SessionGuard for Outlook Web Access

Stop unauthorized Exchange access via OWA!!

Product Overview

OWA has some security issues that should worry Exchange Administrators:  First, an OWA user’s cached credentials can easily be used to gain unauthorized access to Exchange; and second, because an OWA session does not time out if the user forgets to logout and close the browser window, an intruder can gain access to Exchange simply by browsing to the open OWA session.  

Most organizations know to use SSL to encrypt data transferred to and from the OWA client and the Exchange server, thus making it impossible to snoop the contents of a user’s email. What most organizations do not know, however, is SSL will not prevent an intruder from gaining access to Exchange via an OWA session, even if SSL is used in conjunction with other security products such as a firewall. This is because OWA relies on the Web browser for credentials, which are cached.  

SessionGuard for Outlook Web Access goes beyond SSL security and prevents intruders from pirating an OWA session to gain unauthorized access to a user's Exchange mail, calendar, and address books (where many passwords tend to be stored)

Even if a user utilizes the OWA logoff button, unauthorized access is easily accomplished as a user's authentication credentials are still cached. SessionGuard's robust authentication monitoring technology goes beyond SSL security and ensures that a user's cached credentials can not be reused. In addition, SessionGuard provides an administrator with the ability to define session time-outs for those instances when a user forgets to exit OWA and close all browser instances.