I have read quite a bit on the subject of securing MS Exchange - most notably the Client Access role. With the retirement of Microsoft's Threat Management Gateway many people seem to be looking for an alternative, as many people feel uncomfortable with putting their CA role in a position where it can be directly accessed from the internet.

I've done quite a bit of reading on people's opinion on securing the Client Access portion of Exchange. Some say that you absolutely MUST have a reverse proxy in place to secure it, and having the CA role (or in many SMB cases, the client access, hub transport and mailbox role exist on the same server) exposed to the internet for webmail or active sync is a major security concern. Alternatively, many will argue that Microsoft has done a good job in securing Exchange almost right out of the box, and that a reverse proxy is not necessary for secure functions. The very fact that Microsoft did not issue a successor to the popular TMG almost lends credence to this theory.

I'm curious as to what security minded people on this site think about the subject.

  • Exchange is pretty secure as long as you patch it. I would also suggest turning off WebReady, as that is a frequent avenue for exploit. The DMZ or not to DMZ issue isn't possible... anything you do to segment the CAS won't help you. If you're really paranoid, but exchange on its own VLAN with it's own DCs.... better yet in its own forest. – goodguys_activate Oct 25 '13 at 18:17
  • UAG with SP3 supports Exchange publishing, you should look at that. – goodguys_activate Oct 25 '13 at 18:18

Browse other questions tagged or ask your own question.