General – ExchangeDefender Blog

Most Popular Products

EMAIL SECURITY

Services that protects your mail from spam, viruses, and malware.

ARCHIVING

Secure long term message storage and ediscovery reporting.

BUSINESS CONTINUITY

Constantly archiving your sent and received mail.

When things malfunction at other companies, they blame vendors and equipment. When things malfunction at ExchangeDefender, we build products and services so we never have to deal with the problem in the first place. As a result of a DDoS attack last month, I am happy to introduce you to our new service that will improve one area in which we undoubtedly suck the most: communication.

Say hello to AnythingDown.com:



It’s an offsite NOC alert site that’s branded for you.

At ExchangeDefender we do a pretty amazing job communicating and working with our partners, it’s actually our #1 selling point, that you can come to our offices and data centers, you can work with our team and get things done. But when something breaks, that same business friendliness and accessibility is an achilles heel – clients swamp the phones demanding to be briefed on every detail, “Friends of Vlad” call every staff cell phone they can find, the staff that is there to help/coordinate/assist in technical work cannot efficiently correspond and inform every user particularly when things go down and everything isn’t working as it should.

This is where ExchangeDefender XDNOC (aka “AnythingDown.com”) helps.

It’s off site. Doesn’t rely on our networks at all.
It’s on it’s own name space. Not dependent on our DNS/registrars.
It’s branded. Your name, your image, your message.

That last bit is pretty important – we realize that our larger clients have many employees that have never heard of ExchangeDefender, ditto for our partners that don’t want to reveal ExchangeDefender is behind their branded email offering.

Not to worry, your site is already branded and you have your own Service Provider XDNOC: https://<yourExchangeDefenderSPId>.xdnoc.com

It’s yours, it’s yours for free, and we’re just getting started. For the next week or two, the site will host ExchangeDefender content only as we add in the mechanism for RSS subscriptions, linking, SMS/txt alerts, and email notifications.

But this is just the beginning. As an ExchangeDefender subscriber you will have access to this site to tweak it as necessary and to add your own NOC alerts. That’s right, we’re not just building this for ourselves, we see it as a role of central accountability for everyone that relies on our services and all the services you use to deliver a solution. We all want to keep the client happy and informed and this will help out a lot towards that goal.

Our expectation is also to have our proprietary monitoring and alert feeds published on AnythingDown.com going forward so you can see or anticipate the issues that our infrastructure is seeing even before there are tickets or human confirmation of the problems. For many that will be way, way, way too much data but we feel it’s better to present it and get more eyes on it than hide it and hope it’s handled through automation or our staff activity.

In closing, I hope this helps. I know outages and service interruptions or performance issues or networking issues all suck, nobody wants them. They come with the territory and everyone knows it – so it’s not about technology malfunctions, it’s about your communication about the IT work that is done to make it as flawless as possible. We thank you for your business and for your continued support of ExchangeDefender that makes stuff like this possible.

Many IT professionals have gone through a lifecycle infrastructure upgrade – the all important cycle of improving the infrastructure as the vendors push down new features with ever increasing resource demands. We’ve been doing that since 1997. One thing that has changed in the past 20 years is the scope and magnitude of both attacks and the network demands to manage them all. We’ve done an excellent job keeping up with them all, with our last major outage (that lasted nearly 4 hours) back in 2011. We learned a lot that day – and rolled it up into our products and services that many of our partners have experienced. These days, with the cloud services, the game is completely different.

I hope you have a moment to join our WEBINAR next Thursday, April 11th, at noon

Register here: https://attendee.gotowebinar.com/register/5700720797827651073 

It won’t be the usual rah-rah new features new stuff show. I will speak candidly about how we’ve managed to overcome and triumph in the “Cyber” security game and how we’re still always one step behind whatever 0-day attack vector comes down. I’ll be discussing (somewhat intimate) details about the performance issues, DNS issues, DC issues, subscription issues, 3rd party IP issues, and how all of these have become both an IT management issue and customer service nightmare. I truly hope you join us. I know your time is valuable and schedules get tight so if you can’t make it, the recording will be posted in our portal as usual.

What we learned last week – for the millionth time – is that communication in cases of issues is paramount. When things appear to go down, people panic. They require not just information but reassurance, confidence, and a plan required to address issues. For smaller companies, that’s a matter of just falling back to a cell phone – for larger ones (if it’s not already you, it definitely is something to consider for your clients) that is simply not an option and the volume of activity will easily and quickly overwhelm you. I used to see it every day – when issues come up for our partners, their clients call us.

We’ve made an overwhelming investment – not just in technology and features but manpower – that has fueled our growth for the last few years. I want to share, personally, exactly how we operate and how we’ve been able to both prioritize and execute some of the more impressive infrastructure enhancements and how they are going to be here to serve you for years when something happens.

And then I hope to offer you the same – as a token of our appreciation for your business and your loyalty through the years. Pretty excited, I hope you can join us.

Sincerely,
Vlad Mazek
CEO
ExchangeDefender

 

We are currently experiencing  a large scale DDoS attack on our network specifically our DNS servers.

Our team is working diligently to correct the issue, please stand by for more information – or give us a call (877-546-0316) if you need any assistance!

We will make sure to keep you updated via the ExchangeDefender blog, our facebook (@exchangedefender), and within the portal as access gets restored.

Thank you for your patience.

ExchangeDefender Announcements

As you’ve probably noticed, our feature development has really picked up in 2018 and we have an even more aggressive product roadmap for 2019. To help make sure everyone is on top of all the new features and that our partners (MSP/VAR) have the best possible way to keep all of our clients informed of the new features, we’re happy to announce the Announcements feature!

Starting in late February 2019, our service providers and CIOs alike will have the ability to post announcements that will be featured prominently on the ExchangeDefender admin login page, inside the user control panel, and in the domain/org control panel. As you can imagine, this feature has a lot of flexibility to help you efficiently target the right organizations and users.

Announcement Feature Highlights:

– Announcement title and announcement contents can include HTML and you can even insert a picture for each.

– You can set the announcement expiration date so that the announcement doesn’t show up after a certain date. This is great for sales promotions, webinar registrations, etc.

– You can scope the announcement: It can be global (for all of your domains) or it can be scoped down to a list of domains you choose. As most of our MSPs manage different kinds of organizations, one-size-fits-all announcements rarely work and this feature can help you solve that problem by targeting each organization specifically.

– I want to see this announcement too: If you’re in a larger organization you likely have personnel that is responsible for different departments or companies. Because announcements are visible on the login page of your portal as well as control panels for service provider, domain/org, and end users you have the ability to not show end user announcements to your IT and management staff.

– Include all users: You can even write specific announcements that are targeted at end users.

As ExchangeDefender gets bigger and as the complexity and service portfolio grows, we need to help our partners and CIOs communicate the new ExchangeDefender features more efficiently. Since you control your announcements it is up to you if you use it for ExchangeDefender related stuff or if you use it for your own promotion or if you delegate it to your companies to use it as another outlet to broadcast organization-specific but important news to everyone.

Most ExchangeDefender users interact with the service daily so you have a perfect (captive) spot to reach them about a product they are already interacting with – instead of having it burried in an email newsletter that they likely won’t read. This has been among the most demanded MSP features for years and we’re happy to deliver something with enough power and flexibility that will make both your tech/support people happy (so they can address possible support issues) as well as marketing/sales (so they can better target their message). You can only display up to two (2) announcements at a time though so the only bad news here is that you’ll have to prioritize.

To say that our security webinar went well is an understatement – partners actually loved it. It’s a strange and welcome departure from how my security and hacking conversations usually go (nobody ran away from me crying and screaming into their cell phone) and I cannot tell you how gratifying it felt to introduce security features and have people line up to offer them.

Frankly, it was time. The state of email (and email security) is unsustainable if we let the users and infrastructure we manage act like account security is an afterthought – that just leads to more compromised endpoints that just amplify the next attack that will be more sophisticated, harder to defend – AND – will eventually lead to increase in costs as more infrastructure is needed to protect users who want to act the same ways spammers do. We’ve put a smart lock on the door, it’s your choice whether you want to lock it.

That said – all these features are a part of the ExchangeDefender Enterprise which is designed for very large companies and government where organizational policies override any complaints and gripes end users may have with the security inconvenience. Which is exactly the opposite from the small businesses that MSPs tend to manage.

We get it. And we’re not giving up.

In the nearly two weeks that we’ve been rolling out the new security features to the MSP/SMB UI, we’ve noticed some severe pain points for our users that we’ve moved very aggressively to address and mitigate. Which is my commitment to you – we will keep on stepping up the security and we will find ways to mitigate some of the prompts, alerts, and notifications along the way if you don’t want your users to be aware of what is going on under the hood.

First up, if you’ve chosen to lock down ExchangeDefender admin panels to the restricted IP range you own, you now have the option to turn off email notices every time a login attempt is made from outside of this range.

We’re in progress of making additional changes and exceptions to the IP address restriction policy and removing it from the SPAM release process – so if your employees are mobile or working from home they will soon be able to release a legitimate message (false positive SPAM) from anywhere even with IP restrictions in place. They won’t be able to login to the control panel and make modifications or see other settings but they will be able to get to their email.

We hope this feature enhancement will reduce the amount of email notifications – you will still see them in your event logs.

Second, we have opened up our OTP/2FA infrastructure to the whole world.

Finally, the alerts on the clients dashboard. I am going to phrase this carefully as I’m not happy to announce this and will likely change it eventually: You can turn that alert off and stop users from being required to change their passwords very X days. Just set the value to 0. We will revisit this within 30 days but as a mitigation to any unwelcome support calls, yes 0 will just turn it off.

We’ve been working on the announcement and training features for quite some time now and we hope that they will make security implementation and support a problem for ExchangeDefender to handle, instead of burdening our partners with it. In an ideal world, those features would have launched first and we’d slowly trickle down ExchangeDefender Enterprise. Unfortunately, another 600+ million usernames, passwords and other PII has been leaked last week from some very popular sites and the odds that those users and passwords have the same credentials there as at ExchangeDefender are pretty good.

My point is, we are paid to protect and lock down your organizations communication and secrets, something we take extremely seriously. In order to protect all the data you trust us with, we have to lock things down. And as we do so, we will keep user experience front and center.

Thank you for trusting us with your data and thank you for your business.
Sincerely,
Vlad Mazek
CEO
ExchangeDefender

ExchangeDefender has been SMB friendly – to a fault, but the era of terrible passwords and plain text passwords is finally over. Not a single piece of ExchangeDefender stores (or offers) user credentials in plain text anymore. We’ve made the transition exceptionally smooth as well, requiring no changes or IT intervention at all.

But we cannot encourage it enough. And over the next year you will see us introduce several features meant to help you lock down ExchangeDefender and use it to lock down your overall IT security strategy. We’re happy to introduce password age configuration that allows you to force users to reset their passwords automatically.

This setting can be accessed from the Domain Administrator > Policies > Features section of admin.exchangedefender.com

When the password is older than your preset number of days (by default, 90) the user will see an ugly red notice telling them to update their password.

If you set the password expiration to 0 days you will turn this feature off entirely but we cannot discourage it more. The feature is there to help your users avoid having their accounts compromised.

If you implement some of these stronger security features we’ve also got you when it comes to minimizing account management – users can reset their password at any time if they have their PIN on them. So even if their mail server is down, having their PIN handy will let them reset the password without additional authentication. Forgot your pin? No problem, we can email you a reset link to a known email address.

As you can tell, ExchangeDefender will go the extra step of helping your users configure a strong password. It will also keep memory of recent passwords so that they can’t just rotate it back and forth between the same two passwords they use elsewhere.

As you’ve seen with mass password resets , access to advanced access logging , known trusted devices and IP restrictions , we are adding more, and more, of our enterprise features to the ExchangeDefender Pro product.

To hear about all these new security features in more detail please check out the webinar  that covers our current security portfolio and how these features make sense.

 

ExchangeDefender has always been a great friend to the SMB community where folks hate passwords and password complexity right until the moment their password gets compromised. Once that happens, it’s up to the MSP or poor IT guy to sit around and reset all the passwords in the organization.

As mentioned previously, a number of ExchangeDefender Enterprise features is being delivered to ExchangeDefender Pro so now you’ll have the ability to reset every single users password quickly.

Under the domain login you will now see a “Security Reset” link that will allow you to either randomly assign a strong password (smart) and send your users a reset link or pick the same password for all users (outright idiotic but “business requirements”).

If you are an MSP assisting a client during an outage and this is the first time you’re making your users aware of ExchangeDefender LiveArchive for business continuity, you can also print out the passwords and/or email them to your users in plain text. This is a horrible, terrible, idiotic, really bad idea that virtually guarantees you’re going to get hacked but we are here to serve and Howard is a really good friend so here it is:

Just a word of warning: If you select to send your users a new password in clear text, and show the roster with the plain text password on the next page, for whatever ungodly reason, please add a note to come back later and lock your users down. Most MSPs keep the same password for ExchangeDefender and Exchange, and these services also affect ExchangeDefender Encryption, LiveArchive, WebFileShare, Compliance Archive, eDiscovery, FailPOP, mobile, etc and leave you open for collateral damage. Unless you’re using 2FA/OTP, restricting IP address ranges, rotating passwords frequently, I can guarantee that your passwords will be compromised. Please, please, please don’t do this, we are only making it available as the feature of last resort.

As we add these advanced security controls into ExchangeDefender Pro (and some even for Essentials) we will be tightening the security of the platform around. To hear more about our plan for 2019, please sign up for the webinar on February 6th at noon EST. Click the banner below to reserve your seat.

We’re trying something new, because we’re launching a new product.

We’re enormously proud (and a bit nervous) to introduce our partners and clients to a brand new product category from ExchangeDefender: focused on business process management, optimization and accountability. We’ve learned a thing or two about information management and security by handling Microsoft Exchange for businesses for over two decades and the new product that we’re going to announce on Thursday will help complement it.

We would like to extend an invitation to our partners (*** This webinar is live, there will be no recording ***; style this prominently) to take a look at what we’ve built, what has managed our business for years, and to collect feedback and suggestions on what more we can to do help you count on our new product as a profitable way to help businesses gain some accountability.

The webinar itself will be more of a town hall meeting than our typical death by PowerPoint.

The primary goal is to explain what has been working for us and see what more we can do so it can work for you as well. We will be going over our roadmap, our implementation, our business model and where/how this new thing works. Aside from some cool swag and custom marketing collateral, you’ll also be the first one to get access to the beta version that you can use for free and see how it can manage your business and where you may have a sales opportunity.

Exchange 2016 Built For End Users

Have you ever wanted an email system that anyone in your organization could manage, with no IT training? Something so simple even a teenager could master it? Well, you’re in luck, now you can do that with Microsoft Exchange 2016 and ExchangeDefender. We’re putting the power of all the enterprise Exchange features  into the hands of businesses to help reduce IT costs and improve office productivity.

How? We’ve made it so it’s impossible to make a mistake.

Why? Because as a service provider, we too pay a price when support is necessary for some basic and routine tasks. We’ve automated them, simplified the process flow, and given you access to provision services and answer all the questions you’ll possibly have in a jargon-free language.

For example, let’s say a new employee starts today. All you have to do is login to our portal at https://support.ownwebnow.com, click on Service Manager, Exchange 2016, Quick Actions, Mailbox.

Just 3 more clicks and some basic information typed in – and you’re done. You’ve created a mailbox.

Thing is, you’ve done far more than just creating a mailbox. You’ve added an email address to the organization and provisioned all the security templates that match your organization. You’ve enforced your corporate password policy. You’ve ordered the correct plan and assigned the right licensing for this user (it’s automatically done for you). You’ve provisioned all the required services that your organization requires be it corporate encryption, 2 factor authentication, or even compliance archiving and eDiscovery.

You’ve also become your own support person for basic settings, configurations, and guides. The entire system is on-demand, self-service, instant gratification to the max. You can get more done, by yourself, on your schedule and quickly. That is the value behind ExchangeDefender powered Exchange 2016.

Now wait till you see what we can do for the IT personnel managing 100+ user organizations! Are you ready to migrate your users to Exchange 2016? Simply click on the Early Adopters banner below, submit a ticket requesting early adoption, and we’ll get started!

Image result for how to determine spam email

The more SPAM stays the same, the more ways they find to get it through to your mailbox.

How we determine something to be SPAM vs legitimate mail is a bit of a science and it incorporates a ton of statistical analysis, data feeds, real-time blacklists, IP reputation scores, several antivirus products, several malware detection products, subscription services, etc. We pass each inbound message through almost all of these subsystems and assign it a score – as that score adds up the message becomes categorized as SPAM or SureSPAM based on the amount of UCE/malware/infected content the message has.

Every year we rebuild the ExchangeDefender engine to pull out things that no longer perform well, add new promising technologies, shift around the different plugins and so on. While ExchangeDefender filtering is updated in real-time and by tons of different vendors along with our in house technology, major improvements and technology shifts are necessary in order to prevent truly dangerous stuff from getting through. Unfortunately, this means that for about a week or two the amount of junk mail that gets through goes up as we reset all our scores, statistical models, weighs for different services and the implementation. While we wish we could just point and click, the process is far more complex than that, and requires delicate changes over a few days.

We appreciate your patience with us as we get the new engine online. The SPAM filtering levels should return to 100% shortly and we realize SPAM is annoying – which is why we’re doing this in the first place. Thank you for your business and trusting us with your email, we look forward to getting our best ever SPAM detection online shortly.

GDPR - GET STARTED

Our readiness kit contains valuable resources designed specifically to help businesses with GDPR requirements.

DOWNLOAD OUR GDPR READINESS KIT

IoT Security Solution

Introducing our newest security solution for IoT devices. Protect and secure your IoT environment with robust built in Security.

READ MORE

Are you an MSP?

See why you should consider our partner program. Become a partner at no cost, with no annual commitment, cancel anytime.

MORE INFORMATION