Hardening On-Premise Exchange in the Remote Work Era

In the current era of remote and hybrid workforces, the security of on-premise Exchange servers has never been more vital. Ensuring the integrity of your organization’s sensitive information and safeguarding against cyber threats requires a proactive approach to hardening your Exchange infrastructure.

Although Microsoft provides detailed guidance on addressing vulnerabilities through patching, certain widely utilized features in organizational settings may lack specific protective measures. To bridge this gap, we present a curated selection of technologies integral to on-premise Exchange, accompanied by strategic policies for maximizing security.

Key among these technologies are Two-Factor Authentication (2FA) and Outlook Web Access (OWA), each playing a critical role in fortifying your Exchange setup. Below, we delve into the significance of these technologies and outline policies for securing your systems effectively.

Two-Factor Authentication (2FA)

2FA significantly bolsters security by introducing an additional authentication step beyond just the password. The market offers various 2FA solutions, each with distinct capabilities and implementation requirements. Selecting an appropriate 2FA provider hinges on your organization’s specific needs, but here are several key factors to consider:

• Management of device trust
• Insights into device health
• Visibility over device security
• Distinction between corporate and personal (BYOD) devices
• Compatibility with applications

For instance, Cisco DUO, a renowned 2FA provider, facilitates a range of configurable policies. These include enabling user self-enrollment, geographically restricting access, and assessing device health before authentication. Optimal security practices involve selecting suitable authentication methods, denying access from compromised devices, and enforcing full disk encryption.

Outlook Web Access (OWA)

OWA offers web-based access to Exchange Server mailboxes, enhancing accessibility. However, its default six-hour timeout period poses a security concern, especially when 2FA is in place but not prompted for re-authentication within this duration. Given the lack of a clear definition of inactivity from Microsoft, this default setting may introduce vulnerabilities.

To adjust the OWA timeout period, consider the following PowerShell commands:

• Launch Exchange Management Shell.
• Check the current setting with: Get-OrganizationConfig | fl ActivityBasedAuthenticationTimeout*
• To modify the timeout interval to one hour, execute: Set-OrganizationConfig -ActivityBasedAuthenticationTimeoutInterval 01:00:00. It’s advisable to avoid reducing the timeout to less than five minutes, per Microsoft’s guidance.

In summary, the necessity of hardening on-premise Exchange environments has escalated in the landscape of remote and hybrid work. Implementing robust 2FA measures and configuring OWA with security-focused policies are pivotal steps in protecting your organization’s data and ensuring secure access for all users.