238 lines
10 KiB
Plaintext
238 lines
10 KiB
Plaintext
EMAIL INFRASTRUCTURE ASSESSMENT & MIGRATION RECOMMENDATION
|
|
Arizona Computer Guru LLC
|
|
Prepared for: John Velez & Sheila Peress, Quantum WMS
|
|
Date: May 26, 2026
|
|
Prepared by: Mike Swanson
|
|
|
|
================================================================================
|
|
EXECUTIVE SUMMARY
|
|
================================================================================
|
|
|
|
Following our review of Quantum WMS's current email infrastructure, we have
|
|
identified significant security deficiencies in the current Intermedia hosted
|
|
Exchange setup and have confirmed that a migration to Microsoft 365 Business
|
|
Premium is technically superior, more cost-effective, and fully satisfies your
|
|
regulatory compliance requirements under FINRA Rule 4511 and SEC Rule 17a-4.
|
|
|
|
We are recommending: Microsoft 365 Business Premium (exchange and full Office
|
|
suite) with Mailprotector as a managed email security frontend.
|
|
|
|
Before we proceed, we need one item from Sheila: the written policy from your
|
|
Broker/Dealer specifying email and security compliance requirements. Details
|
|
at the end of this document.
|
|
|
|
================================================================================
|
|
CURRENT STATE: INTERMEDIA HOSTED EXCHANGE
|
|
================================================================================
|
|
|
|
Your current email is hosted by Intermedia on their "exch090" Exchange Server
|
|
cluster. This is important to understand: Intermedia is not running Microsoft's
|
|
cloud. They are running Exchange Server software in their own data center —
|
|
the same software that runs on an on-premises server. This distinction has
|
|
major security implications.
|
|
|
|
CRITICAL: YOUR DOMAIN HAS NO EMAIL SECURITY RECORDS
|
|
----------------------------------------------------
|
|
|
|
During our assessment we found the following DNS configuration issues that
|
|
represent active security risks today:
|
|
|
|
DMARC Record: MISSING
|
|
-----------------------------------------------------------------------
|
|
DMARC is what tells the internet what to do with email that claims to
|
|
be from @quantumwms.com but wasn't sent by your mail server. Without
|
|
it, anyone in the world can send email that appears to come from your
|
|
domain with no enforcement. This is the primary mechanism used in
|
|
CEO fraud and vendor impersonation attacks.
|
|
|
|
SPF Records: TWO RECORDS (misconfiguration)
|
|
-----------------------------------------------------------------------
|
|
Your domain has two conflicting SPF records:
|
|
|
|
Record 1: v=spf1 include:spf.intermedia.net -all
|
|
Record 2: v=spf1 include:_spf-usg1.ppe-hosted.com
|
|
include:secureserver.net ~all
|
|
|
|
Internet standards (RFC 7208) permit only ONE SPF record per domain.
|
|
Having two causes receiving mail servers to evaluate them unpredictably,
|
|
which can result in your legitimate email being marked as spam or
|
|
rejected outright.
|
|
|
|
DKIM: NOT CONFIGURED
|
|
-----------------------------------------------------------------------
|
|
DKIM cryptographically signs outbound email, proving it originated
|
|
from your mail server and has not been tampered with in transit.
|
|
Without it, your email cannot be fully authenticated by recipients.
|
|
|
|
These three issues exist independently of which email platform you use and
|
|
need to be corrected as part of any migration.
|
|
|
|
SECURITY RISKS: EXCHANGE SERVER CVE EXPOSURE
|
|
--------------------------------------------
|
|
|
|
Because Intermedia runs Exchange Server (not Exchange Online), your email
|
|
infrastructure is subject to the same vulnerabilities that have affected
|
|
on-premises Exchange servers worldwide over the past several years:
|
|
|
|
- ProxyLogon (CVE-2021-26855) — mass-exploited March 2021
|
|
- ProxyShell (CVE-2021-34473) — mass-exploited August 2021
|
|
- ProxyNotShell (CVE-2022-41040) — actively exploited October 2022
|
|
- OWASSRF (CVE-2022-41080) — Rackspace breach, December 2022
|
|
|
|
Microsoft patches Exchange Online the same day vulnerabilities are
|
|
disclosed. Intermedia patches their hosted Exchange clusters on their
|
|
own schedule. The gap between disclosure and patch deployment is when
|
|
attacks occur.
|
|
|
|
WHAT INTERMEDIA DOES NOT PROVIDE
|
|
---------------------------------
|
|
|
|
- Advanced threat protection (no Safe Links, Safe Attachments)
|
|
- Conditional Access / MFA enforcement policies
|
|
- Modern email archiving with FINRA compliance certification
|
|
- Desktop Office applications (Word, Excel, Outlook, etc.)
|
|
- Mobile device management
|
|
- Identity protection or sign-in risk detection
|
|
|
|
================================================================================
|
|
RECOMMENDED SOLUTION: M365 BUSINESS PREMIUM + MAILPROTECTOR
|
|
================================================================================
|
|
|
|
MICROSOFT 365 BUSINESS PREMIUM
|
|
-------------------------------
|
|
|
|
$22/user/month (direct) — includes:
|
|
|
|
Exchange Online Full cloud email, Microsoft-managed, same-day patching
|
|
Desktop Office Apps Word, Excel, Outlook, PowerPoint, OneNote (5 devices)
|
|
Microsoft Teams Chat, video, file collaboration
|
|
SharePoint / OneDrive 1 TB cloud file storage per user
|
|
Microsoft Purview FINRA/SEC 17a-4 compliant email archiving (WORM)
|
|
Defender for Office 365 Safe Links, Safe Attachments, anti-phishing (Plan 1)
|
|
Microsoft Entra ID P1 Conditional Access, MFA enforcement, sign-in risk
|
|
Microsoft Intune Mobile device and PC management
|
|
|
|
MAILPROTECTOR (ACG-MANAGED FRONTEND)
|
|
-------------------------------------
|
|
|
|
Mailprotector sits in front of Exchange Online as an additional email
|
|
security layer, providing:
|
|
|
|
- Inbound spam and malware filtering before mail reaches Exchange
|
|
- Outbound filtering and DLP
|
|
- Quarantine management
|
|
- ACG-managed — we handle configuration, updates, and tuning
|
|
|
|
WHAT THIS LOOKS LIKE DAY-TO-DAY
|
|
--------------------------------
|
|
|
|
Inbound mail path:
|
|
Sender -> Mailprotector (spam/malware filter) -> Exchange Online -> Outlook
|
|
|
|
Outbound mail path:
|
|
Outlook -> Exchange Online -> Internet (DKIM-signed, SPF-aligned, DMARC-enforced)
|
|
|
|
Result: your outbound email is cryptographically authenticated, and your
|
|
inbound email is filtered twice before reaching your inbox.
|
|
|
|
SECURITY POSTURE COMPARISON
|
|
----------------------------
|
|
|
|
Intermedia M365 Business Premium
|
|
+ Mailprotector
|
|
-----------------------------------------------------------------------
|
|
Exchange CVE exposure Yes (Exchange Server) No (Exchange Online)
|
|
Same-day security patching No (Intermedia pace) Yes (Microsoft)
|
|
Inbound threat filtering Basic Mailprotector + Defender
|
|
Safe Links (URL scanning) No Yes
|
|
Safe Attachments No Yes
|
|
MFA enforcement policy Manual, per-user Conditional Access (P1)
|
|
DMARC/DKIM/SPF Not managed ACG-configured
|
|
Email archiving (FINRA) Extra cost add-on Included (Purview)
|
|
Desktop Office apps No Yes
|
|
Mobile device management No Yes (Intune)
|
|
Sign-in risk detection No Yes (Entra P1)
|
|
-----------------------------------------------------------------------
|
|
|
|
================================================================================
|
|
REGARDING YOUR BROKER/DEALER COMPLIANCE REQUIREMENT
|
|
================================================================================
|
|
|
|
You have indicated that your Broker/Dealer may require Intermedia for
|
|
compliance purposes. We want to address this directly.
|
|
|
|
WHAT FINRA RULE 4511 AND SEC RULE 17a-4 ACTUALLY REQUIRE:
|
|
|
|
The regulations require that broker/dealers retain electronic
|
|
communications (including email) in a format that is:
|
|
|
|
1. Non-rewritable and non-erasable (WORM storage)
|
|
2. Retained for a minimum period (3 years accessible, 6 total)
|
|
3. Indexed and available for regulatory inspection on demand
|
|
4. Subject to supervisory review
|
|
|
|
The regulations do NOT name any specific vendor or platform.
|
|
They specify outcomes, not products.
|
|
|
|
MICROSOFT 365 IS FINRA/SEC 17a-4 COMPLIANT:
|
|
|
|
Microsoft Purview Compliance (included in Business Premium) has received
|
|
a formal compliance assessment from Cohasset Associates confirming that
|
|
Exchange Online and SharePoint Online meet the requirements of SEC Rule
|
|
17a-4(f) and CFTC Rule 1.31. This assessment is publicly available.
|
|
|
|
The majority of FINRA-registered broker/dealers — including large
|
|
institutions — run on Exchange Online today. FINRA has published
|
|
guidance explicitly endorsing cloud-based recordkeeping solutions.
|
|
|
|
OUR EXPECTATION:
|
|
|
|
If your Broker/Dealer has a written policy specifying Intermedia by
|
|
name as the required platform, we would consider that extraordinary and
|
|
would want to review it alongside your compliance attorney. In our
|
|
experience, B/D policies specify archiving standards, not vendors.
|
|
|
|
================================================================================
|
|
ACTION REQUIRED FROM SHEILA — BEFORE OUR MEETING TOMORROW AT 2 PM
|
|
================================================================================
|
|
|
|
Please locate and provide the written policy from your Broker/Dealer that
|
|
specifies your email and security compliance requirements.
|
|
|
|
Specifically, we are looking for any document that:
|
|
|
|
- Defines which email platforms are approved or required
|
|
- Specifies archiving or retention requirements for electronic communications
|
|
- Names Intermedia (or any vendor) as a required provider
|
|
|
|
If no such document exists, or if the policy specifies standards rather
|
|
than a named vendor, we can proceed with the Microsoft 365 migration on
|
|
the timeline we discussed.
|
|
|
|
Please have this document (or confirmation that it does not exist) ready
|
|
for our meeting on Tuesday, May 27 at 2:00 PM.
|
|
|
|
If you have questions before then, call or text Mike at Arizona Computer
|
|
Guru.
|
|
|
|
================================================================================
|
|
PROPOSED TIMELINE
|
|
================================================================================
|
|
|
|
Now through May 27: Sheila obtains B/D compliance policy
|
|
May 27 (2 PM): Review policy; confirm migration go/no-go
|
|
May 28-29: Purchase licenses; configure tenant
|
|
May 30-31: Stand up mailboxes; configure Mailprotector
|
|
June 1-2: Mail migration from Intermedia; DNS cutover
|
|
June 3: Current GoDaddy O365 Essentials lapses — new
|
|
Business Premium is live before this date
|
|
|
|
================================================================================
|
|
|
|
Arizona Computer Guru LLC
|
|
Mike Swanson
|
|
mike@azcomputerguru.com
|
|
(520) 226-3987
|
|
|
|
================================================================================
|