Keeping Microsoft Windows Server Secure

Windows Server has been with us since before Windows NT with Windows for Workstation and Server 3.1. Since then, Windows Server has been the workhorse of data centers for corporations and enterprises. 

Initially, Microsoft Windows Server was the primary local network domain controller, providing local security, services lookup, DHCP for IP addresses, printers and document management. It would later go on to be the backbone for enterprise services like Email with Microsoft Exchange - the world's largest corporate mail server and SQL, as well as one of the world's leading SQL database servers as well as IIS, powering half of the world's web servers. 

In the past, hardening Microsoft Windows servers included maintaining updates and patches, strict user access control, firewalls, securing routers and modems, and installing anti-virus protection. 

Other Considerations for Server Security 

• User Access 

• External Hacking 

• OWASP (for IIS) 

• Ransomware and Malware 

• Viruses 

Cybersecurity with Microsoft Defender for Endpoint 

As these servers have become more exposed and developed more vulnerabilities - which many attribute to Microsoft product development standards - they’ve had to provide anti-virus and EDR services. However, legacy versions - which include some as young as 4 or 5 years old and dating all the way back to Windows 2003 - are no longer a priority for Microsoft. They do offer Defender for Endpoint (formerly Defender Advanced Threat Detection), which provides limited security and defense for anti-virus and some cybersecurity features. In reality, this means full protection against viruses, malware and ransomware for corporate and enterprise data centers is virtually non-existent. 

Versions of Microsoft Defender  

Microsoft Defender for EDR + Anti-virus Status for Legacy Windows Servers 

Notes: 

1. Windows Defender before 2016: Prior to Windows 10 (released in 2015), there was no product called Microsoft Defender specifically designed for servers. Windows Server 2003, 2008, and 2012 relied on other security solutions for protection. 
2. Windows Defender Antivirus (limited) on Windows Server 2016: With the release of Windows 10 in 2015, Microsoft Defender Antivirus became available on Windows Server 2016. However, its functionality was limited compared to the full-fledged product available on Windows 10. 
3. Full Windows Defender Antivirus on Windows Server 2019: Windows Server 2019 (released in 2018) benefits from the full capabilities of Windows Defender Antivirus, offering comprehensive real-time protection against malware, viruses, and other threats. 

Microsoft Defender ATP 

While Microsoft Defender Antivirus provides baseline protection on Windows Server 2016 and later, organizations often utilize additional security solutions for more robust server protection. These might include System Center Endpoint Protection or more advanced solutions like Microsoft Defender for Endpoint mentioned above. 

For Windows Server 2003, 2008, and 2012, it's crucial to rely on alternative security solutions, as Microsoft no longer offers mainstream support for these server versions. 

Primary Microsoft Services Used on Windows Server 

The primary services for Windows Server Services (sometimes workloads) are: 

Network Services 

• DNS 

• Active Directory (AD) 

• Firewall 

• DHCP 

• Printer and Document 

• Mail  

Application Services 

• Windows IIS 

• Windows SharePoint 

• Windows RDS 

Major Microsoft Services 

• Microsoft Exchange Server 

• Versions  

• Microsoft SQL Server 

Microsoft Exchange Server 

As the world's largest email server, it dominated corporate mailbox provision from the 1990s to today where most mailboxes reside in Microsoft 365. But there are millions of Exchange Servers in private and semi-public data centers around the world. 

Initially, Security for Exchange was difficult and only secured by Admin access, firewalls, and router NATs. But Microsoft’s over-trusting of the internet soon made Exchange a massive vector and security soft spot. 

How to Secure Microsoft Exchange Platforms  

Securing Microsoft Exchange involves a layered approach that addresses various security aspects and leverages Microsoft Defender for Office 365 for more advanced email threat protection. The following 8 tips are recommended for general protection and hardening of Microsoft Exchange: 

1. Keep Microsoft Exchange updated
2. Implement Multi-Factor Authentication (MFA) 
3. Enforce strong password policies 
4. Secure user access: 
5. Leverage email security features 
6. Monitor Exchange activity 
7. Implement backups and disaster recovery plan 
8. Educate users

• Use strong encryption for data at rest and in transit. 

• Segment your network to isolate Exchange servers from other network segments. 

• Regularly test your security posture through security assessments and penetration testing. 

Virsec’s Cyber Security Platform 

The Virsec Security Platform (VSP) is a complete protection layer that operates faster than EDR, MDR or XDR to identify and prevent malicious code from deploying malware and ransomware in the form of RCEs like DLLs and EXEs from infecting and taking control of your server environments. 

To learn more about the Virsec Security Platform (VSP), please visit us at www.virsec.com