0

MS is forcing companies to their hosted office/exchange product. I really have not seen any deep discussion or article discussing why I should trust MS to keep my emails secure. I have zero doubt that the hosted version of exchange gives MS has access to all the company emails, and by that logic to any "law enforcing agency". The software is closed source and impossible to verify how many backdoor options there are (and i am quite sure they have plenty). While not an expert, even company like apple whose marketing is based on privacy (regardless of reality) gives us government agencies access if they ask for it that means that they have to have the access. The situation will be the same in EU.

The question thus is, why would someone even be willing to that way, why so many companies migrate to that inherently insecure option? Self hosted exchanged can always be made secure and internal correspondence erased should the need arise.

So what am i missing here, what would convince me to migrate to online hosted exchange (and no, I don't agree that they are more secure as they are faster patched are behind better firewall infrastructure and all that nonsense, because once you migrate, they own you, they own your emails, they can inspect them erase them, report them, give them to anyone who asks for them, that is basically they are already hacked)? Since so many companies are migrating that way, i must be missing something.

3
  • 2
    You are mixing personal and corporate concerns. I think you need to separate those things. Companies are not going to be as concerned about law enforcement gaining access to the data that law enforcement could also get a court order for when it is self-hosted.
    – schroeder
    Mar 1, 2023 at 18:46
  • 1
    "MS is forcing companies to their hosted office/exchange product. " -- where is that stated? MS has said that the next on-prem version is coming in 2025
    – schroeder
    Mar 1, 2023 at 18:52
  • "they are not more secure because ... they 'own' you". Those two statements do not logically follow.
    – schroeder
    Mar 1, 2023 at 19:10

3 Answers 3

1

Since so many companies are migrating that way, i must be missing something.

You have different priorities than most companies; you care about privacy, companies care about cost reduction (capex especially, opex).

Having everything managed on the cloud helps companies reduce costs (read: IT salaries & infra equipment). Unfortunately, opex are still high, but that's another discussion.

As for your concerns, yes, you're absolutely right; once you put all your assets on the cloud, you're owned. Because our global society still lacks cybersecurity mentality, very few give much consideration on the issues you mention; be it at the company or at the personal level (e.g. see how many people are willing to sacrifice their privacy and/or cybersecurity for the sake of convenience).

This dire situation has led some officials to vote for legislation, that tries to establish a bare minimum of data protection (e.g. EU-GDPR, UK-GDPR/DPA, US HIPPA/FISMA/CCPA etc). However, I think that although they constitute a good start, we still have a long way ahead of us, when it comes to privacy protection and cybersecurity.

0

Unless you are using opensource from the email client to the hard disk firmware, you are trusting a closed-source component that may or may not have backdoors and you cannot inspect.

But let's ignore hardware and firmware backdoors, and let you create your own self-hosted, in-house email infrastructure. Your ISP is in position to MitM your email traffic, and most of the time, TLS won't save you.

Between email servers, they usually start a plaintext connection and ask the peer server to STARTTLS. But this command is sent on clear, and anyone on the path can just reply TLS not available, and the entire transaction is sent on clear.

Even if your SMTP server is explicitly using TLS before SMTP, most email servers usually don't check the certificates of each other and trust anything. If your server is one of those, your emails can be intercepted. If your server is properly configured, you may not receive emails from a lot of servers.

If you want real email security, you will have to enforce end to end encryption on all emails you send or receive. That creates an unsolvable problem, because you cannot force anyone to send you encrypted emails, and not everyone will be able to receive encrypted ones. You will have to ditch email and use something else.

I don't agree that they are more secure as they are faster patched are behind better firewall infrastructure and all that nonsense

It's not nonsense, and they are indeed more secure. Microsoft have funding for a dedicated elite security team, something that no small or medium business can do. They can hire the best and pay the best, and your company cannot. They own the OS and the email server, and can apply patches before they are released to the public.

they own you, they own your emails, they can inspect them erase them, report them, give them to anyone who asks for them

Microsoft have a reputation to care for, and its reputation is way more valuable than any email you can send or receive. So unless mandated by the government, Microsoft will not intentionally intercept and monitor your emails.

And even if you run your own email infrastructure, your government can do the same to you. If a government agency comes to your door and demands your servers, you don't have any power to say "no." They can simply park a truck on the parking lot, and leave with all your servers, your storage, your computers and your printed documents.

Most companies are doing it due to cost. Email is not cheap to maintain, and it's a very large attack surface. A company have to care about the email server, the anti-spam filtering, the anti phishing infrastructure, Data Loss Prevention, ransomware attacks, patching, and a lot of other issues. It's way cheaper to pay Microsoft a couple dollars per employee than to hire an entire team of experts to care care of that for them.

10
  • "It's not nonsense, and they are indeed more secure." Welll... not so sure myself. I think in the past 2 years there were quite a few successful exploits run against MS' Exchange servers. While they have a ton of expertise, they are also a HUGE target and the structure of those cloud servers are complicated plumbing. (here's lookin' at you Scotty) Mar 1, 2023 at 19:11
  • @pcalkins You are telling me Microsoft owned internal Exchange servers are less patched and secured and audited than an in-house Exchange Server 2011 ran by a small business? Or any Exchange Server ran by a company which primary business isn't hosting email services?
    – ThoriumBR
    Mar 2, 2023 at 10:33
  • I would think setting up your own e-mail server hosted in house would be such a small target that it's less likely to be attacked by malicious actors trying to get large amounts of data via a single attack. Mar 2, 2023 at 17:43
  • Bots don't care. Your IMAP/SMTP ports have to be open on standard ports, and Shodan will have it listed. When an exploit for Exchange surfaces, any attacker can just download a bunch of addresses from Shodan and run metasploit. Microsoft will have a team online all the time to patch their servers as soon as possible. WIll you be awake 1 in the morning on a Saturday to patch your server? Will you detect an attack on your server before it encrypts everything? Is your backup running all the time, with offsite backups? If you said "no" to any of those, your server is less secure than the cloud.
    – ThoriumBR
    Mar 2, 2023 at 18:51
  • I guess it depends on what you are trying to defend against. For bulk data pulls posted to the dark web, Exchange servers are the more likely target. Ransomware would probably not be all that interested in e-mail servers... they'd want DBs for crucial infrastructure.... I think a blanket statement about cloud being more secure is nonsense... but that's my opinion. If you want your data to be secure don't expose it to the internet. Mar 2, 2023 at 19:30
-1

why so many companies migrate to that inherently insecure option?

Cost and Cost Stability

It costs a lot of money and the costs fluctuate and can be unpredictable; to build and maintain a datacenter, hire and keep staff, and then secure the infrastructure. Then you still have to pay for the software, and maintain support costs (because your sys admin needs support, and policy says you maintain support). Then there is the costs to manage the costs.

When Microsoft says "we can do all that for a flat rate", and they can comply and be validated to cloud security compliance standards (for example FedRAMP https://www.fedramp.gov/ and Cloud Security Authorization processes https://public.cyber.mil/dccs/ ), you can't turn that down as a business owner or as a government agency.

So what am i missing here, what would convince me to migrate to online hosted exchange?

Liability

The final point is it's also a "risk transfer" technique of risk management; not that it protects the data, but it protects the business' liability. That being, if the data is compromised in my datacenter, on my site I'm (financially and legally) liable for the loss. Where if I contract to microsoft to secure it and they compromise it, they're held more liable for the loss. The data is still lost or compromised, but "my risk" is mitigated.

4
  • 2
    I'm not sure that the sentence "if I hire microsoft to handle it, and they compromise it, they're liable" is completely accurate. Nobody forces a company to use the cloud; just because they do it to recude costs, it does not mean that they can share the responsibility for the loss of data after a breach. Now, given a contract that holds (under conditions) the cloud provider responsible for any breach, a company can claim damages from its cloud provider, but that is another story.
    – user284677
    Mar 1, 2023 at 17:17
  • From a risk management strategy it is. It's a risk transfer technique not risk avoidance (couldn't think of the word when I was writing it.) I'll edit that though. Mar 1, 2023 at 17:35
  • 1
    One note: The transfer only moves the financial portion of the data loss risk to the provider. My own business is still legally accountable for it.
    – fleitner
    Mar 1, 2023 at 18:12
  • I think the liability would come in if they were deemed to be "negligent". Mar 6, 2023 at 19:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .