Microsoft is warning customers that “attackers looking to exploit unpatched Exchange servers are not going to go away” and exhorting them to apply the most recent Cumulative Update and Security Update for Exchange server. The post also notes that users should “occasionally perform manual tasks to harden the environment, such as enabling Extended Protection and enabling certificate signing of PowerShell serialization payloads.”
Note
- As recent breaches have shown, mitigations are just buying you (a little bit) of time. Patch early, patch often is your best bet if you insist on running Exchange on premise.
- One reason “attackers looking to exploit unpatched Exchange servers are not going to go away” is that there is a never ended stream of serious vulnerabilities in Microsoft Exchange software! For some enterprises, switching to Google Workspace or Zoho might be feasible, but for many who just can’t keep up with patching demands, moving to cloud-based or hosted/managed Exchange is way better than doing nothing.
- Yes, this threat isn’t going away. Make sure that you are doing three things: First, patch your exchange servers rigorously, whether or not they are Internet accessible. Second, make sure they are hardened to the current guidelines. Require justification for settings which differ. Third, make sure that you are actively hunting for IOCs relating to exploitation. You know I’m going to say this: move to hosted email, if not MS 365, another solution allowing you to focus more on the security of mission specific systems.
- Microsoft’s advice focuses on three critical security controls: data protection [know where your sensitive data resides], secure configuration [harden the operating system to a known standard], and vulnerability management [scan and patch vulnerable systems]. Each of these controls is core to an effective cyber defense program. Be warned, it costs the adversary very little in time and money to target vulnerable servers.
Read more in: Protect Your Exchange Servers
Alex Lim
Alex Lim is a certified IT Technical Support Architect with over 15 years of experience in designing, implementing, and troubleshooting complex IT systems and networks. He has worked for leading IT companies, such as Microsoft, IBM, and Cisco, providing technical support and solutions to clients across various industries and sectors. Alex has a bachelor’s degree in computer science from the National University of Singapore and a master’s degree in information security from the Massachusetts Institute of Technology. He is also the author of several best-selling books on IT technical support, such as The IT Technical Support Handbook and Troubleshooting IT Systems and Networks. Alex lives in Bandar, Johore, Malaysia with his wife and two chilrdren. You can reach him at [email protected] or follow him on Website | Twitter | Facebook
