Agencies release guidance on Microsoft Exchange server best practices

The National Security Agency, Cybersecurity and Infrastructure Security Agency and international partners released joint guidance Oct. 30 on best practices for Microsoft Exchange server security. The guidance includes recommendations and prevention measures specifically for on-premises Exchange servers to help mitigate risk of being compromised. The agencies said that Microsoft Exchange Server Subscription Edition is the only supported on-prem version of the product, as Microsoft ended support for previous versions Oct. 14. Older versions are now at a heightened risk of compromise, and the guidance recommended users migrate to Exchange Server SE or an alternative supported email server software or service. "Previous versions of Exchange have been deprecated," said Scott Gee, AHA deputy national advisor for cybersecurity and risk. "Hospitals still using these versions of Exchange should pay particular attention to this bulletin and closely monitor security settings in your environment." For more information on this or other cyber and risk issues, contact Gee at [email protected]. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.