Microsoft is warning customers that “attackers looking to exploit unpatched Exchange servers are not going to go away” and exhorting them to apply the most recent Cumulative Update and Security Update for Exchange server. The post also notes that users should “occasionally perform manual tasks to harden the environment, such as enabling Extended Protection and enabling certificate signing of PowerShell serialization payloads.”
Note
- As recent breaches have shown, mitigations are just buying you (a little bit) of time. Patch early, patch often is your best bet if you insist on running Exchange on premise.
- One reason “attackers looking to exploit unpatched Exchange servers are not going to go away” is that there is a never ended stream of serious vulnerabilities in Microsoft Exchange software! For some enterprises, switching to Google Workspace or Zoho might be feasible, but for many who just can’t keep up with patching demands, moving to cloud-based or hosted/managed Exchange is way better than doing nothing.
- Yes, this threat isn’t going away. Make sure that you are doing three things: First, patch your exchange servers rigorously, whether or not they are Internet accessible. Second, make sure they are hardened to the current guidelines. Require justification for settings which differ. Third, make sure that you are actively hunting for IOCs relating to exploitation. You know I’m going to say this: move to hosted email, if not MS 365, another solution allowing you to focus more on the security of mission specific systems.
- Microsoft’s advice focuses on three critical security controls: data protection [know where your sensitive data resides], secure configuration [harden the operating system to a known standard], and vulnerability management [scan and patch vulnerable systems]. Each of these controls is core to an effective cyber defense program. Be warned, it costs the adversary very little in time and money to target vulnerable servers.
Read more in: Protect Your Exchange Servers
