Microsoft Urges Businesses to Patch Critical Exchange Server Flaws

[dalekphalm]

*phew* fortunately we skipped on-site Exchange infrastructure.

 

When we migrated away from our shitty ISP POP mailboxes (Yep...), we went straight to Exchange Online/O/M365. I figure Microsoft will handle the patching for those cloud servers xD

[Bombastinator]

18 minutes ago, dalekphalm said:

*phew* fortunately we skipped on-site Exchange infrastructure.

 

When we migrated away from our shitty ISP POP mailboxes (Yep...), we went straight to Exchange Online/O/M365. I figure Microsoft will handle the patching for those cloud servers xD

The cloud stuff is supposed to be safer I think but this was a discovered thing iirc. It was discovered while it was being used, so while there’s not much to do about it now, your email may have already been hacked.

[StDragon]

2 minutes ago, Bombastinator said:

The cloud stuff is supposed to be safer I think but this was a discovered thing iirc. It was discovered while it was being used, so while there’s not much to do about it now, your email may have already been hacked.

Yup. It's all relative. At least with O365 hosted Exchange it got patched ASAP for tenets. On prem will be at the mercy of competent IT staff in terms of skill-set and responsiveness to such issues.

[Sir Asvald]

On 3/4/2021 at 3:43 PM, wkdpaul said:

Thankfully we keep our servers up-to-date, so we didn't have much patching to do, only a few servers. But one client still refuse to update though, he's still on 2008R2 with Exchange 2010 ... but hey, we're paid to keep it running (even though we're pushing to have that decommissioned).

Ah Clients, they think they know everything. But when something breaks, they come crying to you for help. A friend of mine works as a consultant and a company tried to sue him because they got hacked and the hacker encrypted their data even their servers were encrypted. They could not sue him because he had everything in written up in his report. 

[Sir Asvald]

On 3/6/2021 at 4:29 PM, dalekphalm said:

*phew* fortunately we skipped on-site Exchange infrastructure.

 

When we migrated away from our shitty ISP POP mailboxes (Yep...), we went straight to Exchange Online/O/M365. I figure Microsoft will handle the patching for those cloud servers xD

Yeah it's all Online now. Too bad some companies cannot use the cloud for reasons unknown to us. 

[WkdPaul]

Just now, Sir Asvald said:

Ah Clients, they think they know everything. But when something breaks, they come crying to you for help. A friend of mine works as a consultant and a company tried to sue him because they got hacked and the hacker encrypted their data even their servers were encrypted. They could not sue him because he had everything in written up in his report. 

CYA, always CYA (Cover Your Ass), get everything in writing. That saved me a few times, and will again in the future, I'm sure.

[dalekphalm]

1 minute ago, Sir Asvald said:

Yeah it's all Online now. Too bad some companies cannot use the cloud for reasons unknown to us. 

There are definitely legit reasons to avoid the cloud - particularly regarding government regulations (some, for example, enforce a strict policy that data in the cloud must always be stored in the country in question - some cloud operators can guarantee that, others cannot).

[Sir Asvald]

4 minutes ago, dalekphalm said:

There are definitely legit reasons to avoid the cloud - particularly regarding government regulations (some, for example, enforce a strict policy that data in the cloud must always be stored in the country in question - some cloud operators can guarantee that, others cannot).

That is true. My previous place of work was is on-prem due to the nature of the work that we did. I can't speak about it because I am under an NDA.

 

 

 

[Bombastinator]

35 minutes ago, Sir Asvald said:

Ah Clients, they think they know everything. But when something breaks, they come crying to you for help. A friend of mine works as a consultant and a company tried to sue him because they got hacked and the hacker encrypted their data even their servers were encrypted. They could not sue him because he had everything in written up in his report. 

Everyone thinks they know everything because most people know a lot about something and think it applies farther than it does.  It seems to me that almost no one has ever known much of anything even when they thought they knew everything.  They were wrong.  Applies to every person.