having every western company use the garbage that are Microsoft's hosted products (notably Teams and Outlook) is a national security issue that's a massive disaster that's just waiting to happen
I agree around teams and outlook, but what is the alternative? Google? AWS? Self host? Honest question, because the way enterprise tends to work, they want to offload the responsibility to a third party so When information does leak or get hacked, they can blame someone else.
With self-hosting you get to use thing now considered legacy (e.g., IMAP servers), but I definitely have seen them working for organisations with thousands of employees. You’ll need staff to support it, too, but at some scale it will none be more expensive than cloud services. Yet, you’ll have more control over it.
OTOH, some things will definitely be less feature-rich, for example, on-prem Sharepoint (not that I recommend using it) may not live up to the expectations of users familiar with the online version.
> but what is the alternative? Google? AWS? Self host?
I mean, given this was possible:
> used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts
pretty much anything is going to be better than letting Microsoft host your email/corporate data
To be clear: I've never heard of any such thing. I happen to work for Google, but I'm open the possibility that this happened and I didn't hear about it.
The denominator is "Microsoft corporate email accounts." I interpret that as email accounts of the Microsoft organization (management, employees, and so on), but not customers.
It's pretty embarrassing and not very reassuring that they themselves got owned, but they wanted to tell their customers that they didn't.
This kind of attack can happen on any tech stack where bad passwords have ever been allowed. The dunking is obviously fun, but the fact that the underlying technology happened to be Microsoft’s is largely irrelevant.
Yeah, it’s just that less legacy conpanies have less chance of having a system that can be compromised in this way. Conversely, Microsoft is almost guaranteed to have it.
