Microsoft Cybersecurity Breach: Cyber Safety Review Board Unveils Damning Report

Photo of author
Written By Vikas Jangid

Lorem ipsum dolor sit amet consectetur pulvinar ligula augue . 

Microsoft Cybersecurity Breach Failures

A recent investigation by the US Cyber Safety Review Board uncovered severe security lapses within Microsoft, which enabled Chinese state-sponsored hackers to infiltrate US government email systems using Microsoft Exchange Online software last year. This breach impacted over 500 individuals across 22 organizations, including employees involved in national security matters.

The US Department of Homeland Security issued a damning report, placing blame on Microsoft's corporate culture that deprioritized enterprise security investments and rigorous risk management. The report concluded that the cyberattack could have been prevented if different decisions were made within Microsoft.

The hackers utilized a Microsoft account (MSA) consumer key to gain unauthorized access to Outlook on the web (OWA) and While Microsoft remains uncertain about the exact method through which the key was obtained, it's suggested that it may have been acquired from a crash dump.

Source: Twitter/CISAgov

Microsoft’s Admission and Corrections

In November, Microsoft admitted inaccuracies in its September blog post regarding the breach. However, corrections were made only in March following persistent questioning by the Cyber Safety Review Board. Despite Microsoft's cooperation, the consensus is that the company's security culture requires significant improvement.

Cyber Safety Review Board's Findings:
The Cyber Safety Review Board asserts that the breach was entirely preventable, emphasizing the need for a complete overhaul of Microsoft's security culture, given its critical role in safeguarding customer data and operations.

Microsoft's Response: Secure Future Initiative:
In response to the breach and cybersecurity failures, Microsoft has launched the Secure Future Initiative (SFI). This initiative aims to revamp the company's software security measures by redesigning, building, testing, and operating its software and services.

Copilot for Security: Microsoft’s AI Solution

Coinciding with these efforts, Microsoft introduced Copilot for Security, an AI-driven chatbot tailored for cybersecurity professionals. Priced at $4 per hour of usage, this service comes at a time when the company faces ongoing attacks from Russian state-sponsored hackers.

Persistent Threat from Nobelium

The same group responsible for the SolarWinds attack, Nobelium, has been monitoring Microsoft executive email accounts for months. This intrusion resulted in the theft of Microsoft's source code and access to its source code repositories and internal systems.

Conclusion: Microsoft’s Commitment to Enhanced Security

Microsoft is committed to enhancing its software security measures in response to recent breaches and cybersecurity incidents. The Secure Future Initiative represents a significant shift in the company's security approach, aiming to prevent future breaches and safeguard customer data and operations.

Read more such on techinsighttoday
Thank you so much for reading.

Leave a Comment