The Exchange Online security controls organizations keep getting wrong
Overview
In a recent interview, Scott Schnoll, a Microsoft MVP for Exchange, discussed common mistakes organizations make regarding security controls in Exchange Online. He emphasized the importance of understanding the Shared Responsibility Model, where Microsoft manages cloud security while organizations are responsible for their data and configurations. Schnoll pointed out that legacy protocols like SMTP AUTH often remain enabled due to dependencies on older systems, which can create vulnerabilities. He also identified critical controls that are frequently overlooked, such as Conditional Access and Privileged Identity Management (PIM), and noted the gaps in audit logs that can hinder effective monitoring. Organizations need to take immediate action to adjust default settings and implement better security practices to protect their environments.
Key Takeaways
- Affected Systems: Exchange Online, Microsoft 365, SMTP AUTH, Conditional Access, Privileged Identity Management
- Action Required: Organizations should change default settings, disable legacy protocols like SMTP AUTH where possible, and implement Conditional Access and PIM.
- Timeline: Newly disclosed
Original Article Summary
In this Help Net Security interview, Scott Schnoll, Microsoft MVP for Exchange, breaks down the Shared Responsibility Model, where Microsoft secures the cloud while organizations must protect their own data, identities, and configurations. The discussion covers default settings worth changing tomorrow, including legacy protocols like SMTP AUTH that survive due to printer, scanner, and ERP dependencies. Schnoll highlights overlooked controls such as Conditional Access, PIM, and continuous monitoring, plus blind spots in audit logs around … More → The post The Exchange Online security controls organizations keep getting wrong appeared first on Help Net Security.
Impact
Exchange Online, Microsoft 365, SMTP AUTH, Conditional Access, Privileged Identity Management
Exploitation Status
No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.
Timeline
Newly disclosed
Remediation
Organizations should change default settings, disable legacy protocols like SMTP AUTH where possible, and implement Conditional Access and PIM. Continuous monitoring of audit logs is also recommended.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Microsoft, Critical.