security Tag

ExchangeDefender has recently enhanced our MFA features (multi-factor authentication) to help you enforce domain-level MFA compliance and to make it easier for users to be enrolled and protected by a layered authentication process automatically.

Simply put, we’re making it easier for you to keep everyone protected.

Today we are announcing ExchangeDefender MFA support for custom authenticator apps. By now everyone is familiar with our typical MFA functionality, available under your Settings at https://admin.exchangedefender.com. Just scan the QR code on your device and you’re set!

BUT WHAT IF YOUR DEVICE DOESN’T HAVE A CAMERA?

ExchangeDefender now supports MFA app enrollment using a QR code. This is great for scenarios in which:

– You don’t have a camera on your device
– The QR code doesn’t seem to scan (problems with the camera or monitor)
– You want to use a text-based MFA app
– You want to integrate PowerShell/no-code with MFA
– You want to share your MFA codes with others

If you’re in one of those scenarios, note the text under the QR code when you start the enrollment:

Click on the Can’t scan? Show code link and you’ll get the TOTP secret (aka secret code, MFA code). Paste it in your solution and paste back the 6 digit code it generates. That’s it, you’re done. MFA is now enforced and ExchangeDefender will rely on the codes generated by your app to validate MFA and grant access to your account.

All our features come from user feedback so if there is something we need to be doing to keep you more secure please let us know!

ExchangeDefender is giving users more power to lock down their valuable data. Now that ExchangeDefender handles business continuity and backups for M365/Gmail tenants there is even more information in ExchangeDefender that demands more flexibility with security policies. First, let’s talk about the upcoming feature that allows you to lock down your ExchangeDefender SPAM Quarantine Report activity.

Bit of background: ExchangeDefender Quarantine Reports are an immensely popular ExchangeDefender feature (coming up for an upgrade this spring btw!) that sends users a list of quarantined messages with a set schedule. Users tend to rarely look in Junk Items or review SPAM unless they are waiting for something so this is a cool feature that our users just love. Scroll down the list of quarantined messages and release or trust just by tapping the link. Super convenient, but does it meet your security requirements?

ExchangeDefender Quick Release feature now enables you to choose between convenience and a more secure release process. For many organizations, having the message released or get added to trusted senders with just a click is a huge time saver and user convenience. But if your Microsoft M365 / Gmail account gets compromised (which happens ALL the time) or you deploy a new security/business/CRM (mostly AI stuff) that scans links then this “convenience” can turn into an Inbox packed with SPAM messages that some hacker/service inadvertently released.

If this happens to you, know that ExchangeDefender can help with the “Secure Release” setting. By enforcing Secure Release, when the user clicks to release or trust a message they will be prompted to authenticate before they can release/trust the message. This way if you get hacked or install link scanning/crawling software in your tenant will not be able to access the messages without a password.


Now please, go setup your favorite authenticator app with ExchangeDefender MFA (next up, you can set it to be mandatory/required)

Has it been a while since you last reviewed your email policies? Do you need to make sure that every user in your organization gets the same protection and the same service behavior and reporting?

We’ve taken some of our most popular features and wrapped them in a user-friendly wizard that will allow you to quickly configure ExchangeDefender. These settings establish the bare minimum configuration you need to reliably send and receive email on the Internet and instruct ExchageDefender how to sort your email.

Security Policy Overview

Our goal with the Security Policy wizard is to save time while configuring the major aspects of ExchangeDefender. While you still have access to hundreds of policies and can always configure new custom ones (as business requirements demand) it’s nice to know you can quickly adjust the features and make sure they apply to everyone in the organization.

You’ll be able to teach ExchangeDefender how to categorize mail, how long to keep it, and how to report it. Basic SPAM, malware, phishing, and address enforcement policies can be configured in seconds.

We’ve also added some of the settings that are exclusive to ExchangeDefender (From: policy enforcement) and some that always give IT teams trouble (DNS, DKIM + SPF records). The goal was to present all the required and support-intensive features in a friendly way so you can protect your network without knowing the details of the latest standards and security best practices.

Default Security Policy will automatically display the first time you log in as a Domain Administrator. It will load your current settings into the policy and allow you to review it or apply it to all the users in the domain. All the settings are still in their normal places so you can fine-tune your protection and features (https://www.exchangedefender.com/docs >remember the docs).

We hope this new wizard saves you time and gives you peace of mind that your protection is configured correctly.

One of the most common complaints we get from our clients has to do with allow/whitelist policies and to make the long story short this happens because of the way your service provider configured ExchangeDefender. The long story, technical background, and best practices are outlined at https://www.exchangedefender.com/docs/whitelist. It usually sounds like this:

“I keep whitelisting this email address that sends me my OTP password / password reminder / login code / transaction confirmation / newsletter and they keep on ending up in SPAM!”

This happens for clients that configure ExchangeDefender to block email forgeries and spoofing.

You see, the email address that is showing up in ExchangeDefender and your Outlook/Gmail is not the actual email address that the message was sent from. Large volume emails (OTP, password reminders, notifications) are not sent by humans, they are computer generated and there is a random email address for every notification they sent out (so when/if it bounces they can track it).

These automated email addresses tend to have a long randomly generated identifier in them and generally look like this:

010001890676a389-ee862f60-d7ea-4ba1-a113-f16935e2afeb-000000@amazonses.com

But in your Outlook/Gmail the spoofed/faked email appears to have come from DoNotReply@someotpsite.cz which has the domain you trust and attempt to allow/whitelist. If you pull up the SMTP headers from the quarantined email you can see this email address in the envelope-from field:

Received: from inbound10.exchangedefender.com (65.99.255.114) by
 owa.exchangedefenderdemo.com (10.10.10.5) with Microsoft SMTP Server (TLS) id 14.3.498.0;
 Thu, 29 Jun 2023 05:23:03 -0400
Received-SPF: pass (inbound10.exchangedefender.com: domain of 010001890675c389-ee862f60-d7ea-4ba1-a113-f16935e2afeb-000000@amazonses.com designates 54.240.77.69 as permitted sender) receiver=inbound10.exchangedefender.com; client-ip=54.240.77.69; helo=a77-69.smtp-out.amazonses.com; envelope-from=010001890676a389-ee862f60-d7ea-4ba1-a113-f16935e2afeb-000000@amazonses.com; x-software=ExchangeDefender SPF;
Authentication-Results: inbound10.exchangedefender.com; dmarc=pass (p=quarantine dis=none) header.from=someotpsite.cz
Authentication-Results: inbound10.exchangedefender.com;
 dkim=pass (1024-bit key) header.d=someotpsite.cz header.i=@someotpsite.cz header.b=”QPv3HP79″;
 dkim=pass (1024-bit key) header.d=amazonses.com header.i=@amazonses.com header.b=”MsX8RGl7″
Received: from a77-69.smtp-out.amazonses.com (a77-69.smtp-out.amazonses.com
 [54.240.77.69]) by inbound10.exchangedefender.com (8.14.7/8.14.7) with ESMTP
 id 35T9M86a030204
<demo@exchangedefenderdemo.com>; Thu, 29 Jun 2023 05:22:09 -0400
From: <DoNotReply@someotpsite.cz>
To: <demo@exchangedefenderdemo.com>
Subject: ConnectWise Manage Security Code

Solving this issue requires your ExchangeDefender admin to decide how permissive they want to be of email forgeries and fakes. ExchangeDefender provides two ways to manage this in the ExchangeDefender Domain Admin app at https://admin.exchangedefender.com (see documentation)

Option 1: Allow email from the bulk email network

ExchangeDefender enables you to automatically pass through messages coming from specific bulk/spam mail providers. It’s located at https://admin.exchangedefender.com under Advanced Features > Bulk Mailer Policy:

In our example SMTP header the message came from AmazonSES so if you change the policy from Scan to Allow, ExchangeDefender will simply deliver these messages to your mailbox without quarantining it as a forgery/spoof (which it is).

Option 2: Choose a relaxed From: policy

This is a less secure option that will allow forgeries and effectively lowers your security level to that of M365/Office365 – and we strongly discourage you from doing that. However, if the client requires it you can get it done under Advanced Features > From: Policy:

Summary

If you’re seeing notification emails in your SPAM quarantine even though you’ve trusted the sender repeatedly, it’s doing so because the message is being spoofed and your admin has configured ExchangeDefender to block that activity. You can relax the security restrictions by choosing to either allow the bulk mail network or you can build your trust rules on the less-secure From: address.

Our team is always here to help but they aren’t allowed to guess without seeing the SMTP headers first – so if you ever run into an issue that you’d like us to take a look at grab the headers and provide them at https://support.exchangedefender.com and we’ll advise from there.

ExchangeDefender Passwordless Login is a new feature that lets users get into their ExchangeDefender account easier and faster. Instead of logging in and tracking passwords, the user just enters their email address and the OTP code we send there – and they get access to all their ExchangeDefender services.

The Passwordless Login feature will drive down the support costs because that was the major issue our clients found in supporting login and authentication problems. We even joked that you may have answered your last login problem email. We now have more data and feedback indicating that this feature is a hit:

In practical terms, wider adoption of this feature means less support work for login and authentication. The fact that it’s more popular than password reset on launch means the users have already seen this feature elsewhere and trust it as a secure way to get into their account.

We’ve also heard from our technical and compliance audience: It allowed us to finally take you up on an automated password expiration knowing that it will keep our passwords secure and users wouldn’t notice.

The value we provide to our clients is in the ability to securely email, send secure encrypted messages, and continue emailing when there are IT issues. By making it easier for our users to get to these features everyone benefits.

Thank you for your business and for trusting us to protect your email.

On Thursday, May 18th, the login experience at ExchangeDefender will change. Everything still works the same way as before and the new features will not affect user login: you’ll still go to https://admin.exchangedefender.com and type in your email & password to log in.

Below the main login block, you will see the new Advanced Login block featuring Passwordless and Administrator login features.


Passwordless Tap this if you forgot your password and don’t want to set a new one. We’ll email you a code (for account verification) and when you type it in you’re good for the next 30 days.

Administrator Tap this to log in to the management console for ExchangeDefender Domain Admin and Service Provider. It’s safer & smarter to use user->domain, and service provider escalation and this is a more convenient way for smaller organizations.

Social and app authenticator login buttons are on the bottom and we now support all the TOTP app authenticators and encourage you to lock your accounts down.

ExchangeDefender is pleased to announce the addition of passwordless logins. This convenient authentication method has become an industry standard and we’re implementing it at the request of many of our clients.

The problem: “I don’t know what it is, I don’t know what my password is!” OK. Reset password. Wait for the email. Pick a new password. A more complex password. One that you’ll forget as soon as you log in. We’ve all been there.

In our May update, you will see another login option under the default sign-in, allowing you to sign in with email. It’s as simple as it sounds, type in your email address and we’ll email you a magic link (with an OTP code) that you can use to log in to your account without your password. It’s that simple.

The session will stay logged in for a month so as long as you’re on the same computer/mobile you won’t have to worry about tracking passwords with ExchangeDefender.

PS. This means anyone with access to your mailbox will have access to ExchangeDefender as well – so for those of you that value security over convenience we’ve also added a domain-level policy that can disable this feature.


We should talk

ExchangeDefender is aggressively adding features and growing the security footprint and we understand that IT staff is already spread thin enough – so if you’re tight on time or security expertise we are able to help by reviewing, applying, and configuring your mail flow so users get fewer interruptions while getting the latest and best-tuned security service for email.

Accessing and Downloading email logs for Service Providers

ExchangeDefender is the ultimate cybersecurity wrapper for an organization and we already discussed how Users and Domain Admins can locate messages ExchangeDefender was configured to keep out of the mailbox.

ExchangeDefender users have a beautiful and powerful way to access their quarantined mail and work around email problems, domain admins have flexible settings, policies and access to the logs to keep the organization protected. So what do ExchangeDefender Service Providers have that others don’t?

ExchangeDefender Service Provider access enables you to do deep troubleshooting and emergency “incident response” activities. Service Provider login is the highest level of control in ExchangeDefender so you have access to all the data that ExchangeDefender has.

Accessing Logs

ExchangeDefender Service Provider access gives you access to the centralized log facility where you can locate any message ExchangeDefender has processed from a central pane of glass.

You can download any search results as a CSV file that can be better visualized and analyzed in a spreadsheet and reporting tool of your choice. This is particularly useful when you don’t know the sender or are searching for an automated sender with a fake tracing email address.

Our partners frequently rely on this facility to troubleshoot for missing messages.

Downloading Raw Logs

ExchangeDefender Service Providers also have access to raw SMTP Mail Logs which give our partners direct access to low level SMTP transactions and error logs. It’s located in the same location as log search.

Service Providers rely on these logs as the ultimate source of truth regarding the traffic for the ExchangeDefender protected domain. This is a fantastic tool if you’re looking for intermittent delivery errors or policy violations or just have a very specific email or server you’re looking for.

Logs will get pulled from all our services and will be available for download within 24 hours. Don’t let the boilerplate distract you, almost all of our clients will get their logs within the hour. From there you can load the logs into your favorite analytics tool and dig for the errors and problems in the mail flow.

To sum it up

ExchangeDefender can help you account for every message going in and out of your organization. While users have a powerful and beautiful way to access their quarantined mail or continue where they left off during an outage or email problem, domain admins and service providers have far more access to the logs so they can troubleshoot around different settings and policies.