A review board appointed by the Biden administration blamed Microsoft for last year’s Chinese hacking attack. The report is a scathing indictment of Microsoft’s corporate security and transparency, saying a “series of mistakes” by the tech giant allowed a state-backed Chinese cyber operator to hack into the email accounts of senior U.S. officials, including Secretary of Commerce Gina Raimondo. said.
The Cybersecurity Review Board, established by executive order in 2021, found sloppy cybersecurity practices, a lax corporate culture, and a lack of honesty about the company’s knowledge of the breaches that made it the target of a hack, the Associated Press reported. Pointed out.
Given Microsoft’s ubiquity and important role in the global technology ecosystem, the report concludes that “Microsoft’s security culture is inadequate and in need of an overhaul.” It is said that there are. Microsoft products “support critical services that support our national security, the foundation of our economy, and the foundation of our society” Public Health and Safety. ”
Report: A chain of avoidable errors led to the Chinese hack The commission said in its report that the intrusion was “preventable and should never have happened” and blamed the successful intrusion on “a cascade of avoidable errors.” The committee also said Microsoft does not yet know how the hackers got in.
In its recommendations, the committee asked Microsoft to hold off on adding features to its cloud computing environment until “security has been significantly improved.” It also provided Microsoft CEO Satya Nadella and the board with a “plan that includes a concrete timeline for fundamental security-focused changes across the company and product suite.” It called for a “rapid cultural change”, including sharing it publicly.
What Microsoft said in its report
In response to the report, Microsoft issued a statement thanking the board for its investigation and saying, “We continue to harden all of our systems against attacks, implementing even more powerful sensors and logs to detect and defeat enemy cyber forces. “I will.”
To recall, state-sponsored Chinese hackers compromised the Microsoft Exchange Online emails of 22 organizations and more than 500 individuals around the world, including the US Ambassador to China, Nicholas Burns. The 34-page report claimed that the attack affected multiple US agencies doing business with China. The hackers accessed some cloud-based email boxes for at least six weeks and are said to have downloaded more than 60,000 emails from the State Department alone. The Chinese hack was first disclosed by Microsoft in a blog post in July 2023 and was carried out by a group the company calls Storm-0558.
Microsoft said in a statement that the hackers involved were “well-resourced nation-state threat actors who continue to operate without meaningful deterrence.”
The Cybersecurity Review Board, established by executive order in 2021, found sloppy cybersecurity practices, a lax corporate culture, and a lack of honesty about the company’s knowledge of the breaches that made it the target of a hack, the Associated Press reported. Pointed out.
Given Microsoft’s ubiquity and important role in the global technology ecosystem, the report concludes that “Microsoft’s security culture is inadequate and in need of an overhaul.” It is said that there are. Microsoft products “support critical services that support our national security, the foundation of our economy, and the foundation of our society” Public Health and Safety. ”
Report: A chain of avoidable errors led to the Chinese hack The commission said in its report that the intrusion was “preventable and should never have happened” and blamed the successful intrusion on “a cascade of avoidable errors.” The committee also said Microsoft does not yet know how the hackers got in.
In its recommendations, the committee asked Microsoft to hold off on adding features to its cloud computing environment until “security has been significantly improved.” It also provided Microsoft CEO Satya Nadella and the board with a “plan that includes a concrete timeline for fundamental security-focused changes across the company and product suite.” It called for a “rapid cultural change”, including sharing it publicly.
What Microsoft said in its report
In response to the report, Microsoft issued a statement thanking the board for its investigation and saying, “We continue to harden all of our systems against attacks, implementing even more powerful sensors and logs to detect and defeat enemy cyber forces. “I will.”
To recall, state-sponsored Chinese hackers compromised the Microsoft Exchange Online emails of 22 organizations and more than 500 individuals around the world, including the US Ambassador to China, Nicholas Burns. The 34-page report claimed that the attack affected multiple US agencies doing business with China. The hackers accessed some cloud-based email boxes for at least six weeks and are said to have downloaded more than 60,000 emails from the State Department alone. The Chinese hack was first disclosed by Microsoft in a blog post in July 2023 and was carried out by a group the company calls Storm-0558.
Expanding
Microsoft said in a statement that the hackers involved were “well-resourced nation-state threat actors who continue to operate without meaningful deterrence.”