+APP.5.2 Microsoft Exchange and Outlook
---+APP.5.2.G1. Insufficient Rules for Exchange and Outlook
---+APP.5.2.G2. Incorrect Migration of Exchange
---+APP.5.2.G3. Inadmissible Browser Access to Exchange
---+APP.5.2.G4. Unauthorised Connection of Other Systems to Exchange
---+APP.5.2.G5. Improper Administration of Site and Data Access Rights in Exchange and Outlook
---+APP.5.2.G6. Incorrect Configuration of Exchange
---+APP.5.2.G7. Improper Configuration of Outlook
---+APP.5.2.G8. Malfunction and Misuse of In-House Macros and Programming Interfaces in Outlook
---+APP.5.2.A1 Planning the Use of Exchange and Outlook (B)
---+APP.5.2.A2 Selecting an Exchange Infrastructure (B)
---+APP.5.2.A3 Access Management and Access Rights (B)
---+APP.5.2.A5 Backing Up Exchange (B)
---+APP.5.2.A7 Migration of Exchange Systems (S)
---+APP.5.2.A9 Secure Configuration of Exchange Servers (S)
---+APP.5.2.A10 Secure Configuration of Outlook (S)
---+APP.5.2.A11 Protection of Communications Between Exchange Systems (S)
---+APP.5.2.A12 Using Outlook Anywhere, MAPI over HTTP, and Outlook on the Web (S)
---+APP.5.2.A17 Encryption of Exchange Database Files (H)

APP.5.2 Microsoft Exchange and Outlook

Introduction

Microsoft Exchange Server (hereinafter “Exchange”) is a groupware solution for medium-sized to large organisations. It can be used to electronically transmit messages and is equipped with additional services for supporting workflows. Exchange can be used to centrally manage, deliver, filter, and send messages such as e-mails. It also provides and manages typical groupware applications such as notes, contact lists, calendars, and task lists. In addition to the server service itself, client software or a web browser is necessary in order to use the functions of Exchange.

Microsoft Outlook (hereinafter “Outlook”) is a client for Exchange that is made directly available by installing the Office package from Microsoft or by integrating it into the operating systems of mobile devices. Furthermore, the “Outlook on the web” application (previously the “Outlook Web App”) makes it possible to access e-mails, contacts, the calendar, and more via a browser. This function is already included in Exchange.

The combination of Exchange servers and Outlook clients is referred to in this module as the Exchange system.

Objective

The objective of this module is to provide information on typical threats to Exchange and Outlook and show how Exchange and Outlook can be used securely in organisations.

Scoping and Modelling

The module must be applied for all Exchange systems in the information domain under consideration.

General requirements for the security of e-mail systems are included in module APP.5.3 General E-Mail Clients and Servers. This module must also be applied to any e-mail system based on Exchange or Outlook.

It includes specific threats and requirements regarding Exchange systems. Specific requirements for server platforms and operating systems are not part of this module. These can be found in the modules SYS.1.1 General Server and SYS.2.1 General Client, as well as in the respective operating-system-specific modules.

Useful Resources

Microsoft provides comprehensive information on the administration of Microsoft Exchange on the website “Microsoft Technet” (https://technet.microsoft.com/de-de).

1. Übersicht

APP.5.2.A1 Planning the Use of Exchange and Outlook (B)

Before implementing Exchange and Outlook, an organisation MUST plan their use carefully. It MUST consider at least the following points:

  • design of the e-mail infrastructure
  • clients and/or server systems to be connected
  • use of functional extensions
  • the protocols to be used
APP.5.2.A2 Selecting an Exchange Infrastructure (B)

Based on the planning of the deployment of Exchange, the IT Operation Department MUST decide on the systems, application components, and hierarchical gradation with which the Exchange infrastructure will be realised. When selecting an infrastructure, it MUST also be decided whether the systems are to be operated in the cloud or as a local service.
APP.5.2.A3 Access Management and Access Rights (B)

In addition to its general access control policy, an organisation MUST create, adequately document, and apply an access control policy for the systems in its Exchange infrastructure.

The IT Operation Department MUST use server-side user profiles for computer-independent user access to Exchange data. It MUST adapt the default NTFS authorisations for the Exchange directory so that only authorised administrators and system accounts are allowed to access the data in this directory.
APP.5.2.A5 Backing Up Exchange (B)

Exchange servers MUST be backed up prior to any installations and configuration changes, as well as at cyclical intervals. In particular, the Exchange server databases MUST be backed up.

Deleted Exchange objects SHOULD only be removed from the database after some time.
APP.5.2.A7 Migration of Exchange Systems (S)

The IT Operation Department SHOULD thoroughly plan and document all migration steps. The IT Operation Department SHOULD consider mailboxes, objects, security policies, Active Directory concepts, and connections to other e-mail systems. It SHOULD also take into account the functional differences between different versions of Exchange. The new system SHOULD be tested in a separate testing network prior to being installed.
APP.5.2.A9 Secure Configuration of Exchange Servers (S)

The IT Operation Department SHOULD install and configure Exchange servers as specified in the respective organisation's security policy. Connectors SHOULD be configured securely. The IT Operation Department SHOULD enable logging of the Exchange system. A corresponding concept SHOULD be created for existing user-specific customisations.

When using functional extensions, it SHOULD be ensured that the requirements defined to maintain confidentiality, integrity, and availability are still being met.
APP.5.2.A10 Secure Configuration of Outlook (S)

The IT Operation Department SHOULD create a separate Outlook profile with user-specific settings for each user.

The IT Operation Department SHOULD configure Outlook so that only necessary information is transmitted to other users. The IT Operation Department SHOULD inform users regarding information that is automatically transmitted to other users. Read receipts and information that offers insights into the internal structure of the organisation at hand SHOULD NOT be transmitted to external users.
APP.5.2.A11 Protection of Communications Between Exchange Systems (S)

The IT Operation Department SHOULD decide on the protection mechanisms that are to be used to secure communications between Exchange systems in a comprehensible way. In particular, the IT Operation Department SHOULD determine how communication to the following interfaces is secured:

  • administration interfaces
  • client-server communications
  • existing interfaces for web-based distributed authoring and versioning (WebDAV)
  • server-to-server communication
  • public key infrastructure on which Outlook's e-mail encryption is based
APP.5.2.A12 Using Outlook Anywhere, MAPI over HTTP, and Outlook on the Web (S)

The IT Operation Department SHOULD configure Outlook Anywhere, MAPI over HTTP, and Outlook on the Web in line with its organisation’s security requirements. Access to Exchange through the Internet SHOULD be restricted to the necessary users.
APP.5.2.A17 Encryption of Exchange Database Files (H)

The IT Operation Department SHOULD create a concept for encrypting PST and Information Store files. The organisation in question SHOULD inform users about the protection mechanisms used to encrypt PST files and how these mechanisms work. Additional aspects of local PST files that SHOULD be taken into consideration when encrypting Exchange system databases include:

  • proprietary encryption functions
  • degrees of encryption
  • mechanisms for securing the data in a PST file

mechanisms such as the Encrypting File System or Windows BitLocker drive encryption SHOULD be used to secure PST files.

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
includes APP.5.2.G1. Insufficient Rules for Exchange and Outlook
includes APP.5.2.G2. Incorrect Migration of Exchange
includes APP.5.2.G3. Inadmissible Browser Access to Exchange
includes APP.5.2.G4. Unauthorised Connection of Other Systems to Exchange
includes APP.5.2.G5. Improper Administration of Site and Data Access Rights in Exchange and Outlook
includes APP.5.2.G6. Incorrect Configuration of Exchange
includes APP.5.2.G7. Improper Configuration of Outlook
includes APP.5.2.G8. Malfunction and Misuse of In-House Macros and Programming Interfaces in Outlook