4 ms·
Do you manage any Internet facing Exchange? If so, what have been your remediation strategy with this attack?
by darkwater 6y ago
Do you manage any Internet facing Exchange? If so, what have been your remediation strategy with this attack?
- EvanAnderson 6y agoAll of them are Internet-facing. I have done a lot of patching and some restoring from backup (followed by parching) this week. Some people disabled /ECP facing the Internet. It was "unsupported" by MSFT so I never did that. In retrospect it would have been worth the gamble. If I had it to do over again I would have taken that bet. None of the compromised boxes I saw this week showed signs of post-exploit activity. They dropped their payload and left. Every compromised box was restored from backup, temporarily isolated from the Internet, and patched.