Outlook Web Access (OWA) does not require secure channels and encryption.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18787	EMG1-105 Exch2K3	SV-20500r1_rule	ECCT-1	High

Description
Failure to require secure connections on a web site increases the potential for unintended decryption and data loss. This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. If secure channels are required, the server can also require the channel to be strongly secure by requiring FIPS 140-2 encryption. If Outlook Web Access is approved for use, secure channels and FIPS level encryption are required, as well as appropriate certificate setting. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including CAC enabled pre-authentication through an application firewall proxy, such as Microsoft ISA. Note: if OWA is not approved for use, this control is not applicable and the OWA virtual directory should be removed to eliminate the possibility of attack through this vector.

Description

Failure to require secure connections on a web site increases the potential for unintended decryption and data loss. This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. If secure channels are required, the server can also require the channel to be strongly secure by requiring FIPS 140-2 encryption. If Outlook Web Access is approved for use, secure channels and FIPS level encryption are required, as well as appropriate certificate setting. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including CAC enabled pre-authentication through an application firewall proxy, such as Microsoft ISA. Note: if OWA is not approved for use, this control is not applicable and the OWA virtual directory should be removed to eliminate the possibility of attack through this vector.

STIG	Date
Microsoft Exchange Server 2003	2014-08-19

Details

Check Text ( C-22497r1_chk )
If Outlook Web Access (OWA) is not approved for use at this site, this check is N/A. Verify Exchange directory (OWA) security settings. Procedure: IIS Manager>> [Server name]>>Web Sites>>Default Web Site >> Exchange >>Properties >> Directory Security tab >> Secure Communications >> Edit button. "Secure Channel" and "128 bit encryption" should be selected. Under Client Certificates, the “ignore client certificates” option should be selected. All other settings should be cleared. Criteria: If "Secure Channel" and "128 bit encryption" are selected, with the “ignore client certificates” option, this is not a finding.

Check Text ( C-22497r1_chk )

If Outlook Web Access (OWA) is not approved for use at this site, this check is N/A.

Verify Exchange directory (OWA) security settings.

Procedure: IIS Manager>> [Server name]>>Web Sites>>Default Web Site >> Exchange >>Properties >> Directory Security tab >> Secure Communications >> Edit button.

"Secure Channel" and "128 bit encryption" should be selected. Under Client Certificates, the “ignore client certificates” option should be selected. All other settings should be cleared.

Criteria: If "Secure Channel" and "128 bit encryption" are selected, with the “ignore client certificates” option, this is not a finding.

Fix Text (F-19441r1_fix)
Set Outlook Web Access security. Proedure: IIS Manager>> [Server name]>>Web Sites>>Default Web Site >> Exchange >>Properties >> Directory Security tab >> Secure Communications >> Edit button Select "Secure Channel" and "128 bit encryption". Under Client Certificates, select the “ignore client certificates” option. All other settings should be cleared.