Microsoft Exchange Server ProxyLogon Vulnerability: 8 Questions to Ask Vendors

Three Levels of Coverage to Stay Ahead of Third-Party Breaches

The Microsoft Exchange ProxyLogon vulnerability is an important reminder that mitigating the impact of attacks targeting your third parties requires multiple layers of detection, both proactive and reactive. Here are three levels of coverage that we consider essential:

1. Monitor for third-party breach disclosures

Establishing continuous monitoring of third-party breach disclosures, news updates, and regulatory and legal filings is an important first step, providing qualitative indicators that a compromise could occur. However, simply monitoring news sites, social media posts, or getting daily updates from an RSS feed will not enable you to quantify or analyze the impact of such announcements or act on them. That’s why it’s important to seek qualitative insights from a centralized service that includes hundreds of thousands of public and private sources and enables you to tie the data together in a unified risk register.

2. Monitor for other indicators of cyber compromises

Scanning for vulnerabilities on public-facing vendor web properties will only reveal a small measure of the risks they (and therefore you) are exposed to. Go deeper by monitoring criminal forums, onion pages, the deep dark web’s special access forums, threat feeds, paste sites for leaked credentials, as well as security communities, code repositories, and finally vulnerability databases. As above, though, it’s too complex and time-consuming to monitor this activity on your own, even when limited to your high-tier suppliers. Instead, centralize this activity in a single service that monitors for cybersecurity intelligence and can automatically trigger remediation actions based on findings.

3. Augment point-in-time assessments with rapid response

SolarWinds, Accellion, and now Microsoft Exchange. High-profile security incidents and damaging breaches impacting third parties has been on the rise. Yet, many organizations struggle to get timely notifications of impact from their supplier bases. This can delay risk identification and mitigation and ultimately lead to unwanted exposure. Why? Existing approaches to vendor event notification are highly manual, don’t offer third parties the opportunity to quantify their risk or provide meaningful context to the incident, and lack prescriptive remediation guidance to jump start the risk mitigation process.

How can your organization help your vendors accelerate the event notification process? Assess your vendors against a customizable event questionnaire that is automatically triggered by events, enables them to proactively submit assessments, and offers prescriptive remediation guidance to quickly identify and mitigate the impact of a security incident.

None of that is possible by watching news feeds or exchanging spreadsheets over email. Centralized assessment platforms automate the critical tasks required to quickly discover, quantify and remediate risks from vendor vulnerabilities -- without overwhelming your team.

Next Steps

Be sure to download the PDF of the Third-Party Microsoft Exchange Server ProxyLogon Vulnerability Assessment. We hope the questionnaire will provide some assurance that your vendors and suppliers have implemented the controls necessary to address this critical vulnerability.

Because cyberattacks targeting this vulnerability have evolved to include ransomware, be sure to also download Prevalent’s free ransomware assessment to identify immediate gaps that could impact the readiness of your organization to react to similar ransomware threats.

Once the dust settles, keep in mind that Prevalent offers a third-party risk management platform that includes more than 60 questionnaire templates meant to help you automate the tedious tasks of assessing vendors, and augments the findings with continuous cyber and breach monitoring. Contact us today to schedule a strategy session.