You know in the back of your mind that not every message you send or receive is absolutely safe. Isn’t it time you figured out how to protect your enterprise e-mail system?
Safe Messaging with Exchange
You know in the back of your mind that not every message you send or receive is absolutely safe. Isn’t it time you figured out how to protect your enterprise e-mail system?
- By Roberta Bragg
- 03/01/1999
We live dangerously. No, I’m not talking about that
ride through commuter traffic or your quest for a Furby.
I’m talking about the e-mail that we so casually
send to our bosses, co-workers, friends, and sweethearts.
While we’ve given plenty of attention to e-commerce
and whether or not it’s safe to purchase products
over the Internet, most people have given little thought
to the messages they so blithely send across cyberspace.
Who’s reading your e-mail today? When you open that
holiday attachment from Aunt Sue, are you going to bring
down the corporate network? Are you going to be able to
send that important contract, proposal, or critical information,
or will you get the dreaded “message rejected”
message from somebody’s mail server?
The answer may be maybe. Much depends on the use of a
securable messaging server—yes, like Microsoft Exchange
Server. Like most messaging servers Exchange has multiple
security features built in to ensure safe messaging. But
these features require configuration and understanding
by messaging administrators, installers, and users in
order to protect both the server and message store as
well as the transport of your messages from server to
server and server to client. Let’s look at four areas
of concern to better understand how to protect ourselves.
- Ensuring the security and availability of the messaging
server.
- Ensuring that messages on the server can be accessed
only by approved mailbox users.
- Ensuring that the message reaches the intended recipient,
untouched and unintercepted.
- Ensuring received messages and attachments pose no
threat.
Securing the Messaging Server
Exchange has many features that can protect the server
and its messaging store. Its security is tightly integrated
with NT Server where it’s installed. Mailboxes can
be accessed only by authenticated users who have been
given permission. Administration of the mail server is
hierarchical and granular. You can split the administrative
burden while maintaining control. You can secure messages
between users and organizations by using certificates
and certificate trust lists. Unsolicited Commercial E-mail
(UCE) or spam can be controlled by message turfing, or
the deletion of mail from specified domains and the control
of who uses the Internet Mail Service (IMS) for mail relaying.
In order for all security features to work, you must
first lay a groundwork, then plan and implement your installation
with security in mind. Likewise, you have to make sure
that users and administrators are trained and that you
practice continued vigilance.
To ensure the security of the messaging server, follow
these 14 recommendations.
1. Secure NT Server before your installation.
Follow recommended security advice to harden and protect
the server. (I covered this in the October issue.) Weigh
carefully whether you should apply service packs and hot
fixes. Service packs are sometimes necessary for certain
features. Hot fixes may prevent problems, such as those
that protect you against attacks or correct known bugs.
Others should only be applied if you’re experiencing
the problem they’re designed to fix. (Microsoft doesn’t
guarantee that hot fixes are regression tested.) Consult
Microsoft’s online advice and make decisions based
on this and your particular system. Continually monitor
security sites such as www.microsoft.com/security
for new information.
2. Plan the Exchange installation.
Most of the actual process is point and click.
However, like many unplanned, serendipitous excursions,
this casual approach can lead to disaster. In addition
to the issues regarding how many servers you need, what
naming conventions to use, what your hardware specification
should be, how much bandwidth you’ll require, and
other generic brouhaha, you need to plan your security
strategies. Will Internet e-mail be allowed, or are you
limiting it to leased-line access and/or local access?
Will clients need access via browsers to their e-mail
boxes? Who will administer which servers and which parts
of those servers? Will encryption of messages and/or digital
signing be necessary? How will this be accomplished—through
Exchange Server’s Key Management Server, Internet
Information Server 4.0 Certificate Server, or through
a certificate service such as VeriSign, Inc.’s?
3. Create and use a special service
account for the implementation of Exchange. Don’t
use the built-in Administrator account or the account
used to install Exchange. This account doesn’t have
to be a member of the Domain Admins or local Administrators
groups. (But it does have to be trusted by any other domains
that Exchange servers might be installed in.) This account
will be used by Exchange services to communicate internally
as well as with other Exchange servers and connectors.
By using a special account, you’re limiting the vulnerability
of your network and the Exchange server should the service
account be compromised. Hackers don’t obtain administrative
privileges on the server or in the domain by hacking the
service account.
4. Understand the Exchange Server
hierarchy. At the top level is the Organization.
The Organization is composed of Sites (logical groups
of Exchange servers that can communicate via Remote Procedure
Calls (RPC)). Each Site may have multiple servers.
5. Understand and plan the administration
of Exchange. Administration of Exchange
Server is granular by design. NT administrators don’t
have to be Exchange Server administrators. Exchange Server
administrators can be given limited permissions on various
servers as well as on different layers of the server architecture.
6. Understand permissions in Exchange.
Permissions are hierarchical and can be inherited.
Permissions granted at the Organization and Site levels
are inherited elsewhere in the organization. Make sure
permissions for remote administrators affect only their
local servers. Be sure everyone understands the implications
of the permission they’re granting. An improperly
designed and granted permission strategy can undo any
security implementation. See “A
Horror Story” for proof.
7. Understand how Exchange Server
works. You need two things to accomplish Exchange
Server administration: a knowledge of how it works and
familiarity with its 1,001 property pages (in order to
know where to place the change to make it work). To ensure
security of the server, administrators not only need to
know what to do, but where to do it.
8. Evaluate, plan, and implement the
level of security you believe you need. Exchange
Server has built-in security features. Users are limited
to accessing their own mailbox. Unlike with shared messaging
file systems, you don’t need to share the entire
messaging store or give read and write access to all users.
Messages get stored in a database structure; access to
them is limited to mailbox owners and those granted access
by owners or administrators. Exchange Server communicates
via connectors. Exchange servers in the same site are
automatically connected. To connect sites, connectors
have to be installed and/or configured, and some connectors
can be configured to limit access. Specific gateways or
connectors have to be configured to link with disparate
mail systems, such as cc:Mail or Lotus Domino. This configuration
also needs to include the sharing of passwords with connectors
on other mail systems.
9. Decide on and implement the best
location for your enterprise. Place the messaging
server outside of the corporate firewall with other “outer-ring”
servers. Or keep the Exchange Server inside the firewall
and configure the IMS to route mail to and from the outside.
The approach you use will depend on the size of your enterprise,
your budget, and your risk assessment. A properly configured
Exchange server has many firewall-like features. For example,
communication between the outside world and the internal
network isn’t direct but consists of communications
(messages) left on the server and retrieved by outside
agents. There’s no mechanism for direct passthrough
of packets to the internal network. Of course, if you
configure NT Server to route packets, you’ve bypassed
this feature.
10. Configure the protocols for Internet
services appropriately. Exchange can use LDAP,
HTTP, and NNTP. If you don’t use these protocols,
make sure they’re disabled. You can limit the protocols
to the Internet gateway and even restrict them at the
mailbox level. You may wish to limit Internet mail access
to specific accounts instead of giving broad access across
the organization.
11. Build in redundancy. Ensure
messaging continuity by having multiple portals. If Internet
mail is a critical part of your messaging strategy, configure
more than one Exchange server with this service. (But
realize that if an IMS machine goes down, any Internet
mail queued on that machine will not be routed to another
machine.) If connections with remote messaging servers
exist, configure multiple portals.
12. Limit the size of messages and
attachments both leaving and receiving. Large messages
can block access and tie up resources. Messages can be
limited for the entire server as well as by user.
13. Purchase, implement, and monitor
modern virus protection with components designed for messaging
servers. Computer Associates’ InoculateIT
is one solution that claims to have the appropriate features.
Look for centralized management, a virus wall (which prevents
the overwriting of existing uninfected files with infected
versions), virus quarantine (for automatic log-off of
the client workstation attempting to upload an infected
file), free virus signature updates, alert options, messaging
protection (to detect and cure a virus in e-mail and file
attachments), and Internet gateway protection from malicious
Java and ActiveX applets. Before purchasing a virus protection
solution, check out its Checkmark certification. West
Coast Lab’s Checkmark will give you an independent
review of antiviral products on the market. It indicates
their ability to detect viruses and retests them every
three months. Also check out the International Computer
Security Association, which tests and certifies antiviral
software. A certified antiviral software must detect 100
percent of viruses in the wild (generally distributed)
and 90 percent of over 6,000 test viruses.
14. Block forwarding of mail.
Mail spammers often use unprotected mail servers to reroute
their advertisements, thus tying up your resources and
making their mail look like it came from your server.
| A
Horror Story |
|
My client complained that Exchange
Server wasn’t a secure messaging
system. The reason: A secretary had
been able to access her boss’ e-mail.
This user had logged on as herself at
her Windows 95 computer and double-clicked
on the Exchange client icon. She was
surprised to see that the mailbox she
was accessing belonged to her boss.
Profiles were enabled on the Windows
95 computer. Administrative personnel
could repeat the action and, by logging
on with user-level accounts, access
other individual mailboxes. This action
was repeatable across their Exchange
organization, which consisted of multiple
sites and geographical locations.
 |
| Once mailbox
owner permission rights were granted
from a boss’ mailbox to an
assistant’s mailbox, the permission
was inherited throughout the organization. |
The system had been installed by knowledgeable
but untrained personnel and was being
administered at different locations
by a variety of personnel.
In a lab implementation consisting
of a server running Exchange and Windows
95 computers we couldn’t duplicate
the incident—that is, until we
gave mailbox owner permission to all
users. Indeed, this was the case. Apparently,
one of the client’s remote administrators
who had organization, site, and server
administrative privileges had been trying
to make a boss’ mailbox accessible
to his secretary (with permission from
the manager, of course). Experienced
Exchange administrators will recognize
that this is possible by granting permissions
from the boss’ mailbox. The boss
could have done it himself.
The administrator, a member of the
“never-mind-the- proper- way-or-figuring-out-the-implications-let’s-just-make-it-work”
school, had made it work by granting
mailbox ownership to all. Worse, the
permission had then been inherited throughout
the organization. The company was lucky
to discover the problem before too many
secretaries did. Removing this permission
secured the mailboxes.
—Roberta Bragg
|
|
|
Who To Let Through
A properly installed and configured Exchange server protects
messages in the database. A mailbox can only be configured
for NT Server accounts, and only authenticated users can
access their mail. If the NT server has authenticated
a user, access to his or her mailbox is transparent. A
user can also impose other levels of permission to limit
mailbox access.
Exchange Server 5.5 Service Pack 1 allows an audit copy
of all mail messages to be stored and made accessible
to administrative personnel. However, this feature isn’t
turned on automatically.
Users need to be trained to not allow access to their
mail by any other means than granting permission. Likewise,
they need to be counseled to not leave systems logged
on unattended.
As with any system, if you don’t have or follow
a proper security policy—if there’s no “security
awareness” in a corporation—the security of
e-mail will be compromised.
You can implement an additional layer of security for
mail messages on the server and during transport by installing
Exchange’s Key Management Server or by implementing
the use of X.509 certificates to encrypt and/or digitally
sign e-mail. Employ Microsoft Certificate Server or an
Internet certificate authority such as VeriSign for this
purpose.
Extreme security measures such as FORTEZZA cards (in
which users’ computers have special hardware and
software that require “smartcards” for access)
can be employed. See “And,
Now, for the Very Paranoid...”
Getting the Message Out Untouched
Microsoft Outlook and Outlook Express mail clients have
features that can ensure message integrity. These features
include the capability of obtaining a secure connection
to the Exchange server. To access an Exchange Server mailbox
the client must authenticate with the server. On a LAN
this is invisible to the client; authentication occurs
on the LAN before the mail server gets accessed. Outlook
Express provides LAN- or dial-up-access to the Internet
and authentication via a pop-up window.
Depending on the level of security required, the message
itself may require encryption and/or digital signing.
Encryption uses various algorithms to scramble the message
so it can’t be interpreted by normal means. Digital
signing applies a signature and only implies that the
digitally-signed message is from the person it claims
to be from. The message isn’t encrypted, but message
encryption and digital signing can be used together. In
reality both processes are only as good as the algorithms
used to produce them.
For internal use Exchange comes with advanced security
supplied by its own Key Management Server. Multiple-organization
systems or those that require inter-organization secure
messaging can use Microsoft’s Certificate Server
or a commercial certificate authority like VeriSign and
Certificate Trust Lists. The latter are lists of certificate
authorities that trust each other.
Keeping It Clean
High on your list of communication to all users about
e-mail security should be advice about the threat of viruses
that can travel to their computer via messages and attachments.
Caution users about opening unsolicited attachments. While
you can install antiviral agents at the server and client
level, this doesn’t guarantee protection.
Visit www.microsoft.com
for updates and patches to Internet Explorer and Outlook,
Outlook Express, and the Exchange client. Apply these
updates and patches to all client machines.
And,
Now, for the Very Paranoid…
For increased security on your messaging system you could
require the use of the Defense Message System (DMS) version
of Exchange Server, developed by Microsoft for the U.S.
Department of Defense. DMS is a global messaging system
composed of a set of technologies from different vendors
and designed for the transfer of classified and non-classified
defense data. The system supports the use of FORTEZZA
hardware encryption for the encryption of messages and
the electronic signing of messages using a FORTEZZA driver
and the Message Security Protocol (MSP or P42). Using
the DMS version of Exchange Server provides users with
end-to-end security, including non-repudiation, privacy,
and content integrity, as well as signed receipts. FORTEZZA
is a registered trademark (held by the National Security
Agency) that describes a number of security products (such
as PCM/CIA cards, serial port devices, communication cards,
and server boards). I bring this up, of course, because
non-defense customers can purchase DMS-approved messaging
technologies. Learn more at http://cms1.ssg.gunter.af.mil.
Until next month, make sure you lock up!