The Australian Information Security Association (AISA) is warning that the global Microsoft outage may have created a new wave of cyber security risks, as organisations scrambled to keep working using personal email accounts, USB drives and alternative platforms.
The Association says the widespread disruption to Microsoft 365 services, including Outlook, Teams and SharePoint, has exposed the risks of relying heavily on a single technology provider and raised serious questions about where sensitive business information may have ended up.
AISA Board Director, Rajiv Shah said the immediate disruption was only part of the problem.
“When people can’t access the systems they rely on, they find ways to keep working. If organisations don’t have contingency plans in place, people will make their own. They send documents to personal Gmail accounts, copy files onto USB drives, use messaging apps or move information onto platforms their organisations haven’t approved,” said Dr Shah.
“Those decisions are understandable, but they can leave sensitive information outside an organisation’s security controls. Once services are restored, who knows where all that data has gone, who can access it, or whether it has been properly secured?
“Given the massive number of organisations affected around the world, we could be looking at an enormous amount of information that has moved outside normal security arrangements in a single day. We need to understand how much additional cyber risk has been created.”
Dr Shah said organisations should make reviewing the workarounds used during the outage a priority as systems return to normal.
“Getting email and Teams working again doesn’t mean the job is finished. Businesses need to find out what information was moved, where it was stored and whether any copies remain in personal accounts, on portable devices or in other services,” he said.
“Staff should be encouraged to report the workarounds they used without fear of blame. Organisations need that information to identify potential exposures and bring their data back under appropriate controls.”
AISA said the outage also highlighted the need for businesses and governments to build greater redundancy into their critical systems and business continuity arrangements.
“Many organisations have invested heavily in cloud technology, but they still need to consider what happens when a major provider becomes unavailable,” Dr Shah said.
“Redundancy means having practical, secure alternatives that allow essential work to continue. That might include independent communication channels, offline access to critical information, tested backups and alternative ways to authenticate users.
“These arrangements need to be planned and tested before an outage, so employees aren’t left making up their own solutions under pressure”
Dr Shah said the outage should prompt organisations to reconsider how they maintain operations during major technology failures.
“Businesses need to be able to keep operating when technology fails, without losing control of their information in the process.
“The lesson from this outage is to plan for disruption, establish secure alternatives and make sure there is a clear process to bring everything back under control afterwards.
“Make sure employees know which backup communications, file-sharing and operational procedures are approved during an outage, and test that these arrangements work.”
