you have a good anti-virus application running on Exchange using OWA is fairly safe. Block harmful EXE attachments at the Internent gateway and they won't become a problem at the mail client unless they originate internally, which would be very rare since you are blocking them at the gateway and they have no way into the system other than a floppy.

As for VPN, giving it to a user who only needs OWA access for e-mail is simply wrong. If the end node of the VPN (i.e. The remote user's home computer) because infected with a trojan, a VPN connection allows a straight pipe into the corporate network. When you have little control of the end node, VPN access is much more dangerous than allowing OWA.

If you want to make things secure AND remove OWA from the picture AND make it easy for your users, consider setting up a Citrix farm. Users get remote access via any web browser, and you have a lot more control over what programs they can or can't run, plus your don't open a doorway into your network like a VPN tunnel creates.

This is completely inaccurate. If you use virus/malware scanning tools that work directly on the Exchange store, OWA is *safer* than Outlook. Furthermore, because it is easier (as far as user compliance and ease of use) to get OWA over SSL than itis to get MAPI over VPON, it is safer from a network connectivity standpoint than Outlook, as well.

I am surprised this got through the editors - I usually find the articles from TechRepublic to be much more accurate and useful. Very disappointing.

With blanket statements like this, I can now understand why the credibilty of the Secret Service is in the news.

First, not everyone has the luxury of getting the type network connectivity for using VPN. We have consultants on customers sites whoare not allowed to connect our equipment to theirs. They are provided a workstation from which they can at least get to the internet.

Second, the config efforts are no small task compare to OWA. Also the solutions are typically not mix and match.You are pretty much commited to the vendor that supplies the connectivity on the back end. Cisco, Sonicwall and WatchGuard all use the Safenet OEM software but they are not the least bit compatible. The clients can not even coexist on the same machine.

Third, a VPN solution is only as secure as the remote users who are connecting. You may have great security implimented on the front door but VPN provides access to the back. In my companies own situation, I have had little control in what theusers do in terms of their home setup/configurations. This should be relegated by policy but it is extremely difficult to monitor/audit it at the employees house. I had one user, who without even asking if it would be an issue, implimented a wireless network in his homw. It was on of these low cost solutions with little or no security and he had no clue on setting it up other that taking it out of the box as is. So much for the security with his VPN tunnel.

Finaly IMO using OWA with SSL is an extremely reasonable "VPN solution" and is fare easier to install an set up than on using IPSEC or a less secure PPTP. Millions of secure transactions occur daily using SSL and although it is not perfect (no solution is) I am comfortable with the RISK (Risk = vulnerablity x threat x cost) associated with OWA over SSL.

-Dave Vantine
System Administrator

Getting rid of OWA in the name of virus protection is merely sticking your head into the sand. What you save in Outlook client and anti virus license fees are eaten up by more support time.

A better solution is to use OWA combined with SSL and have a good Exchange Server anti virus product scanning/filtering e-mail as it enters the Exchange Server.

Brian E. Conklin, MCP+I, MCSE
Director of Information Services

If the newsletter gets people thinking and generates a lively discussion, then it's done it's job.

I agree, that the optimal solution would be thru citrix, through a vpn to home users might not be optimal, but you can definitely control their access and force server standards on their connection.

I don't think we'll ever get rid of OWA, users like it to much (including me), but there are a host of potential virus issues especially when accessed via a public terminal.

Most users savy enough to access owa from home also run anti-virus and if they're not, then they should.

In closing, As always my intent is to show an alternative to current practices. It may not be the best, but an alternative non the less.

Let's keep bouncing ideas off each other and keep the comments coming (both positive and negative).

Is anyone here worried about OWA being used from a "public" computer where a keystroke logger could be installed? We are thinking of forcing all OWA to occur over VPN to prevent users logging in from public computers. Our VPN software lets us lockdown what applications are available to the user on the gateway. We could limit the users access only to OWA. Is this too paranoid?

What total crap, I can't belive I wasted my time reading this. Does T.R. not screen before publising such trife?