Anti virus for OWA
Ewan ...
One interesting question that came up today was how to protect an Outlook Web Access system from having viruses introduced. The scenario might be that a remote user sends an email using OWA from a PC, and submits a virus-infected attachment into OWA. If the remote PC doesn't have reliable anti-virus software, there's a risk that an infected attachment could be introduced into the Exchange store.
An obvious solution would be to run store AV scanning, which would mean that anything which was submitted to the back end server (which is ultimately responsible for rendering OWA anyway) would get checked for viruses. If you don't run AV on the backend server, there may be 3rd party options that can scan the attachments during upload (ie some firewalls can do in-line attachment AV scanning etc).
OWA 2003 gives you the option of restricting which attachment types can be viewed at the client (so that executable attachments can't be inadvertantly downloaded) and you can also restrict that external clients - ie PCs connecting from outside your network, through a front end server - can't download or upload attachments, whereas internal clients (which connect over the internal network) can continue to use attachments in OWA.
We'd be interested to hear if you have implemented OWA with access over the internet, and don't use back-end virus scanning - how do you protect against infection spreading through attachment uploads?
-- Ewan
