|
Greetings! Welcome to Vol. 7, No. 16, 23 Jan 2003, of Exchange Messaging
Outlook, a biweekly newsletter about Microsoft Exchange and
Microsoft Outlook.
Today's highlights:
- New security-related update for Outlook 2002
- Security settings folder = minimal impact
- Microsoft CRM released
- Defense Messaging System 3.0
- More holiday tools
Regular features:
- New utilities
- Updated utilities
- Other new resources
New security-related update for Outlook 2002
Microsoft has issued a public update for Outlook 2002 resolving a
problem with Exchange clients that could allow information in
encrypted HTML-format messages to leak out. Microsoft Security
Bulletin MS03-003 (http://www.microsoft.com/technet/security/bulletin/MS03-003.asp),
Flaw in How Outlook 2002 Handles V1 Exchange Server Security
Certificates Could Lead to Information Disclosure, provides details
on the problem. The vulnerability does not affect mail encrypted
with S/MIME certificates or non-Exchange clients.
The update does contain other minor fixes, however. Details on
the fixes and on download locations are available in a Microsoft
Knowledgebase (MSKB) article at
http://support.microsoft.com/?kbid=812262. The client update
requires Office XP Service Pack 2. The administrative update can be
installed over SP1 or SP2. For end users, the best update procedure
is the use the Office Updates scanner at
http://office.microsoft.com/ProductUpdates/mainCatalog.aspx to
see which updates fit your system.
Security settings folder = minimal
impact
At long last, Microsoft has released some quantitative
information on the performance impact of implementing the Outlook
Security Settings folder to control attachment blocking, loosen or
tighten security for the "object model guard," and, in Outlook 2002,
trust specific Outlook COM addins. When the Outlook Email Security
Update was initially released two and a half years ago, Microsoft
warned that it was not scalable and, as a result, many
administrators were probably hesitant to deploy it. Or, they avoided
the Email Security Update altogether.
The good news is that checking the security folder when Outlook
starts adds only a few remote procedure calls (RPCs) to the startup
sequence -- 16 RPCs in addition to the usual 20 or so. The MSKB
article at
http://support.microsoft.com/?kbid=811968, Performance
Implications of Outlook Security Settings in the Public Folder,
explains that those extra RPCs occur only one time, as Outlook
starts, and have no appreciable effect on the performance of either
the client or the Exchange server.
The bottom line, therefore, is that the security settings folder
is probably more scalable than Microsoft originally thought. In
large organizations, no doubt you’ll want to replicate the folder to
several public folder servers. Given that changes to the security
settings should be rare, the replication traffic should also be
minimal.
Microsoft CRM released
Microsoft released Microsoft CRM (formal name = Microsoft
Business Solutions Customer Relationship Management) to
manufacturing this week, a bit later than the original December 2002
target date. The sales module has some Outlook integration. The
service module is web-only. More information is available at
http://www.microsoft.com/crm.
This week's release is the U.S. version. An international version
is expected in the second half of this year.
I like the way Microsoft describes MS CRM as a ".NET-connected"
application. That's one of the most precise uses of the .NET term
that I've seen, and it’s appropriate in this case, because MS CRM is
not .NET through and through. The data store is SQL Server 2000,
while Active Directory holds security information. The basic CRM
platform that controls the business logic is written with C++ and
provides a web services interface. The application layer uses
ASP.NET and, for the sales module, Outlook. Custom applications that
interact with Microsoft CRM use XML and SOAP to communicate with the
web services in the business logic layer. Developers can get the SDK
from
http://msdn.microsoft.com/library/en-us/CrmSdk/htm/default.asp.
Defense Messaging System 3.0
A security-enhanced version of Outlook is being deployed at U.S.
Department of Defense (DoD) sites worldwide as part of Defense
Messaging System 3.0, which also includes Exchange Server.
Deployment began last July and is slated for completion in March.
The DMS version of Outlook incorporates security technology from
SPYRUS for encryption and authentication. DMS is replacing dozens of
different mail systems used at DoD.
More holiday tools
I’ve updated my holidays transmittal form to add support for the
Location field, make it work better in non-English environments, and
let the user set a category on all the added items. I have one more
tweak to make and a readme to write, but if you'd like to try it,
feel free to download it from
http://www.slipstick.com/files/events.zip. Send feedback to
webmaster04@slipstick.com.
Also, the New Utilities section below includes a tool that allows
you to select public holidays from many countries and add them to
Outlook.
Finally, Microsoft apparently has published yet another update
for the Outlook.txt holidays file. The latest version, dated Jan.
21, 2003, is available from
http://office.microsoft.com/downloads/2000/OutlHol.aspx and
apparently fixes various errors.
|