Businesses should prepare for the possibility of another major disruption like the Microsoft outage that affected services worldwide in recent days, cybersecurity specialist Dinos Pastos told CNA, urging organisations to strengthen business continuity planning and maintain backup systems.
According to Pastos, Microsoft attributed the incident to a technical error, with one of its configurations failing and triggering a cascading disruption across several services, including email, chat and artificial intelligence applications.
He stressed that the outage was not the result of a cyberattack.
"From the first day it was clear that it was an issue within Microsoft's infrastructure," he said.
Asked whether human error was involved, Pastos replied in the affirmative, adding that Microsoft had acknowledged that efforts to correct the problem created additional service-load issues, preventing a rapid resolution.
The disruption affected millions of users, first those relying directly on Microsoft's platforms and subsequently their own customers.
"For example, if a business could not operate properly, it could not serve its customers either," he said.
Pastos said one of the most troubling aspects of the incident was that it took three days to resolve. In previous cases involving centralised service failures or errors causing limited outages, restoration typically took only a few hours or, at most, a day, he noted.
He said the incident had raised concerns among governments and organisations because it highlighted the risks of concentrating vital functions within a single private provider.
Businesses rely on external providers to maintain, upgrade and secure their systems, which are among the main reasons for using cloud services. However, this also creates the risk that large numbers of users can be affected simultaneously if a problem occurs.
Limited alternatives
Asked whether there was a realistic alternative for users, Pastos said that "there is no realistically easy solution".
Migrating services, particularly email and cloud-synchronised files, is not straightforward, he said. Nevertheless, businesses could maintain local copies of files or backup internal communication systems, even though most users depend on a single external provider.
"What is realistic, so that companies can be ready, is for them to assume that this will happen again, that it is not an isolated incident. There is no reason why it could not happen again tomorrow and on an even worse scale," he said.
He advised companies to ensure that their security and business continuity policies include contingency plans for situations in which a central provider is unable to support specific functions.
Those functions, he said, should be capable of being replaced to a large extent by alternative or backup services within the organisation, which may not be connected to the internet or the cloud.
Pastos said the overall financial impact of the outage would be difficult to quantify because of its global reach. He added that the consequences appeared to involve communication disruptions more than direct losses linked to sales and revenue, and that no reliable estimate of the damage had yet emerged.
Internet-connected devices vulnerable
Commenting on recent cyberattacks targeting supermarket refrigerators and a blood bank in several European countries, Pastos said internet-connected devices controlled remotely should be incorporated into organisations' security and maintenance policies.
Their upkeep should be monitored in the same way as computers and servers, he said.
He warned that such incidents should not be ignored and could serve as a wake-up call for businesses when assessing risk.
"We will certainly see similar incidents involving other connected devices and services," he said.
Some devices may have been forgotten and are no longer maintained, while others may have been configured incorrectly during installation, creating opportunities for malicious actors, he added.
Asked about the motives behind such attacks, Pastos said they are often carried out as pranks, for showmanship or intimidation, but can also form part of cyberwarfare activities.
He urged households and businesses to review which connected devices they have installed, who configured them and whether there is a maintenance, upgrade and replacement plan in place.
"Anything we buy that is connected must be maintained accordingly," he said, noting that even a security camera can be used as a point of entry to compromise security.
Source: CNA
