Submit your essay to the AI-Cybersecurity Essay Prize Competition by January 2, 2025.
The AI-Cybersecurity Essay Prize Competition

Microsoft’s recent cloud security breach draws attention to new national security risks

The recent Cyber Safety Review Board report on Microsoft’s 2023 cloud security intrusion underscores broader security failures within CSPs
Main Top Image
Image created with the assistance of Midjourney

As modern society becomes increasingly dependent on Cloud Service Providers (CSPs), the robustness of their security is no longer just an IT concern—it is a cornerstone of national security, economic stability, and public health. Over the past decade, CSPs like Amazon, Microsoft, and Google have cornered much of the marketplace. At least 90% of US enterprises use cloud deployment, and three major companies make up 67% of the market: Amazon, Google, and Microsoft. 

CSPs are ubiquitous, and the marketplace is highly concentrated. This makes the cloud a valuable target for a variety of cybercriminals and nation-state threat actors. A 2023 intrusion into Microsoft’s cloud services sparked an important debate about the current security responsibility model for CSPs. Ultimately, the incident demonstrates that to mitigate these major security risks, Microsoft and other players need to change the way they think about security.

Uncovering cloud compromise

Microsoft’s cloud infrastructure was the target of Storm-0558 in a massive, preventable incident. Storm-0558 is a known threat actor attributed by Microsoft to be sponsored by the People’s Republic of China. They were associated with the 2009 Operation Aurora, which targeted the source code repositories of several tech and defence companies, significantly influencing the information security landscape. More recently, they have been known to target US government agencies and European diplomatic missions.      

The 2023 attacks were discovered by the US Department of Homeland Security (DHS), which has developed an internal detection methodology nicknamed “Big Yellow Taxi”. This methodology can detect anomalies in the MailItemsAccessed log, which displays actions taken by a user on mail items in Exchange Online mailboxes. MailItemsAccessed is a part of the Unified Access Log in Microsoft 365—a log only available to users that have the most extensive and expensive Microsoft 365 licence, called E5. DHS uses a G5 licence, which is an E5 licence with added compliance frameworks specifically provided for government use. Yet despite the added price and promised protection, neither the E5 nor the G5 licence ultimately included the detection capability needed to identify the attack. Instead, the attack was discovered after Big Yellow Taxi generated an alert about a large volume of mail items being accessed. 

An intensive investigation revealed that Microsoft had failed to detect compromised cryptographic material. As of today, no organisation, including Microsoft, has publicly confirmed the root cause of the compromise. The most prominent theory remains that the threat actor was able to leak the cryptographic material through crash information after compromising an engineering account.   

The leaked cryptographic material was a Microsoft Service Account (MSA) consumer key, which are crucial for validating and authorising access to various Microsoft services, including email accounts, because they generate authentication tokens. Valid authentication tokens provide access to a user account without needing the user’s password. With the leaked key, a malicious actor could generate tokens for any Outlook or Exchange Online account. 

Yet the security issues ran even deeper: the leaked key was a consumer key, which should never have been able to generate authentication tokens for enterprise email in the first place. Engineers incorrectly assumed that the underlying code would automatically validate such keys’ use and context.     

In the end, the attackers managed to exfiltrate information from approximately 25 organisations, including 60 thousand emails from US State Department accounts. Big Yellow Taxi—not Microsoft’s own E5 and G5 products—was likely the only reason the compromise was not much greater. 

Even so, the intrusion affected US diplomats in the Pacific region, Europe, and East Asia. The profiles of the targeted government officials suggest that the leaked data included sensitive information. Storm-0558 could have gained access to information about the increased US military support for Taiwan around the cross-strait between the island and China, the US Indo-Pacific strategy to counter Chinese influence in the region, and other delicate political matters. 

Failing security culture

Shortly after the intrusion was discovered, DHS announced that the independent Cyber Safety Review Board (CSRB) would assess the intrusion. The findings were published in March 2024 in an extensive report that concluded “the intrusion was preventable and should never have occurred”. The attackers exploited avoidable errors on Microsoft’s side. Moreover, Microsoft lacked standard security practices implemented by other major CSPs and failed to correct inaccurate public statements promptly. 

The CSRB report emphasises that CSPs have become high-value targets for a broad range of adversaries. After all, compromising a single CSP can have immense repercussions, creating access points for a wide variety of their customers, which has happened before. The threat only grows as governments continue to adopt CSPs. 

 In a response to the report, Microsoft CEO Satya Nadella released a memo stating, “If you’re faced with the trade-off between security and something else, your answer is clear: do security”. This is an acknowledgement of one of the most important findings of the report: Microsoft’s security culture needs a complete overhaul.     

Despite Nadella’s declaration, Microsoft soon began deploying the “Recall” feature, allowing users to search AI-processed screenshots taken every five seconds by the operating system. This attracted criticism from security researchers for its many security flaws such as showing private encryption keys as plaintext data in the captures, all accessible without administrative privileges. Only after public backlash did Microsoft implement necessary security features. 

Clearly, this suggests that a security-first policy has not yet become standard practice at the company. 

Dual-faceted security responsibilities

According to the Cloud Shared Responsibility Model (CSRM), CSPs are responsible for the security of the cloud infrastructure, while customers are responsible for securing the data and configurations they deploy in the cloud. This division, however, relies on customers fully trusting the CSP to fulfil their scope of obligations. In the context of the Storm-0558 attack, the threat actor gained access through failed security mechanisms that fall under the responsibility of the CSP in any interpretation of the CSRM. 

As a result, customers could do little to prevent an intrusion, and could only detect the activity after the initial compromise. Through restrictive and expensive licensing practices, CSPs price out many customers from accessing the security controls under their responsibility. The E5 and G5 licences discussed above are clear examples of this problem. These licences provide major security improvements that ended up being crucial to detecting the Storm-0558 attack. CSP’s repeated failures to maintain responsibilities related to the CSRM puts customers at a severe disadvantage. Market concentration only makes this problem worse. 

Google took this situation as an opportunity to publicly lash out against a key competitor, explaining the need to break up monoculture to address Microsoft’s failings. As the article notes, monoculture creates the risk of a single breach undermining an entire ecosystem. While this is undeniably true, diversification is not a practical solution for security. Many organisations simply do not have the financial and organisational resources required to manage multiple providers. Google does not address the core failings of CSPs to provide the security dictated by the CSRM. Instead, Google demonstrates an attitude Microsoft has long adopted: for a company to prevent becoming a victim of vendor mistakes, it must increase its own security spending. 

Responsible security levels

Ultimately, CSPs can’t have it both ways: by reaping the benefits of providing services to thousands of customers across various industries, including critical infrastructure, they must face being  high-profile targets of both cybercrime and state sponsored adversaries. Therefore, their security posture must be impeccable. 

The Storm-0558 attack exemplifies this. Microsoft’s position as a major market player in this space comes with global responsibility. The company needs to sufficiently prepare for state-backed actors to launch attacks and have safeguards in place in case of intrusions.

As adoption of cloud services will likely only increase, public disclosure and analysis of these incidents is a welcome step in the right direction. We cannot control the pace of threat actors’ operations, but we can ensure that CSPs make security their top priority.

Terms and Conditions for the AI-Cybersecurity Essay Prize Competition

Introduction

The AI-Cybersecurity Essay Prize Competition (the “Competition”) is organized by Virtual Routes (“Virtual Routes”) in partnership with the Munich Security Conference (“MSC”). It is sponsored by Google (the “Sponsor”). By entering the Competition, participants agree to these Terms and Conditions (T&Cs).

Eligibility

The Competition is open to individuals worldwide who are experts in the fields of cybersecurity and artificial intelligence (“AI”). Participants must ensure that their participation complies with local laws and regulations.

Submission Guidelines

Essays must address the question: “How will Artificial Intelligence change cybersecurity, and what are the implications for Europe? Discuss potential strategies that policymakers can adopt to navigate these changes.”

Submissions must be original, unpublished works between 800-1200 words, excluding footnotes but including hyperlinks for references.

Essays must be submitted by 2 January 2025, 00:00 am CET., through the official submission portal provided by Virtual Routes.

Only single-authored essays are accepted. Co-authored submissions will not be considered.

Participants are responsible for ensuring their submissions do not infringe upon the intellectual property rights of third parties.

Judging and Awards

Essays will be judged based on insightfulness, relevance, originality, clarity, and evidence by a review board comprising distinguished figures from academia, industry, and government.

The decision of the review board is final and binding in all matters related to the Competition.

Prizes are as follows: 1st Place: €10,000; Runner-Up: €5,000; 3rd Place: €2,500; 4th-5th Places: €1,000 each. The winner will also be invited to attend The Munich Security Conference

Intellectual Property Rights

The author retains ownership of the submitted essay.

By submitting the essay, the author grants Virtual Routes exclusive, royalty-free rights to use, reproduce, publish, distribute, and display the essay for purposes related to the Competition, including but not limited to educational, promotional, and research-related activities.

The author represents, warrants, and agrees that no essay submitted as part of the essay prize competition violates or infringes upon the rights of any third party, including copyright, trademark, privacy, publicity, or other personal or proprietary rights, breaches, or conflicts with any obligation, such as a confidentiality obligation, or contains libellous, defamatory, or otherwise unlawful material.

The author agrees that the organizers can use your name (or your pseudonym) and an image of you in association with your essay for purposes of publicity, promotion and any other activity related to the exercise of its rights under these Terms.

The organizers may remove any essay-related content from its platforms at any time and without explanation.

The organizers may block contributions from particular email or IP addresses without notice or explanation.

The organizers may enable advertising on its platforms and associated social media accounts, including in connection with the display of your essay. The organizers may also use your Material to promote its products and services.

The organizers may, at its sole discretion, categorise Material, whether by means of ranking according to popularity or by any other criteria.

Data Protection

Personal information collected in connection with the Competition will be processed in accordance with Virtual Routes’ Privacy Policy. Participants agree to the collection, processing, and storage of their personal data for the purposes of the Competition.

Liability and Indemnity

Virtual Routes, MSC, and the Sponsor will not be liable for any damages arising from participation in the Competition, except where prohibited by law.

Participants agree to indemnify Virtual Routes, MSC, and the Sponsor against any claims, damages, or losses resulting from a breach of these T&Cs.

General Conditions

Virtual Routes reserves the right to cancel, suspend, or modify the Competition or these T&Cs if fraud, technical failures, or any other factor beyond Virtual Routes’ reasonable control impairs the integrity or proper functioning of the Competition, as determined by Virtual Routes in its sole discretion.

Any attempt by any person to deliberately undermine the legitimate operation of the Competition may be a violation of criminal and civil law, and, should such an attempt be made, Virtual Routes reserves the right to seek damages from any such person to the fullest extent permitted by law.

Governing Law

These Terms and Conditions are governed by the laws of the United Kingdom, without regard to its conflict of law principles. Any dispute arising out of or in connection with these Terms and Conditions, including any question regarding its existence, validity, or termination, shall be referred to and finally resolved by the courts of the United Kingdom. The participants agree to submit to the exclusive jurisdiction of the courts located in the United Kingdom for the resolution of all disputes arising from or related to these Terms and Conditions or the Competition.