30k U.S. organizations newly hacked via holes in Microsoft Exchange Server

Re:30k U.S. organizations newly hacked via holes in Microsof... by kaliszad on Saturday March 06, 2021 @11:34AM (#26368502)

I know. It really is quite scary, if you have been in a for-real security audit actually. We wouldn't be creating admin workstations if the security story with AD would be so great, hint - it isn't. Exchange must communicate with AD with much higher permissions than most users. It really is scary how many barriers will be crossed just so anything you would expect, like contacts, works.

[ Parent | on HN ]

Re:30k U.S. organizations newly hacked via holes in Microsof... by Godel_unicode on Saturday March 13, 2021 @01:44AM (#26444564)

I've been a part of many for-real security audits. This is largely incorrect scare-mongering. Separate admin workstations are symptomatic of a bad security posture and check-box security, they are absolutely not necessitated by nebulous concerns about the directory being readable.

Of course a server process which is designed to modify (among other things) group memberships needs different permissions than a user, why would that not be the case...?

If you don't like it being highly privileged, don't grant it the permissions. Or hire someone who can.

[ Parent | on HN ]