EU Banking Reg. Hit By MS Exchange Attack– Experts Reaction

The European Banking Authority, a key EU financial regulator, confirmed it has fallen victim to a hack of its Microsoft email system which the US company blames on a Chinese group. Microsoft said last week that a state-sponsored group operating out of China was exploiting previously unknown security flaws in its Exchange email services to steal data from business and government users, believed to number in the tens of thousands so far.  

Experts Comments

March 10, 2021
Bryson Bort
Founder & CEO
SYTHE

This is a clear example of why companies must practice both defensive and offensive security. Organizations can’t prevent zero-days which is why it’s important to embrace the “assume you’ve been breached” model, ie - assume you’ll be compromised and emphasized detection and response. No matter how an attacker gets in, they have to be visible afterward; it’s a question of whether you’ve got resources that are good enough to see it.

March 10, 2021
Saryu Nayyar
CEO
Gurucul

While many organizations have moved their business to the cloud in general, and their office productivity suite to Microsoft Office 365 in particular, there are still many organizations that have regulatory compliance issues that prevent moving to a pure cloud infrastructure. That is why the recent attacks against Microsoft Exchange Server have had such an impact on the organizations that still have on-premises installations, such as the attack against the European Banking Authority. There is

.....Read More

While many organizations have moved their business to the cloud in general, and their office productivity suite to Microsoft Office 365 in particular, there are still many organizations that have regulatory compliance issues that prevent moving to a pure cloud infrastructure. That is why the recent attacks against Microsoft Exchange Server have had such an impact on the organizations that still have on-premises installations, such as the attack against the European Banking Authority. There is always a challenge in balancing operational concerns and change management windows when planning for security patches, but as we have so often seen, the emphasis needs to be on security.  Chances are that when an organization gets the alert that they need to deploy a security patch, malicious actors are already using it in the wild.  That means they need to deploy the patches sooner rather than later and hope their existing security stack will keep them safe until the patches are in place.

  Read Less

Submit Your Expert Comments

What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Write Your Expert Comments *
Your Registered Email *
Notification Email (If different from your registered email)
* By using this form you agree with the storage and handling of your data by this web site.
SUBMIT
Share on facebook
Share on twitter
Share on linkedin

Recent Posts

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts