CISA Publishes New Guidance to Strengthen Microsoft Exchange Server Security

According to CISA, working alongside the National Security Agency and international cybersecurity partners, a new comprehensive security guidance has been released to harden Microsoft Exchange servers against evolving threats. The Microsoft Exchange Server Security Best Practices guide aims to help network defenders and IT administrators fortify on-premises Exchange infrastructure and guard against malicious exploitation.

The guidance emphasises three immediate pillars: implementing strong identity verification and privilege management with multi-factor authentication across all accounts accessing Exchange services; ensuring encryption for data in transit with up-to-date protocols; and minimising the application attack surface by disabling unnecessary services and closing exposed interfaces.

It also warns that retaining legacy Exchange servers during cloud migrations creates ongoing security risks, advising organisations to develop decommissioning plans for end-of-life on-premises and hybrid servers. Organisations should review the guide published by CISA for detailed, actionable recommendations to reduce cyber threat risk and improve their Exchange security posture.