UCF STIG Viewer Logo

Encryption must be used for OWA access.


Finding ID Version Rule ID IA Controls Severity
EXCH-CA-101 EXCH-CA-101 EXCH-CA-101_rule Medium
Failure to require secure connections on a web site increases the potential for unintended decryption and data loss. This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. If Outlook Web App is approved for use, secure channels and FIPS level encryption are required, as well as appropriate certificate setting. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including CAC enabled pre-authentication through an application firewall proxy, such as Microsoft ISA. Note: If OWA is not approved for use, this control is not applicable and the OWA virtual directory should be removed to eliminate the possibility of attack through this vector.
Microsoft Exchange 2010 Client Access Server Role 2012-05-31


Check Text ( C-_chk )
Open the Exchange Management Shell and enter the following command.


Review the website and verify port 443 is used for OWA access. If not, this is a finding.
Fix Text (F-_fix)
Have the IIS administrator configure the site to require SSL for OWA access.