The US Cyber Safety Review Board faults Microsoft for a “cascade of avoidable errors” that led to the 2023 Chinese hack of top US government officials' emails
The independent Cyber Safety Review Board's forthcoming report knocks the tech giant for shoddy cybersecurity practices …
Washington Post
Context & Ripple Effects
The email compromise was disclosed after Microsoft said Chinese hackers had accessed government accounts for at least a month before detection. Subsequent coverage questioned whether the company’s disclosures adequately addressed Microsoft’s own role in the breach.
The review follows the board’s stated plan to examine cloud-computing risks, including this government email incident, putting the breach at the center of its cloud-security agenda. Its findings matter because the affected accounts belonged to senior U.S. officials, making Microsoft’s operational controls a public-policy concern as well as a customer-security issue.
First-order effects
Microsoft faces a formal public rebuke from the U.S. Cyber Safety Review Board over the security practices tied to the 2023 government-email compromise.
Government customers using Microsoft’s cloud and email services gain an official account of the failures behind an intrusion that affected senior officials, sharpening scrutiny of Microsoft’s remediation.
Second-order effects
The report increases pressure on Microsoft to demonstrate stronger security engineering and incident-response practices to public-sector customers; rival cloud providers can use that scrutiny to compete for sensitive workloads.
The board’s focus reinforces its planned examination of cloud-computing risk, pushing agencies and suppliers to treat provider-side controls—not only attacker activity—as central to breach assessment.
Third-order effects
If such reviews repeatedly identify preventable provider failures, government cloud procurement is likely to place more weight on independently scrutinized security operations and transparent incident reporting.
The case points toward ecosystem cyber defense in which cloud platforms, government buyers, and oversight bodies share accountability for resilience, though the report alone does not establish what procurement or regulatory changes will follow.
The trend: Cloud-security incidents are shifting accountability from individual intrusions toward the operational practices of the platforms that host critical government communications.
This section right here is vindication for every cybersecurity reporter who has ever interacted with Microsoft's PR. — That PR department lies through its teeth — [image]
CSRB report is out, and TAG has linked Storm-0558, the group which breached Microsoft last year, to the bigger group who hacked Google and RSA in the cyber stone age (pre-WannaCry) — https://www.cisa.gov/... [image]
Very proud of the work of the Cyber Safety Review Board (CSRB) on this important review of the 2023 Microsoft Exchange Online intrusion that affected a number of national security officials And the threat actor responsible is the same one that did Operation Aurora in 2009!
Thanks to the CSRB for its work on this important issue. @CISAgov plans to convene major CSPs to develop cloud security practices aligned with the CSRB recommendations and a process for CSPs to regularly attest to & demonstrate alignment. https://go.dhs.gov/JRT
Today, DHS released the Cyber Safety Review Board's (CSRB) report summarizing the findings of its review into attacks associated with the 2023 Microsoft Exchange Online intrusion. Learn more here⬇️ https://www.cisa.gov/...
“Perhaps most concerning, the board report makes clear, Microsoft still does not know how the Chinese carried out the attack.” @washingtonpost https://www.washingtonpost.com/ ...
The Cyber Safety Review Board's report on the Microsoft Exchange Server hacking campaign — in which China compromised tens of thousands of email servers — sounds pretty unsparing in its criticism of the company's security practices and public messaging. https://www.washingtonpost…
Worth a read! While there do appear to be a few factual errors, I strongly agree with the CSRB's conclusion. Until we have the right incentives to optimize for the outcomes we care about, i.e., customer security, we'll keep seeing the same problems we promised to fix last time.
Today the Cyber Safety Review Board released its independent review of the Summer 2023 Microsoft Exchange Online intrusion laying out what led to the intrusion & what industry & gov't can do to ensure an intrusion at this magnitude does not happen again. https://go.dhs.gov/JRT [i…
New: Cyber Safety Review Board releases its report on the Chinese hack of Microsoft cloud-hosted email accounts: https://www.cisa.gov/... “This intrusion was preventable and should never have occurred. ... Microsoft's security culture was inadequate and requires an overhaul.” [im…