The European Banking Authority, a key EU financial regulator, confirmed it has fallen victim to a hack of its Microsoft email system which the US company blames on a Chinese group. Microsoft said last week that a state-sponsored group operating out of China was exploiting previously unknown security flaws in its Exchange email services to steal data from business and government users, believed to number in the tens of thousands so far.
<p>While many organizations have moved their business to the cloud in general, and their office productivity suite to Microsoft Office 365 in particular, there are still many organizations that have regulatory compliance issues that prevent moving to a pure cloud infrastructure. That is why the recent attacks against Microsoft Exchange Server have had such an impact on the organizations that still have on-premises installations, such as the attack against the European Banking Authority. There is always a challenge in balancing operational concerns and change management windows when planning for security patches, but as we have so often seen, the emphasis needs to be on security. Chances are that when an organization gets the alert that they need to deploy a security patch, malicious actors are already using it in the wild. That means they need to deploy the patches sooner rather than later and hope their existing security stack will keep them safe until the patches are in place.</p>
<p>This is a clear example of why companies must practice both defensive and offensive security. Organizations can’t prevent zero-days which is why it’s important to embrace the “assume you’ve been breached” model, ie – assume you’ll be compromised and emphasized detection and response. No matter how an attacker gets in, they have to be visible afterward; it’s a question of whether you’ve got resources that are good enough to see it.</p>