4 ms·
How long can you responsibly run Exchange on the internet after a security patch was released? The recent Drupal SQL injection [1] showed that attackers have da
by Ded7xSEoPKYNsDd 12y ago
How long can you responsibly run Exchange on the internet after a security patch was released? The recent Drupal SQL injection [1] showed that attackers have databases of fingerprinted services, just waiting for an update that shows them how to exploit these systems. Reverse engineering the binary patches for Exchange and building a reliable exploit out of them probably takes longer than it did in the case of that SQL injection in Drupal. But how long a testing period is too long?
1: https://www.drupal.org/PSA-2014-003 https://www.drupal.org/PSA-2014-003
- exelius 12y agoIn the case of something like a corporate Exchange server, you can run an IDS/IPS system in front of them to block any specific exploits. Even then, enterprise configurations of Exchange are usually quite unique to the company, so there's a low likelihood of a security problem being exposed to the outside.