\n<\/p>\n
A new report from the US Cyber Safety Review Board has found that Microsoft could have prevented<\/a> Chinese hackers from breaching US government emails through its Microsoft Exchange Online software last year. The incident<\/a>, described as a \u201ccascade of security failures\u201d at Microsoft, allowed Chinese state-sponsored hackers to access online email inboxes of 22 organizations, affecting more than 500 people including US government employees working on national security.<\/p>\n<\/div>\n The US Department of Homeland Security (DHS) has released a scathing report<\/a> that found that the hack was \u201cpreventable\u201d and that a number of decisions inside Microsoft contributed to \u201ca corporate culture that deprioritized enterprise security investments and rigorous risk management.\u201d<\/p>\n<\/div>\n The hackers used an acquired Microsoft account (MSA) consumer key to forge tokens to access Outlook on the web (OWA) and Outlook.com. The report makes it clear that Microsoft still isn\u2019t sure exactly <\/em>how the key was stolen, but the leading theory is that the key was part of a crash dump. Microsoft published that theory in September, and recently updated its blog post<\/a> to admit \u201cwe have not found a crash dump containing the impacted key material.\u201d<\/p>\n<\/div>\n Without access to that crash dump, Microsoft can\u2019t be sure exactly how the key was stolen. \u201cOur leading hypothesis remains that operational errors resulted in key material leaving the secure token signing environment that was subsequently accessed in a debugging environment via a compromised engineering account,\u201d says Microsoft in its updated blog post.<\/p>\n<\/div>\n Microsoft acknowledged to the Cyber Safety Review Board in November that its September blog post was inaccurate, but it was only corrected months later on March 12th \u201cafter the Board\u2019s repeated questioning about Microsoft\u2019s plans to issue a correction.\u201d While Microsoft fully cooperated with the board\u2019s investigation, the conclusion is that Microsoft\u2019s security culture needs an overhaul.<\/p>\n<\/div>\n \u201cThe Board finds that this intrusion was preventable and should never have occurred,\u201d says the Cyber Safety Review Board. \u201cThe Board also concludes that Microsoft\u2019s security culture was inadequate and requires an overhaul, particularly in light of the company\u2019s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations.\u201d<\/p>\n<\/div>\n The findings from the board come in the same week that Microsoft has launched its Copilot for Security<\/a>, an AI-powered chatbot designed for cybersecurity professionals. Microsoft is charging businesses $4 per hour of usage as part of a consumption model to access this latest AI tool, just as the company struggles with an ongoing attack from Russian state-sponsored hackers. <\/p>\n<\/div>\n Nobelium, the same group behind the\u00a0SolarWinds attack<\/a>, managed to spy on some<\/a> Microsoft executive email inboxes for months. That initial intrusion also led to some of Microsoft\u2019s source code being stolen, with Microsoft admitting recently that the group accessed the company\u2019s source code<\/a> repositories and internal systems.<\/p>\n<\/div>\n Microsoft is now attempting to overhaul its software security<\/a>\u00a0following the breach of US government emails last year and similar cybersecurity attacks<\/a> in recent years. Microsoft\u2019s new Secure Future Initiative (SFI) is designed to overhaul how it designs, builds, tests, and operates its software and services. It\u2019s the biggest change to Microsoft\u2019s security efforts since the company introduced its Security Development Lifecycle (SDL) in 2004 after the devastating Blaster worm that hit Windows XP machines offline in 2003.<\/p>\n<\/div>\n