CSRB Report on Microsoft Exchange Online Intrusion at US govt depts last year

Report link: [https://www.cisa.gov/sites/default/files/2024-04/CSRB\_Review\_of\_the\_Summer\_2023\_MEO\_Intrusion\_Final\_508c.pdf](https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf)

Whats your take on the review? I personally was quite shocked that Microsoft made amateurish mistakes that I would expect in smaller less security aware companies.

Perhaps this was a driver for giving one of their SVPs charge of Security: [https://www.linkedin.com/in/charlie--bell/](https://www.linkedin.com/in/charlie--bell/)

They also launched something called the Secure Future Initiative

[https://blogs.microsoft.com/on-the-issues/2023/11/02/secure-future-initiative-sfi-cybersecurity-cyberattacks/](https://blogs.microsoft.com/on-the-issues/2023/11/02/secure-future-initiative-sfi-cybersecurity-cyberattacks/)

​

​

aware called companies cybersecurity expect future initiative microsoft mistakes review security