Re: RPC over HTTPS security risks

["xyberpix" <xyberpix () xyberpix com>]

Hi Tim,

I would say that allowing users to use this on their home computers would
be a very bad idea indeed, even if you have inspected the computer
beforehand, as when you inspect the computer, you may make a few changes
to it, to secure it. The changes that you make may not be what the user is
used to, or likes, and then after you have your certificate installed on
it, all they do is take it home, and reset the settings to the settings
that the like, and they still get to connect to the Exchange box.

I would say that one way to secure this, would be to set up a VPN, so that
all clients connect to the VPN, and when connected to the VPN it doesn't
route any other traffic, so if they are using the Exchange box, they have
no access to the Internet, and more importantly the Internaet has no
access to their machine. Ideally the best option would be to buy some
laptops, and then secure the hell out of these, and give the user a
normal(not Admin) account on these machines, and then have these connect
via VPN. I know this is an expensive option, but it all depends on how
much the security of your company means to you. There is no way I would
allow any users home computer to connect to our network, as it is just not
safe for numerous reasons.

I realize that my reply to this mail may have come a bit late, and you
have probably had loads of other replies to this already, but if there are
any other questions that you have you can either contact me on or off the
list, and I'll do my best to help out.

xyberpix

On Tue, 7 December, 2004 7:43 pm, Tim Hanekamp said:
> We have begun to implement RPC over HTTPS for Exchange 2003 at our
> corporate office.  Before rolling this service out to our users, who
> then could possibly start using it on their home computers, which
> could easily be insecured, we are trying to evaluate the possible
> security threats that this poses.
>
> It would seem that if someone were able to own a machine that had this
> configured on it, it would be fairly easy for them to use the exchange
> server as a relay for mail and/or completely flood the system with
> viruses, especially if the computer were infected with a virus.
>
> Do you think this would be the case, and, if so, what measures do you
> think could be taken in order to mitigate this risk.  The only thing
> we could come up with so far was requiring these clients to use
> digital certificates and only install these certificates on machines
> that have been inspected and will be used in the proper setting (not
> that we could ever really be certain of the latter idea).
>
> Thoughts?


-- 
For security and Opensource news check out:
http://xyberpix.demon.co.uk