DHS cyber review board to examine China-linked cyberattacks of Microsoft 

The Department of Homeland Security's Cyber Safety Review Board will conduct its next investigation on cloud security and examine a recent cyberattack that targeted government email accounts supplied through Microsoft software. 

The review board, composed of 15 cybersecurity leaders across the public and private sectors, will probe how threat actors target cloud computing environments for malicious purposes. 

The review will also assess how a hacking group reportedly linked to China leveraged a vulnerability in Microsoft Exchange Online to access unclassified government emails in a cyberattack described at the time by a senior Cybersecurity and Infrastructure Security Agency official as a "surgical campaign" targeting a "small number of mailboxes."

DHS Secretary Alejandro Mayorkas described cloud security as "the backbone of some of our most critical systems" in a statement announcing the new review on Friday. 

"Organizations of all kinds are increasingly reliant on cloud computing to deliver services to the American people, which makes it imperative that we understand the vulnerabilities of that technology,” Mayorkas said. 

The announcement comes after calls from Congress for federal investigations into the cyberattack, including from Sen. Ron Wyden, D-Ore., who urged CISA and the attorney general to take action against Microsoft related to allegations of negligent cybersecurity practices he asserted in a letter last month.

"Government emails were stolen because Microsoft committed another error,” Wyden wrote at the time. 

The senator released a statement on Friday praising the review. Wyden added:  "Had the board studied the 2020 SolarWinds hack, as President Biden originally directed, its findings might have been able to shore up federal cybersecurity in time to stop hackers from exploiting a similar vulnerability in the most recent incident. The government will only be able to protect federal systems against cyberattacks by getting to the bottom of what went wrong."

Wyden noted in his July letter that the Cyber Safety Review Board was established in response to the 2020 SolarWinds hack but never delivered on a probe of the breach, and Microsoft's role in it, despite the lawmaker's urging. 

"I have repeatedly pushed CISA and DHS to direct the Board to study the SolarWinds incident, but have been rebuffed. Had that review taken place, it is quite likely that Microsoft’s poor data security practices around encryption keys would have come to light, and this most recent incident might have been averted," Wyden wrote.

Lapsus$ findings

The announcement also comes a day after the review board released its report on a hacking group known as Lapsus$, which was found to have "leveraged simple techniques to evade industry-standard security tools" and avoid detection while accessing critical networks. 

According to the report, cybercriminals like Lapsus$ used techniques like phishing employees and stealing cell phone numbers to gain access to proprietary data. The review featured 10 actionable recommendations that government agencies, companies and others can employ to bolster cyber defenses against Lapsus$ and other threat actors.

Common multi-factor authentication techniques featured critical vulnerabilities that left major companies susceptible to cyber intrusions, the report said. 

"Lapsus$ and related threat actors are using basic techniques to gain an entry point into companies," Rosa Smothers, a government relations executive at the security firm KnowBe4 and former CIA cyber threat analyst, told Nextgov/FCW. "Their primary attack vectors – SIM swap attacks and phishing employees – can be easily addressed, especially for companies like Microsoft and Okta that are so well resourced."

The board recommended organizations "immediately switch to more secure, easy-to-use, password-less solutions by design" and called on the government to develop a “secure authentication roadmap” that helps accelerate the adoption of password-less authentication. 

CSRB Chair and DHS Under Secretary for Policy Robert Silvers said in a statement that the review "uncovered deficiencies in how companies ensure the security of their vendors; how cell phone carriers protect their customers from SIM swapping; and how organizations authenticate users on their systems.

"The board examined how a loosely organized group of hackers, some of them teenagers, were consistently able to break into the most well-defended companies in the world," Silvers said. 

The review board, which does not have regulatory authority, will aim to develop best practices that software providers and cloud users across both sectors can employ to bolster network security.