Microsoft Exchange on-premises hardening recommendations
Source Kaspersky Security Blog
Description
A holistic approach to securing Exchange servers beyond Exchange 2016 and 2019 end-of-life.
Impact
For European organizations, the compromise of Exchange on-premises servers can lead to significant operational disruption, data breaches, and regulatory non-compliance, especially under GDPR. Attackers gaining access to mailboxes can exfiltrate sensitive corporate communications, intellectual property, and personal data, potentially resulting in reputational damage and financial penalties. The ability to deploy web shells and move laterally within networks increases the risk of widespread compromise, ransomware deployment, and persistent espionage. Organizations relying on unsupported Exchange versions face heightened risk due to lack of security patches, making them attractive targets for threat actors. The complexity and accessibility of Exchange servers from external networks amplify the attack surface. Additionally, failure to implement modern authentication and secure configurations can facilitate credential theft and privilege escalation, further exacerbating the impact. Given the critical role of email infrastructure in business continuity and communication, successful attacks can disrupt essential services and cause cascading effects across supply chains and partners. The medium severity rating reflects the significant but manageable risk if appropriate mitigations are applied promptly.
Defensive guidance
1. Prioritize migration to Exchange Subscription Edition (Exchange SE) to ensure ongoing security updates; if migration is delayed, purchase Extended Security Updates (ESU) and isolate unsupported servers from internal and external networks. 2. Establish a rigorous patch management process to deploy Microsoft’s biannual Cumulative Updates and monthly security hotfixes without delay, using tools like Exchange Health Checker for verification. 3. Enable and maintain the Emergency Mitigation (EM) service on Exchange Mailbox servers to automatically apply urgent mitigation rules against active threats. 4. Deploy Endpoint Detection and Response (EDR) and Endpoint Protection Platform (EPP) solutions on Exchange servers to detect exploitation attempts and prevent web shell creation; enable Application Allowlisting via AppLocker or equivalent. 5. Restrict administrative access to Exchange Admin Center and PowerShell remoting to a limited set of privileged access workstations enforced by firewall rules; disable remote PowerShell where possible and ensure PowerShell stream signing is enabled. 6. Audit and migrate away from legacy authentication protocols (NTLMv1/v2, SMBv1) to Kerberos and implement Modern Authentication (OAuth 2.0 with MFA and ADFS); disable Basic authentication once migration is complete. 7. Enable Extended Protection (EP) to defend against NTLM relay and man-in-the-middle attacks by enforcing Channel Binding Tokens and uniform TLS versions (1.2 or 1.3). 8. Configure HTTP Strict Transport Security (HSTS) to enforce TLS usage for all Outlook on the web (OWA) and Exchange Admin Center connections. 9. Implement Role-Based Access Control (RBAC) to separate Exchange administrative privileges from Active Directory domain admin rights, minimizing privilege escalation risks. 10. Protect mail headers against forgery by ensuring Microsoft’s enhanced detection rules remain enabled and forward suspicious emails for expert analysis. 11. Use specialized mail security solutions to enforce SPF, DKIM, and DMARC protocols and filter spam and phishing attempts effectively. 12. Regularly review and update security baselines according to CIS Benchmarks and Microsoft guidance tailored to the Exchange version in use.