{"id":3948,"date":"2023-01-27T03:00:09","date_gmt":"2023-01-27T03:00:09","guid":{"rendered":"https:\/\/www.sebae.net\/blog\/protect-your-exchange-servers\/"},"modified":"2023-01-27T03:00:09","modified_gmt":"2023-01-27T03:00:09","slug":"protect-your-exchange-servers","status":"publish","type":"post","link":"https:\/\/www.sebae.net\/blog\/protect-your-exchange-servers\/","title":{"rendered":"Protect Your Exchange Servers"},"content":{"rendered":"
\n

We\u2019ve said it before, we\u2019re saying it now, and we\u2019ll keeping saying it: it is critical to keep your Exchange servers updated<\/a>. This means installing the latest available Cumulative Update (CU) and Security Update (SU) on all your Exchange servers (and in some cases, your Exchange Management Tools workstations), and occasionally performing manual tasks to harden the environment, such as enabling Extended Protection<\/a> and enabling certificate signing of PowerShell serialization payloads<\/a>.<\/p>\n

Attackers looking to exploit unpatched Exchange servers are not going to go away. There are too many aspects of unpatched on-premises Exchange environments that are valuable to bad actors looking to exfiltrate data or commit other malicious acts. First, user mailboxes often contain critical and sensitive data. Second, every Exchange server contains a copy of the company address book, which provides a lot of information that is useful for social engineering attacks, including organizational structure, titles, contact info, and more. And third, Exchange has deep hooks into and permissions within Active Directory, and in a hybrid environment, access to the connected cloud environment.<\/p>\n

To defend your Exchange servers against attacks that exploit known vulnerabilities, you must<\/em> install the latest supported CU (as of this writing, CU12 for Exchange Server 2019<\/a>, CU23 for Exchange Server 2016<\/a>, and CU23 for Exchange Server 2013<\/a>) and the latest SU (as of this writing, the January 2023 SU<\/a>). Exchange Server CUs and SUs are cumulative, so you only need to install the latest available one. You install the latest CU, then see if any SUs were released after the CU was released. If so, install the most recent (latest) SU.<\/p>\n

After installing an update, there may be manual tasks that an admin needs to perform, so always<\/strong> run Health Checker<\/a> after installing an update to check for such tasks. Health Checker provides you with links to articles that provide step-by-step guidance.<\/p>\n

Prior to releasing an SU, we may release a mitigation for a known vulnerability that can be applied to servers automatically by the Exchange Emergency Mitigation Service<\/a> or manually using the Exchange On-Premises Mitigation Tool<\/a>. As previously stated, mitigations are designed to provide temporary protection<\/em> until an SU is available and can be installed. In some cases, mitigations can become insufficient to protect against all variations of an attack. Thus, installation of an applicable SU is the only way to protect your servers.<\/p>\n

Updating your Exchange servers is straightforward:<\/p>\n