I have read quite a bit on the subject of securing MS Exchange - most notably the Client Access role. With the retirement of Microsoft's Threat Management Gateway many people seem to be looking for an alternative, as many people feel uncomfortable with putting their CA role in a position where it can be directly accessed from the internet.
I've done quite a bit of reading on people's opinion on securing the Client Access portion of Exchange. Some say that you absolutely MUST have a reverse proxy in place to secure it, and having the CA role (or in many SMB cases, the client access, hub transport and mailbox role exist on the same server) exposed to the internet for webmail or active sync is a major security concern. Alternatively, many will argue that Microsoft has done a good job in securing Exchange almost right out of the box, and that a reverse proxy is not necessary for secure functions. The very fact that Microsoft did not issue a successor to the popular TMG almost lends credence to this theory.
I'm curious as to what security minded people on this site think about the subject.
