OWA Security
introduction
When users in an organization work with OWA (Microsoft Exchange Outlook Web App) from anywhere in the world, they are likely to leave behind copies of mailings that have saved or opened on computers from which they have accessed the service. In fact, when you open Attachment in OWA, a copy of the browser cache is saved that is available for future access for anyone with permissions to access the cache partition. The cche partition can be accessed on the following routes depending on the browser version from which OWA was accessed:
- For IE 6,7,9,10,11: Go to Tools, Internet Options, click Settings under Browsing History, View Files, Sort by type and look for the document;
- For IE8: Go to Tools, Internet Options, click Settings under Browsing History and View Files. Add \low to the end of the URL and search by *extension;
- For Firefox: Click the Firefox button, and select Downloads, and search for the document;
- For Chrome / Edge: Click the Chrome menu, and select Downloads, and search for the document.
So how do we actually allow on the one hand access to bundleds from any computer in the world, and on the other hand, guard against leaking sensitive business information? First, we’ll review the …
First, we will review the built-in capabilities in THE OWA to view / prevent the display of attachments and file types, and then we will present Messageware AttachView solution for managing enterprise policy in the presentation of combinations.
Built-in Options
- Attachment Control
Public And Private
Allows access to joins from computers on the private network and computers on the public network. It should be noted that the distinction between Public Share Computer and Private Computer is possible only when forms-based authentication is defined. In all other identification options, the computer will be configured as Private Computer without the ability to select. As a result of setting the computer to public or private, you can allow or completely block the opening of the bundle and/or set a different policy of group management permissions (irrelevant to the Exchange 2016/2019 version)
PowerShell Command :
Set-OwaVirtualDirectory -Identity “Contoso\owa (default Web site)” -DirectFileAccessOnPublicComputersEnabled $false
ON GUI:
Note: Non-exposing Direct File Access does not prevent access to content sourced from an organized OOS (Office Online Server) server.
Types
You can allow or block files according to an approved File Types or Mime Types list, and/or require a local save of a attachment before it can be opened.
PowerShell Change parameter :
Set-OwaVirtualDirectory -Identity “Contoso\owa (Default Web Site)” -ActionForUnknownFileAndMIMETypes Block
- Web Ready View
A mechanism that allows preview only for OFFICE and PDF documents on stations that do not have OFFICE software installed. The solution allows the document to be displayed as an HTML page, thereby preventing leaking of organized information because no copy is saved to the browser’s CACHE.
The option to use Web Ready was understandable in OWA until exchange 2010 without the need to install additional components or servers.
.
Exchange 2013/2016/2019 Management Center:
Starting with the 2013 EXCHANGE version, we will need to install a new server – Office Web Apps Server (OWAS) or Office Online Server for EXCHANGE 2016/2019 and interface it to work with the enterprise mail infrastructure to enable webReady capabilities. The Office Online Server also allows you to edit the files that are displayed through WebReady.
Tip – If you’re working in mix mode, we’ll need to absorb each version of Exchange against the appropriate Office Server version.
In fact:
You can see that the built-in solution in OWA has several key limitations:
- Office and PDF documents are supported only.
- You cannot restrict the retention of the user-initiated document.
- Users/ groups cannot be exceptional (exclusion exists only at the mail server level (CAS)).
AttachView
Messageware AttachView solution comes to address the key limitations of the built-in OWA solution and expand aggregate management capabilities.
Key product capabilities:
- Policy-based Security & Configuration
Flexibility The product enables high-flexibility management to define access to combinations (which includes view, open, save, print) based on criteria such as IP addresses, enterprise end device identification, groups, and location in Active Directory.
- Securely view over 400 attachment file types HTML
rendering of over 400 types of attachments in OWA that are executed on the side of the mail server. TheHTML page is displayed in a dedicated AttachView window. TheHTML page is not saved in the browser’sCA, thus preventing access to enterprise-sensitive information to unauthorized users
- Control Open/Save of Attachments
Control at a granular level for those who are allowed to open a bundle and who is allowed to keep a bundle. The “OPEN” option actually allows THEA to treat the bundle like any standard file found on a webpage and open it with the software and/or settings defined passed at the operating system level.
- Disable Copy/Paste of Attachments
The displayed contents of the displayed join cannot be copied, thus preventing the ability to exclude information from the organization.
- Control Printing of Attachments
Ability to determine whether the user can print the contents of the displayed burn or not (adding a button with print capability on the HTML page).
- Save Confirmation
In cases where it is necessary to allow a particular user or group of users to save the document locally (for example, for editing content in locally installed Office software). Your system administrator can set up a certificate request for the save with an explanation of the retention policy—where to save, a request to delete the file at the end of work, and so on.
- Control uploading of Email Attachments
Controls whether files from computers from which the OWA server is accessed are allowed.
Architecture and description of product
- Central Administration Portal – The initial installation of the product installs an IIS-based management portal (you can basically install on one of the existing mail servers in your organization). From the portal you can define and enforce the policy set, examine the health and integrity of the infrastructure, and more
- Local installation of solution components on each of the enterprise mail infrastructure’s CS servers – the infrastructure FRAMWORK of all company products and product installation (centered on ISAPI Filter and HTML rendering)
The admin screen displays the components of the product and versions of each component (versions will only be displayed if one of the installed components is upgraded)
Policy
In the first step, you must Update default policy and correct the desired organizational policy settings. On the main screen, you can set users or groups for which the selected policy will not apply , and in fact those users will have the defaults set in owa policy.
.
Policy settings are structured as Rules when the order in which they appear is important. The top law on the list is the first executed and actually takes the top priority in policy. You can add rules and change the order as needed and implement organizational policy
In this case, I added a law called test rule with the lowest priority. There is another law called Default Rule that actually defines the policy for cases that the rest of the laws have not addressed
.
For each rule you can define different criteria – who will apply (IP addresses, users/groups /end devices), and what actions are allowed to be performed (opening, saving, displaying, inability to upload mustards, etc.)
At the end of the POLICY setting, save and specify the name of the Policy (in this case, Test Policy).
Policy Deployment
On the Deployment Policy screen, we can select the policy we have defined (in this case test policy) and if an upgrade has been made to one we can choose the version of the product components
Finally, for each enterprise mail infrastructure server, we will deploy the selected version. At the end of the deploy process, you receive an information about the integrity of all system components
So how is this reflected in OWA?
In this case, I selected VIEW only for the organizational policy, so that only the bun can be viewed without the ability to save and unable to print the contents of the bun.
Clicking on the attachment (in this case a PDF file called Exchange 2016v1.3.pdf) will open a pane with the options available to the user who has set the infrastructure manager past, in this case the VIEW option only.
After clicking, the mail server on which the converted user mailbox is located (HTML rendering) and the user will be displayed in the HTML file.
Summary
Messageware’s AttachView prevents unsecured access to sensitive organisational information sent or received in the OWA by converting the attache to a secure HTML page that can be viewed from any browser. In fact, the product expands the capabilities that exist in Microsoft’s built-in WebReady Document Viewing solution from support for Office and PDF applications to support over 400 file types. The rules mechanism that exists in the product enables the definition of flexible organizational policies and is tailored to the different needs of employees and information security requirements.
SHMUEL H.