Redazione RHC : 31 October 2025 07:40
A rapid response to the increasing threats against email infrastructure was provided by the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the National Security Agency (NSA), the Australian Cyber Security Centre (ACSC) and the Canadian Centre for Cyber Security .
The document, titled ” Microsoft Exchange Server Security Best Practices ,” emphasizes proactive hardening measures in the event of persistent attacks on these critical systems, which handle sensitive business communications.
It is essential to prioritize thorough maintenance of security updates and patches to adopt a prevention-first approach, as highlighted in the guide that emphasizes the importance of this strategy.
A few weeks after Microsoft announced its planned end of support for older versions of Exchange on October 14, 2025, this document was developed to help mitigate the risks posed to environments that have not been updated.
Administrators are advised to install security patches and hotfixes on a monthly basis as well as cumulative updates (CUs) every two years to curb the rapid creation of exploits by threat actors.
This is because, as recent zero-day exploits have shown, it is critical for organizations operating in critical industries to implement such measures to prevent security breaches.
Tools such as Exchange Health Checker and Microsoft’s SetupAssist are recommended to verify readiness and facilitate updates, reducing exposure to vulnerabilities over time.
For end-of-life (EOL) servers, immediate migration to Exchange Server Subscription Edition (SE), the only supported on-premises version, is critical , with temporary isolation from the Internet recommended if full upgrades are delayed.
It’s also crucial to ensure that the Exchange Emergency Mitigation (EM) service remains enabled, as it implements automatic protections such as URL rewriting rules against malicious HTTP requests. You should also plan to migrate from the deprecated NTLM protocols to Kerberos and SMB, as well as review legacy usage and prepare for the phaseout of NTLM.
In addition to patching, the guidelines promote the application of established security guidelines from providers such as DISA, CIS, and Microsoft to standardize configurations across Exchange, Windows, and email clients.
Endpoint Detection and Response (EDR) tools are highlighted for advanced threat protection, while Exchange anti-spam and anti-malware capabilities should be enabled to filter out malicious emails.
To improve email authentication, organizations must manually implement DMARC, SPF, and DKIM standards, potentially through add-ons or third-party gateways.
Implementing strong multi-factor authentication (MFA) through Active Directory Federation Services, combined with certificate-based signing, replaces the previous, vulnerable Basic Authentication, thus ensuring PowerShell serialization protection.
Redazione