Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have read quite a bit on the subject of securing MS Exchange - most notably the Client Access role. With the retirement of Microsoft's Threat Management Gateway many people seem to be looking for an alternative, as many people feel uncomfortable with putting their CA role in a position where it can be directly accessed from the internet.

I've done quite a bit of reading on people's opinion on securing the Client Access portion of Exchange. Some say that you absolutely MUST have a reverse proxy in place to secure it, and having the CA role (or in many SMB cases, the client access, hub transport and mailbox role exist on the same server) exposed to the internet for webmail or active sync is a major security concern. Alternatively, many will argue that Microsoft has done a good job in securing Exchange almost right out of the box, and that a reverse proxy is not necessary for secure functions. The very fact that Microsoft did not issue a successor to the popular TMG almost lends credence to this theory.

I'm curious as to what security minded people on this site think about the subject.

share|improve this question

closed as primarily opinion-based by Adi, TildalWave, Scott Pack, NULLZ, Terry Chia Oct 25 '13 at 7:06

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

Exchange is pretty secure as long as you patch it. I would also suggest turning off WebReady, as that is a frequent avenue for exploit. The DMZ or not to DMZ issue isn't possible... anything you do to segment the CAS won't help you. If you're really paranoid, but exchange on its own VLAN with it's own DCs.... better yet in its own forest. – LamonteCristo Oct 25 '13 at 18:17
UAG with SP3 supports Exchange publishing, you should look at that. – LamonteCristo Oct 25 '13 at 18:18