CISA and National Security Agency Publish New Best Practices for On-Premises Microsoft Exchange Server Security
The Cybersecurity and Infrastructure Security Agency (CISA), alongside the National Security Agency (NSA) and international partners, released a new best-practices guide aimed at hardening on-premises Microsoft Exchange Server installations amid sustained threat activity.
Key recommendations include a focus on securing network encryption, tighter user access and authentication processes and reducing application attack surfaces. CISA also suggests decommissioning any hybrid exchange servers post the transition to Microsoft 365 to reduce exploitation activities.
The agency stressed that merely installing updates is not sufficient — organizations must audit, reconfigure, and decommission insecure environments as part of a broader zero-trust posture. A full guide on Exchange Server Best Practices can be viewed here.
Posted by Redmondmag.com Editors on 10/31/2025