Quarantine Access is something you usually switch on when configuring your IP interfaces - AFAIK there is no default access to it, since the Anti-Spam Quarantine is disabled at first start until you enable it.
Other then that it's the rest of your network environment that allows or rejects the access to the Quarantine Web Services really, like firewall, NAT, etc.
In our case we enabled it for https access, but only for the internal network or users coming through a SSL VPN. Anything else and without some hardened authentication method (OTP, Token, whatever) just leaves too much room for tempering with the access page for my taste.
Example: You open up your Quarantine for https access from the Internet and use LDAP authentication. Now what happens to internal user accounts if people start running "brute force" methods to get in? Usually accounts are locked after a number of failed login attempts and that could stop internal users from even being able to log in.
No, I wouldn't want something like that to happen. ;)
Torsten
