Overview

For many Exchange deployments, proactive planning of security measures and protections for users, data, servers, and infrastructure are an afterthought. As we deploy Exchange, we focus on getting the messaging functionality in place and often don't have the extra cycles needed to properly investigate security issues. In addition, security is a topic that is very complex, and many do not have the training or expertise required to provide a secure Exchange environment. In some cases, a separate group or department from the Exchange deployment manages organizational security. This can create either a competitive environment or a knowledge gap in which Exchange system managers and security managers compete for resources, resulting in a lack of cooperation or knowledge transfer. Overall, this results in the security needs of the Exchange deployment being overlooked, improperly specified, or ignored altogether. Without going too far down this path (it's highly political in nature), it is safe to say that the users and the organization suffer the end consequences.

Because every organization's architecture and security requirements are different, there are many approaches you can take. In the course of this chapter, I will be discussing threats to Exchange security and the countermeasures available. You may choose to apply all or part of the topics covered depending on your scenario. Since the topics discussed will have a definite impact on the overall design of your organization's security infrastructure, you should read this chapter with this in mind and in conjunction with the "big picture" plan for...