CISA just published crucial new guidance on keeping Microsoft Exchange servers secure
The agencies have warned of persistent threats, saying Microsoft Exchange environments are continuously targeted for compromise
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
The US Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA) have issued advice on how to harden on-premises Microsoft Exchange Server instances.
The advisory comes amidst a surge in attacks against Exchange Server in recent months, according to Nick Andersen, executive assistant director for the Cybersecurity Division (CSD) at CISA.
“With the threat to Exchange servers remaining persistent, enforcing a prevention posture and adhering to these best practices is crucial for safeguarding our critical communication systems," Andersen said.
"This guidance empowers organizations to proactively mitigate threats, protect enterprise assets, and ensure the resilience of their operations.”
Anderson added that CISA recommends organizations also “evaluate the use of cloud-based email services” rather than “managing the complexities” of hosting their own.
Shoring up Microsoft Exchange Server
So what does the advisory recommend? First and foremost, organisations should restrict administrative access, implement multi-factor authentication, enforce strict transport security configurations, and adopt zero trust security model principles.
On top of this, as certain Exchange Server versions have recently become end-of-life (EOL), they strongly encourage organizations to take proactive steps to mitigate risks and prevent malicious activity.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Attackers frequently target these servers, which usually receive less monitoring and security updates than cloud-based alternatives.
Organizations should decommission any remaining end-of-life on-prem or hybrid Exchange servers after transitioning to cloud-based Microsoft 365, the duo said.
Stay up to date with patching
The most effective defense against exploitation, according to the NSA, is ensuring that all Exchange servers are running the latest version and Cumulative Update (CU).
Organizations that are running an unsupported version of Exchange should migrate to Exchange Server SE or an alternative supported email server software or service.
Elsewhere, ensuring that Emergency Mitigation Service remains enabled is vital, and enterprises are also advised to apply and maintain the Exchange Server baseline, Windows security baselines, and applicable mail client security baselines.
As far as administrative access is concerned, this should remain limited, according to CISA, while authentication and encryption should be hardened by configuring Transport Layer Security and Extended Protection.
Similarly, instead of NT LAN Manager (NTLM), Kerberos and Server Message Block (SMB) should be configured; Modern Authentication and multi-factor authentication should be used, along with certificate-based signing of PowerShell serialization, HTTP Strict Transport Security (HSTS), and Download Domains.
Exchange server flaws are heavily targeted
The publication of the guide follows a warning from CISA in August about a high-severity post-authentication vulnerability in Exchange Server.
Tracked as CVE-2025-53786, the vulnerability allowed an attacker to move laterally from on-premises Exchange to the M365 cloud environment.
CISA said that while exploitation of this flaw would require highly specific circumstances, it still represents a serious concern.
"Although exploitation of this vulnerability is only possible after an attacker establishes administrative access on the on-premises Exchange server, CISA is deeply concerned at the ease with which a threat actor could escalate privileges and gain significant control of a victim’s M365 Exchange Online environment," it said.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
New UK schemes aim to boost number of women in tech – and keep them in the sectorNews The initiative includes work placements and plans to help women return to the workforce after time away
-
Global demand for this one AI role has skyrocketed 283% in the last year aloneNews AI trainers are now among the most sought-after specialists around the world
-
Is your new hire an AI clone? Microsoft says North Korean hackers are using AI to impersonate job seekers and steal company secretsNews The groups are increasingly using face-changing or voice-changing software to make their fake identities more plausible
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
