In the alert, the company urged admins to take action, saying, “If your servers are so much out of date [pre-March 2023], please update your servers ASAP to secure your email workload and re-enable your Exchange server to check for EEMS rules.”
The Microsoft blog is “alarming,” said Andrew Grotto, a research scholar at Stanford University’s Centre of International Security and Co-operation and the senior director for cybersecurity policy at the White House in both the Obama and Trump administrations. “It shows how sticky [on-premises] Exchange is.”
Exchange mitigations are essentially hot fixes that plug holes, Shipley explained. Shifting to the software-as-a-service M365 doesn’t solve all security problems for the email service, he acknowledged, but, he added, it does solve the problem of threat actors being able to exploit unpatched or aged versions of the server, because Microsoft installs fixes for Microsoft 365 as soon as it creates them.
