SEC304 Enhancing Exchange, OWA and IIS Security with ISA Server Feature Pack 1 Steve Riley Microsoft Corporation Agenda The problem Enhancing Outlook-to-Exchange communication Enhancing Exchange OWA and IIS deployments More ISA Server Feature Pack 1 The Problem Packet filtering & stateful inspection are not enough to protect against todays attacks! Traditional firewalls focus on packet filtering & stateful inspection Todays attacks bypass this protection Ports & protocols cannot be trusted to indicate user intent Port 80 yesterdayWeb browsing only Port 80 todayWeb browsing, OWA, MSN Messenger, XML Web Services Internet to internal network Application-layer firewall Traditional firewall Application-layer Firewalls Are Necessary Required to protect against todays attacks Enables deep content inspection Understanding whats in the payload is a requirement ISA Server = Application-Layer Security Packet filtering & stateful inspection Application-layer filtering Deep content inspection Advanced proxy architecture Extensible/pluggable architecture 30+ partners Best firewall for Microsoft environments Enhancing Outlook-To- Exchange Security Enhanced SMTP Filter Uses ISA Server application-layer filtering ability Filterwith increased reliability and security on several attributes Sender Domain Keyword Attachment extension, name, size Any SMTP command and its length RPC server (Exchange) RPC client (Outlook) ServiceUUIDPort Exchange { 4402 AD replication { 3544 MMC { 9233 RPC services grab random high ports when they start, server maintains table RPC /tcp Client connects to portmapper on server (port 135/tcp) Client knows UUID of service it wants Client accesses application over learned port Client asks, What port is associated with my UUID? Server matches UUID to the current port 4402/tcp Portmapper responds with the port and closes the connection 4402/tcp{ } Exchange Server Outlook ISA Server Internet Exchange RPC Filter ISA Server Exchange RPC filter Only port 135 (portmapper) is open High ports are opened and closed for Outlook clients as necessary Inspects portmapper traffic at application- layer Only Exchange UUIDs allowed ISA Server with Feature Pack 1 Exchange Server OutlookOutlook RPCRPC Internal network External network Exchange RPC Filter Enforce RPC encryption Outlook RPC encryption enforced centrally Enable outbound RPC communication Outlook clients behind ISA Server can now access external Exchange Servers Enhancing Exchange OWA And IIS Security URLScan 2.5 For ISA Server Filters incoming requests based on rules set Helps protect from attacks which Request unusual actions Have a large number of characters Are encoded using an alternate character set Can be used in conjunction with SSL inspection to detect attacks over SSL RSA SecurID Authentication ISA Server prompts user for SecurID username and PASSCODE RSA ACE/Agent on ISA Server passes credentials to the RSA ACE/Server for validation When credentials are validated User is granted access to the protected content Cookie is delivered to the user's browser for subsequent activity during the session Web server ISA Server Internet clientclient Client requests protected content from Web server ISA Server pre-authenticates users and logs their activity ISA Server forwards the credentials to the protected Web or OWA server Authentication Delegation For basic and SecurID authentication Authentication happens at ISA Server Eliminates multiple authentication dialogs Only valid traffic allowed past ISA Server Enabled per Web publishing rule Protecting OWA Traditional firewall OWAOWA clientclient OWA server prompts for authentication any Internet user can access this prompt SSLSSL SSL tunnels through traditional firewalls because it is encrypted which allows viruses and worms to pass through undetected and infect internal servers! ISA Server with Feature Pack 1 Basic authentication delegation ISA Server pre-authenticates users, eliminating multiple dialog boxes and only allowing valid traffic through URLScan for ISA Server SSL or HTTP SSLSSL ISA Server can decrypt and inspect SSL traffic inspected traffic can be sent to the internal server re-encrypted or in the clear. URLScan for ISA Server URLScan for ISA Server can stop Web attacks at the network edge, even over encrypted SSL InternetInternet ISA Server Feature Pack 1 demo demo Used in combination with the additional OWA deployment docs 1. Documentation = correct cert deployment 2. Wizard = easily configures ISA Server settings Generates destination set and Web publishing rule with correct elements Adds the correct listeners to external interface Selects correct certificate OWA Wizard More ISA Server Feature Pack 1 New Documentation ISA Server Feature Pack 1 walkthroughs OWA, link translation, RSA SecurID Web Publishing Many scenarios & troubleshooting information Exchange Server Publishing Includes Exchange RPC filter, POP and IMAP & troubleshooting information Additional Documentation Including client types and digital certificates ISA Server: ISA Server with Feature Pack 1: RPC Filter Wizard Create RPC service definitions used in server publishing rules Enumerates services on a given server UUIDs can also be entered manually ISA Server Feature Pack 1 Web server (www.example.com)Web server (int-mktg) int-mktg/ mktg.example.com/ LINK TRANSLATOR clientclient Client requestsInternetInternet Link Translator Translates hyperlinks within responses Intranet computer names to those of externally available computers Including HTTP HTTPS; SPS Allows removal of path prefix Details in translated to translated toISA Server clientclient Internet Partial URL Path Translation site1.ex.comsite1.ex.com site2.ex.comsite2.ex.com No Exchange Server or IIS deployment is complete without ISA Server protection! New firewall security designed to help protect Exchange Server and IIS Great fit into existing deployments Evaluate Security of your current Exchange Server or IIS deployment ISA Server Download ISA Server Feature Pack 1 What Can You Do Today? Community ResourcesMost Valuable Professional (MVP)Newsgroups Converse online with Microsoft Newsgroups, including WorldwideUser Groups Meet and learn with your peers Suggested Reading And Resources The tools you need to put technology to work! TITLE Available Microsoft Internet Security and Acceleration (ISA) Server 2000 Administrator's Pocket Consultant: Today Internet Information Services (IIS) 6.0 Resource Kit: /27/03 Microsoft Press books are 20% off at the TechEd Bookstore Also buy any TWO Microsoft Press books and get a FREE T-Shirt evaluations evaluations 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Steve Riley