RE: Security and Implications of Hosted Exchange

By and large, hosted Exchange solutions make use of Outlook via RPC over
HTTPS.  VPN solutions (either hardware or software) preclude quick and
easy deployments.

You must be running at least a particular patch level of Outlook 2003
(or greater) in order to use it, and a copy is typically included in the
service by the provider.

I would research RPC over HTTPs with respect to Outlook in order to
decide how secure it is.

sT

-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Roland Dobbins
Sent: Friday, November 16, 2007 9:35 AM
To: focus-ms@securityfocus.com
Subject: Re: Security and Implications of Hosted Exchange


On Nov 15, 2007, at 11:11 AM, Dan Denton wrote:

> But, having the features of
> Exchange without having to backup/restore the system or worry about  
> patches
> and fixes is pretty attractive.

I'm sure at least some of the folks who offer hosted Exchange would  
also offer a VPN service whereby the Exchange server wouldn't be  
exposed to the general Internet (or to other servers for other  
customers), but would be isolated with all appropriate network, host  
OS, and application BCPs, and accessible only via a VPN of some sort.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins@cisco.com> // 408.527.6376 voice

        Culture eats strategy for breakfast.

            -- Ford Motor Company