Microsoft Outlook Web
Access (OWA) is a
useful tool for giving
remote or mobile users access
to their Outlook mailboxes.
Although OWA lacks some of
Outlook's features, the overall
user experience is similar to
that of Outlook and is a reasonable alternative. However, some
of the functionality that makes
OWA useful and convenient
also raises some security concerns—among them fears
about attachment safety, either
from sensitive information getting into the wrong hands or
from malicious content that can
harm a user's PC or the network. But rather than deny
users the ability to use OWA to
remotely access their mailboxes, you can take some steps
to help secure OWA attachments and reduce the security
risks involved. You can also plan
ahead to take advantage of
some new attachment-control
features that Microsoft has
included in Exchange Server
2007.
OWA Attachment Handling
When an OWA user receives an
email message containing an
attachment, the user can perform one of three actions:
- From within the browser, the
user can right-click and save
the attachment. This behavior is purely a function of the
browser and has nothing to
do with OWA.
- From within the browser, the
user clicks the attachment
link, and the browser displays a dialog box that asks
whether the user wants to
save or open the file. If he or
she chooses to save it, the
browser saves the file—again
without OWA being involved.
- The user chooses to open the
document, in which case,
OWA sends an HTTP header
to the browser indicating
that the document expired
the previous day. This causes
the browser to not cache the
document, although it might
write the document to a temporary file area on the hard
disk.
Note that in the first two cases,
OWA has no control over what
happens to the file. If the user
chooses to save the file, the
browser will simply ignore the
"don't cache this" header. Even
if you manually add the Cache-control: no-cache header to the
Exchange virtual directory,
users will still be able to save
attachments. To amend this behavior, you can take advantage of OWA 2003's attachment-control
features to prevent users from being
able to open the attachments. To be
specific, with OWA you can . . .
Register
