Implementing Exchange Server Security Ward Solutions

Session Prerequisites Hands-on experience with Microsoft Windows Server 2003 Working knowledge of Microsoft Exchange Server 2003 Working knowledge of Internet protocols including POP3, IMAP4, SMTP, HTTP, and NNTP Working knowledge of networking, including TCP/IP, DNS, and IIS Basic understanding of PKI concepts and technologies Level 300

Session Overview Implementing Exchange Server Securing Exchange Server Services and Messaging Protocols Maintaining Security on Exchange Server Configuring Exchange to Protect Against Unwanted

Implementing Exchange Server Securing Exchange Server Services and Messaging Protocols Maintaining Security on Exchange Server Configuring Exchange to Protect Against Unwanted

Exchange Server 2003 Security Overview Secure by design Secure by default Support for Sender, Recipient and Connection filtering, including Block List services Secure by default Support for Sender, Recipient and Connection filtering, including Block List services Secure by default User logon on server disabled Messaging limits configuration of 10MB User logon on server disabled Messaging limits configuration of 10MB Microsoft Exchange Server 2003 Security Enhancements security_E2k3.mspx

Exchange Server Deployment Scenarios ISA Server integrated General deployment FE/BE deployment Exchange server Internet Front-end Exchange server Back-end Exchange servers ISA server Exchange server

Hosted Exchange

Exchange Server Client Scenarios General client access: Microsoft Outlook Mobile client access: Outlook Web Access Outlook Mobile Access Exchange Server ActiveSync Outlook Web Access Outlook Mobile Access Exchange Server ActiveSync Exchange Server 2003 client scenarios include the following:

Configuration and Security Update Recommendations for Exchange Server Component Configuration Operating system and software Microsoft Windows Server 2003 with the latest security updates Exchange Server 2003 with Service Pack 1 (or higher) Microsoft Exchange Intelligent Message Filter Browser Internet Explorer 6 with the latest security updates Security update management Microsoft Baseline Security Analyzer

Implementing a Defense-in-Depth Approach to Exchange Server Security Using a layered approach: Increases an attacker’s risk of detection Reduces an attacker’s chance of success Security policies, procedures, and education Policies, procedures, and awareness Guards, locks, tracking devices Physical security Application hardening Application OS hardening, authentication, security update management, antivirus updates, auditing Host Network segments, NIDS Internal network Firewalls, boarder routers, VPNs with quarantine procedures Perimeter Strong passwords, ACLs, backup and restore strategy Data

Securing Exchange Server Services and Messaging Protocols Implementing Exchange Server Securing Exchange Server Services and Messaging Protocols Maintaining Security on Exchange Server Configuring Exchange to Protect Against Unwanted

Securing Exchange Servers: What Are the Challenges? Challenges to securing an Exchange server include: Maintaining the security of the underlying Windows infrastructure Maintaining baseline security hardening practices Understanding security options for various deployment scenarios Maintaining the security of the underlying Windows infrastructure Maintaining baseline security hardening practices Understanding security options for various deployment scenarios

Hardening the Messaging Environment To harden your Exchange messaging environment, deploy the following: Environment Configuration Server environment Domain, Domain Controller, and Member Server Baseline Policy templates Windows Server 2003 Security Guide at Messaging environment Exchange Domain Controller Baseline Policy template Exchange Server 2003 Security Hardening Guide at exchange/2003/library/exsecure.mspx

Hardening Back-End Exchange Servers Tasks for hardening back-end Exchange servers include: Hardening services Hardening file access control lists (ACLs) Changing privilege rights Enabling additional services (optional) Hardening services Hardening file access control lists (ACLs) Changing privilege rights Enabling additional services (optional) Apply the Exchange 2003 Backend.inf security template to your back-end servers

Hardening Front-End Exchange Servers Tasks for hardening front-end Exchange servers include: Hardening services Hardening file access control lists (ACLs) Enabling additional services (optional) Running URLScan (optional but recommended) Dismounting the mailbox store and deleting the public folder store (optional but recommended) Hardening services Hardening file access control lists (ACLs) Enabling additional services (optional) Running URLScan (optional but recommended) Dismounting the mailbox store and deleting the public folder store (optional but recommended) Apply the Exchange 2003 Frontend.inf security template to your front-end servers

Understanding SMTP Relaying SMTP Relaying : When an SMTP server accepts mail from one DNS domain addressed to mailboxes in another domain, neither one of which the server owns Relaying may be necessary when: Accepting mail for another organization Supporting clients that use POP3 or IMAP4 Supporting applications that generate SMTP mail Accepting mail for another organization Supporting clients that use POP3 or IMAP4 Supporting applications that generate SMTP mail Prevent open relays by: Allowing only authenticated computers to relay Restricting relaying to specific computers or users Using an SMTP connector to relay mail to particular domains Allowing only authenticated computers to relay Restricting relaying to specific computers or users Using an SMTP connector to relay mail to particular domains

Demonstration 1: Securing and Testing SMTP Relaying Securing SMTP relaying and testing for open relays

Securing SMTP Communication Between Mail Servers To secure SMTP communication between servers: Install and configure an X.509 certificate on the SMTP server 1 1 Enable and configure TLS encryption for inbound mail 2 2 Enable and configure TLS encryption for outbound mail to specific domains 3 3

Securing Exchange Servers: Best Practices Limit Exchange Server functionality to clients that are strictly required Remain current with the latest updates for both Exchange Server 2003 and the operating system Use SSL/TLS and forms-based authentication for Outlook Web Access Use ISA Server 2004 to regulate access for HTTP, RPC over HTTPS, POP3, and IMAP4 traffic

Maintaining Security on Exchange Server Implementing Exchange Server Securing Exchange Server Services and Messaging Protocols Maintaining Security on Exchange Server Configuring Exchange to Protect Against Unwanted

Maintaining Security on Exchange Server: What Are the Challenges? Challenges to maintaining security on an Exchange server include: Keeping up with the latest security updates Keeping up with recommended best practices Understanding the impact of configuring the various options within Exchange Server Maintaining documentation on configuration and security settings Keeping up with the latest security updates Keeping up with recommended best practices Understanding the impact of configuring the various options within Exchange Server Maintaining documentation on configuration and security settings

Analyzing Exchange Server 2003 Using MBSA MBSA checks for issues related to the following: Known Windows and Internet Explorer security issues Missing security updates Weak account passwords Internet Information Services (IIS) security issues Exchange Server security issues SQL Server security issues

Validating Exchange Server Configuration Settings ExBPA can examine your Exchange servers to: Generate a list of issues, such as misconfigurations or unsupported or non-recommended options Judge the general health of a system Help troubleshoot specific problems

Demonstration 2: Analyzing Configuration Settings on Exchange Server 2003 Analyze Exchange Server using MBSA and the ExBPA Tool

Implementing Antivirus Protection on Exchange Server Consider the following when designing and implementing an antivirus solution: Design a defense-in-depth approach Implement an antivirus scanner that supports AVAPI 2.5 Prevent file-based scanning on Exchange Server folders Design a defense-in-depth approach Implement an antivirus scanner that supports AVAPI 2.5 Prevent file-based scanning on Exchange Server folders

Configuring Exchange to Protect Against Unwanted Implementing Exchange Server Securing Exchange Server Services and Messaging Protocols Maintaining Security on Exchange Server Configuring Exchange to Protect Against Unwanted

Preparing for and Installing IMF - what is Spam? Unsolicited Commercial More than 50% of traffic Costly use of resources  IT  Personnel Potentially offensive

Phishing

Preparing for and Installing IMF Microsoft’s Anti-UCE Strategy Innovative Technologies Industry Self-Regulation and Cooperation Working with Governments``

What Are the Exchange Options for Limiting Unwanted ? Options to limit unwanted include: Recipient filtering Sender filtering Connection filtering Microsoft Exchange Intelligent Message Filter Recipient filtering Sender filtering Connection filtering Microsoft Exchange Intelligent Message Filter

Preparing for and Installing IMFAccept/ Deny Lists 3 rd ptyBlock Lists Recipient Filter Sender Filtering Intelligent Message Filter Information Store

Preparing for and Installing IMF - Exchange 2003 Anti Spam Strategy FeatureFilter PointResource Cost Accept/Deny ListsSMTP Session Block Lists SMTP Session Exchange Sender FilterSMTP Gateway Recipient FilteringSMTP Gateway Intelligent Message FilterGateway/User Mailbox

Configuring Filtering by Recipient Address Recipient filtering blocks mail to specified addresses within your domain and filters addressed to users who are not in your Active Directory

Configuring Filtering by Sender Address or Domain Sender filtering blocks mail from specified senders or domains

Implementing Real-Time Block List Support Using Connection Filtering Connection filtering is used to configure Exchange Server to contact a Real-Time Block List (RBL) provider

Demonstration 3: Implementing Real-Time Block List Support Configure Real-Time Block List Support

Overview of Exchange Intelligent Message Filter Exchange Intelligent Message Filter is an add- on product to help companies reduce the amount of unsolicited commercial received by users

Preparing for and Installing IMF Intelligent Message Filtering Utilizes Smart Screen Machine Learning Applied at the gateway  Marks message with Spam Confidence Level (SCL) rating Utilized throughout the mail stream Scans headers, body of message and other attributes. Hotmail and MSN Outlook 2003 – Junk Folder 3 rd Party products

Deploying the Intelligent Message Filter Exchange Gateway Servers Intelligent Message Filter Firewall Internet Exchange Intranet Servers Intelligent Message Filter handles based upon two thresholds: Gateway blocking configuration Store junk configuration Gateway blocking configuration Store junk configuration

Client SCL 5 Smart Screen Technology SCL 8 Smart Screen Algorithm Gateway Server Mailbox Store Server 3 rd Party Tools SCL 5

How the Intelligent Message Filter Works with Exchange and Outlook Exchange Server 2003 Gateway Server Connection filtering Recipient filtering Sender filtering Intelligent Message Filter (Gateway Threshold) Exchange Server 2003 Back-end Store threshold User mailbox Inbox Junk Inbox YNYN Internet Safe sender Blocked sender Yes No Spam

Managing IMF Archived Messages Using the Archive Manager Archive Manager C# tool released with source on GotDotNet  Supports the following features:  Tree view of the Archive directory of messages  View of RFC2822 decoded headers and raw message  Resubmission of message to pickup directory  Deletion of messages  Forwarding of message as attachment to third-party address

Demonstration 4: Implementing Exchange Intelligent Message Filter Implement and configure Intelligent Message Filter

Session Summary Deploy Exchange Server 2003 and Microsoft Office Outlook 2003 to take advantage of the latest security enhancements Implement the appropriate base and incremental security templates to fully secure Exchange Server Install Exchange-aware antivirus applications and maintain security using the MBSA and ExBPA tools Protect against unwanted by implementing a layered approach using features such as filtering and the Intelligent Message Filter utility

Next Steps Find additional security training events: Sign up for security communications: default.mspx Find additional e-learning clinics Get additional security information on Exchange Server 2003: /library/default.mspx

Questions and Answers