Exchange must use encryption for Outlook Web App (OWA) access.

From Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide

Associated with: CCI-000068

SV-95431r1_rule Exchange must use encryption for Outlook Web App (OWA) access.

Vulnerability discussion

This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server.The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including Common Access Card (CAC)-enabled pre-authentication through an application firewall proxy.Failure to require secure connections on a website increases the potential for unintended eavesdropping or data loss.

Check content

Open a Windows PowerShell and enter the following command: Get-OwaVirtualDirectory | select internalurl, externalurl If the value returned is not https://, this is a finding.

Fix text

Configure the OWA site to require SSL port 443.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.