Build an ultra-secure Microsoft Exchange Server

Yes, it's possible to do a Microsoft Exchange Server deployment that is secure enough for all but the most sensitive information. Here's how to do it.

Man pointing to security icon for email

With all the news about information leaks, hackers, and encryption, it’s natural for security administrators to ask how to make an ultra-secure Microsoft Exchange Server deployment that’s good enough for any purpose outside of sending top secret information. I’ll show you how to build out an Exchange Server 2016 deployment in a Hyper-V virtual machine that is as secure as I can possibly make it while still allowing it to be usable. We're talking locked down, encryption both at rest and in transit, securely accessible from remote locations, and hardened against interlopers.

Specifically, I’ll explain how to build:

  • An Exchange Server. I am sure a lot of people will roll their eyes and say Microsoft Exchange cannot ever be secured properly and that true security can only come from Sendmail or Postfix custom compiled. I take issue with that. Those solutions might work if you are hosting a server for yourself and perhaps a couple of other people, but Exchange has valuable groupware features.

    Secondly, information lives both in e-mail and in calendars and contacts. Neither Sendmail nor Postfix address that in an integrated way. If you secure Exchange, you secure calendars, contacts, inboxes, journal entries, instant message conversation history, and more. Finally, most people prefer Outlook and Outlook simply works best with Exchange.
  • A solution that works in the office and on the road. I want to focus on securing mobile access to Exchange as much as possible. Secure mobility is critically important. If there is a compromise to be made in this design, it will be in the name of security and not convenience. Anyone with any experience in this industry will tell you security and convenience are at odds with each other. I want to make intelligent and reasoned choices with this build that allow some convenience without compromising the overall integrity of the system.
  • A simple one-box solution. I am not going to deploy multiple Exchange servers as part of an availability group. I am not going to cluster the Windows Server machines. I am not going to have attached storage or try to manage a SAN connection. Rather, I am going to keep it simple: The storage, server, and Exchange will all live on one box to the point where you can set this up on a single virtual machine and either run it in house or deploy it up in an infrastructure as a service environment like Amazon Web Services or Microsoft Azure.

This is a three-part operation. First, deploy Exchange. Second, secure the foundation both from a Windows Server and Exchange perspective. Finally, secure the network and implement the very latest in encryption and auditing technologies so that you have the best secure single Exchange Server implementation available. In fact, I am putting this system into production for my own business, so this is not a theoretical exercise. My organization will depend on this deployment.

Installing Exchange Server 2016 on your server

To continue reading this article register now

The 10 most powerful cybersecurity companies