{"id":6909,"date":"2021-05-24T19:12:19","date_gmt":"2021-05-24T17:12:19","guid":{"rendered":"https:\/\/tekmart.co.za\/t-blog\/?p=6909"},"modified":"2021-05-24T19:12:21","modified_gmt":"2021-05-24T17:12:21","slug":"12-microsoft-exchange-server-security-best-practices","status":"publish","type":"post","link":"https:\/\/tekmart.co.za\/t-blog\/12-microsoft-exchange-server-security-best-practices\/","title":{"rendered":"12 Microsoft Exchange Server security best practices"},"content":{"rendered":"<span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\">Reading Time-approximately:<\/span> <span class=\"rt-time\"> 4<\/span> <span class=\"rt-label rt-postfix\">minutes<\/span><\/span>\n<h2 class=\"wp-block-heading\"><strong>Exchange security has come under increased scrutiny since the recent exploitation of critical vulnerabilities. Review this list of activities to best protect your enterprise.<\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn.ttgtmedia.com\/rms\/onlineImages\/kirvan_paul.jpg\" alt=\"Paul Kirvan\"\/><\/figure>\n\n\n\n<p>By <a href=\"https:\/\/www.techtarget.com\/contributor\/Paul-Kirvan\">Paul Kirvan<\/a><\/p>\n\n\n\n<p>Microsoft Exchange Server is a widely used email server application. Many utilities, as well as supporting tools and aids, have been developed for it. Considering how important email is to any organization, maintaining a secure Exchange server is an essential activity.<\/p>\n\n\n\n<p>Zero-day vulnerabilities on Exchange Server &#8212; not Exchange Online &#8212; that were exploited by cyber attackers\u00a0starting in January 2021\u00a0have put the server&#8217;s security in the spotlight. While the remote code execution exploits can be mitigated by deploying Microsoft patches and updates, it is still critical for security teams to pay close attention to other Exchange security best practices.<\/p>\n\n\n\n<p>IT professionals should use the following 12 activities to secure and protect Exchange servers from unauthorized access, cyber attacks, viruses and malware.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1. Keep Exchange servers up to date<\/strong><\/h3>\n\n\n\n<p>Microsoft regularly releases software updates, patches\u00a0and other resources to keep Exchange servers running at peak performance. Ensure Exchange Server maintenance includes deployment and testing of updates, builds, patches, bug fixes, security updates and feature compatibility.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2. Launch specialized Microsoft Exchange security utilities<\/strong><\/h3>\n\n\n\n<p>Microsoft offers an array of tools to ensure Exchange is secure and performing normally, including the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Microsoft Exchange On-Premises Mitigation Tool.<\/strong>\u00a0Recent cyber attacks on Exchange servers\u00a0necessitated the creation\u00a0of this simple-to-use automated tool that meets the needs of users using current or out-of-support versions of on-premises Exchange Server. Downloading and running the tool mitigates the recent zero-days on any Exchange server on which it is deployed. While it is not a replacement for regular Exchange security updates, it is an expeditious way to mitigate risks to internet-connected, on-premises Exchange servers prior to patching.<\/li><li><strong>Microsoft Safety Scanner.\u00a0<\/strong>Also known as Microsoft Support Emergency Response Tool, this downloadable scanning tool finds and removes malware from Windows systems, including Exchange.<\/li><li><strong>Microsoft Defender Antivirus.<\/strong>\u00a0This Windows antimalware tool automatically mitigates the recent zero-days. It also scans the server and reverses changes made by known threats.<\/li><li><strong>Microsoft Security Configuration Wizard.<\/strong>\u00a0This tool\u00a0analyzes the OS supporting Exchange 2008 and recommends ways of enhancing security.<\/li><li><strong>Microsoft Security Compliance Toolkit.<\/strong>\u00a0This toolkit\u00a0analyzes, tests, edits and stores Microsoft-recommended security configuration baselines for Exchange Server, comparing them against other security configurations.<\/li><li><strong>Exchange Analyzer.<\/strong>\u00a0This PowerShell tool examines the current Exchange environment and compares it to Microsoft best practices to identify modifications that can be made to improve its security posture.<\/li><li><strong>Microsoft Exchange Online Protection.<\/strong>\u00a0This cloud-based filtering service protects against and removes spam, malware and viruses in emails. It is included in all Microsoft 365 installations using Exchange Online mailboxes. It can also be supported by hybrid installations using on-premises and cloud-based mailboxes.<\/li><li><strong>Microsoft Exchange antispam and antimalware.<\/strong>\u00a0These functions are supported in Exchange 2016 and 2019. Antispam protection is provided by the same built-in transport agents that were introduced in Exchange Server 2010. Antimalware protection is provided by the malware agent that was introduced in Exchange Server 2013.<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"950\" height=\"597\" src=\"https:\/\/tekmart.co.za\/t-blog\/wp-content\/uploads\/2021\/05\/Microsoft-Exchange-Server-security-best-practices.png\" alt=\"Microsoft Exchange Server security best practices\" class=\"wp-image-6910\" srcset=\"https:\/\/tekmart.co.za\/t-blog\/wp-content\/uploads\/2021\/05\/Microsoft-Exchange-Server-security-best-practices.png 950w, https:\/\/tekmart.co.za\/t-blog\/wp-content\/uploads\/2021\/05\/Microsoft-Exchange-Server-security-best-practices-300x189.png 300w, https:\/\/tekmart.co.za\/t-blog\/wp-content\/uploads\/2021\/05\/Microsoft-Exchange-Server-security-best-practices-768x483.png 768w, https:\/\/tekmart.co.za\/t-blog\/wp-content\/uploads\/2021\/05\/Microsoft-Exchange-Server-security-best-practices-800x503.png 800w, https:\/\/tekmart.co.za\/t-blog\/wp-content\/uploads\/2021\/05\/Microsoft-Exchange-Server-security-best-practices-320x202.png 320w, https:\/\/tekmart.co.za\/t-blog\/wp-content\/uploads\/2021\/05\/Microsoft-Exchange-Server-security-best-practices-700x441.png 700w\" sizes=\"(max-width: 950px) 100vw, 950px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3. Deploy firewalls<\/strong><\/h3>\n\n\n\n<p>Exchange Server can use Windows Defender Firewall with Advanced Security to facilitate the passage of Exchange traffic. Third-party firewalls designed for Exchange are also available and may include functions to address potential cybersecurity threats, such as viruses, worms,\u00a0spyware\u00a0and spam. When evaluating third-party firewalls, check their support features for the Exchange Server version used.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4. Use Exchange Server security programs<\/strong><\/h3>\n\n\n\n<p>Security companies such as Symantec and Kaspersky offer security programs for Exchange Server. Such products protect Exchange from viruses, phishing, denial-of-service attacks, malware and spam. Symantec Mail Security for Microsoft Exchange, for example, also prevents the spread of email-borne threats and enforces data loss prevention policies.<\/p>\n\n\n\n<p>Be sure to evaluate how well a\u00a0third-party product integrates with Exchange Server, as well as the frequency of malware updating. As viruses that infect email systems often originate within an organization, do not limit scanning to email entering the system from the outside. Make sure the security software scans\u00a0<em>all<\/em>\u00a0email for malware and other cyberthreats.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>5. Secure the network perimeter supporting Exchange<\/strong><\/h3>\n\n\n\n<p>Providing a secure network perimeter is an important Exchange Server security best practice. Techniques to secure perimeters include sender-recipient connection checking, content filtering and the use of reverse proxies and Simple Mail Transfer Protocol gateways. On-premises and cloud-based intrusion prevention and detection systems can also be used to scan inbound and outbound emails. Rules in such devices should include the ability to scan for malware and viruses, as well as inspect attachments.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>6. Monitor Exchange servers<\/strong><\/h3>\n\n\n\n<p>Numerous tools are available to monitor the performance of Exchange servers, both from Microsoft and third parties. They are typically configured with sensors that detect abnormal conditions. This is done by setting threshold values for various parameters and triggering alerts when those values are exceeded. Sensors can be configured to monitor Exchange mailboxes, databases, backups, email queues and other email functions. Microsoft offers Azure Monitor &#8212; and currently uses the product in its own IT operations &#8212; superseding its\u00a0System Center Operations Manager, though SCOM is still available for enterprise use.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>7. Use allowlists and blocklists<\/strong><\/h3>\n\n\n\n<p>Outlook&#8217;s allowlists and blocklists enable users to specify trusted and untrusted senders. The function works with the Exchange server, which\u00a0initiates a safelist process\u00a0that works with filtering resources to permit or deny senders listed by the user.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>8. Use certificates when dealing with external services<\/strong><\/h3>\n\n\n\n<p>An important security method is the use of\u00a0SSL certificates\u00a0for external services, such as Outlook Web Access and Outlook Anywhere. Certificates can be generated by either an internal or external certificate authority.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>9. Limit administrative access to internal users<\/strong><\/h3>\n\n\n\n<p>Remote administrative access can open the door to\u00a0potential security issues. Limit administrative access to Exchange servers to internal users only whenever possible. If remote administrative access is needed, implement\u00a0multifactor authentication\u00a0to boost security.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>10. Enable role-based access control and require strong passwords<\/strong><\/h3>\n\n\n\n<p>As part of their\u00a0access management strategy, organizations should enable role-based access control (RBAC), which configures and grants permissions based on rules surrounding employees&#8217; roles in the organization and their need to know and perform specific actions. It grants access precisely and based on the principle of least privilege, further minimizing the potential for unauthorized access. The\u00a0use of strong passwords\u00a0is an important complement to RBAC and other authentication measures.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>11. Harden the OS hosting Exchange<\/strong><\/h3>\n\n\n\n<p>Hardening the OS that hosts Exchange is another effective way to increase Exchange Server&#8217;s security posture. It can be performed manually or with a variety of OS hardening tools, such as Microsoft Attack Surface Analyzer or Bastille Linux. The process of hardening an OS includes several activities, such as configuring the OS for greater security, updating and patching it regularly, defining policies and rules to securely manage the system, and deleting unnecessary or unused applications and services.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>12. Audit mailbox activities<\/strong><\/h3>\n\n\n\n<p>Another way to identify possible security violations is to audit mailboxes supported within an Exchange server. This is performed by examining the logs of all activities performed by users on their mailboxes, as well as those of other employees and administrators who can gain access. Logs are then exported for analysis and identification of possible security breaches.<\/p>\n","protected":false},"excerpt":{"rendered":"<p><span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\">Reading Time-approximately:<\/span> <span class=\"rt-time\"> 4<\/span> <span class=\"rt-label rt-postfix\">minutes<\/span><\/span>Exchange security has come under increased scrutiny since the recent exploitation of critical vulnerabilities. Review this list of activities to best protect your enterprise. By Paul Kirvan Microsoft Exchange Server is a widely used email server application. Many utilities, as well as supporting tools and aids, have been developed for it. Considering how important email is to any organization, maintaining<\/p>\n<p><a class=\"more-link\" href=\"https:\/\/tekmart.co.za\/t-blog\/12-microsoft-exchange-server-security-best-practices\/\">Read More<\/a><\/p>\n","protected":false},"author":113,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[38,35,8,4,111,30,3,110,113],"tags":[],"class_list":["post-6909","post","type-post","status-publish","format-standard","hentry","category-best-practices-for-data-center-operations","category-data-center-facilities","category-data-center-hardware","category-datacenter-news","category-exchange-online-administration-and-implementation","category-expert-advise-and-opinion","category-industry-news-and-expert-advise","category-messaging-and-collaboration","category-sql-and-exchange-resources"],"_links":{"self":[{"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/posts\/6909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/users\/113"}],"replies":[{"embeddable":true,"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/comments?post=6909"}],"version-history":[{"count":1,"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/posts\/6909\/revisions"}],"predecessor-version":[{"id":6911,"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/posts\/6909\/revisions\/6911"}],"wp:attachment":[{"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/media?parent=6909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/categories?post=6909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tekmart.co.za\/t-blog\/wp-json\/wp\/v2\/tags?post=6909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}