Gerade vom Kollegen rausgefischt

@LinksfraktionHH Datenschutz, digitale Souveränität und Kostenfragen beim Einsatz von Microsoft 365 in der Hamburger Verwaltung - 23/2931 Große Anfrage vom 29.01.2026: https://www.buergerschaft-hh.de/parldok/dokument/102664/23_02931_datenschutz_digitale_souveraenitaet_und_kostenfragen_beim_einsatz_von_microsoft_365_in_der_hamburger_verwaltung

(Parlamentsdatenbank: https://www.buergerschaft-hh.de/parldok/suche/10_1_23___23.%20Wahlperiode%20(ab%2026.03.2025)/7_1_1___Drucksache/9_1_29.01.2026_datefrom__Von%3A%2029.01.2026/8_1_2___Dokumenttyp%3A%20Gro%C3%9Fe%20Anfrage)

#hhbue #LinksfraktionHamburg #DieLinkeHamburg #Hamburg #DigitaleSouveränität #microsoft #Microsoft365 #ms365 #Storm0558 #FISA

🚨 Microsoft just moved MSA token signing to Azure Confidential VMs, a major step forward in securing its identity infrastructure after the high-profile Storm-0558 breach.

This move, along with the ongoing migration of Entra ID signing services, is part of Microsoft’s broader Secure Future Initiative (SFI) — described as the largest cybersecurity engineering project in its history.

Here’s what’s changing:
- MSA signing keys now protected inside Azure Confidential VMs
- Entra ID token signing is also being migrated to confidential infrastructure
- Access tokens are generated, stored, and auto-rotated via Azure-managed HSM
- 90% of identity tokens for Microsoft apps now validated via hardened SDKs
- 92% of Microsoft productivity accounts use phishing-resistant MFA
- 81% of production code branches are protected with proof-of-presence MFA
- Security logs have a mandatory 2-year retention period
- A new tenant provisioning system auto-registers tenants into the emergency response process

Microsoft is also piloting isolated customer support environments to reduce lateral movement, a direct response to risks exposed in the 2023 Storm-0558 breach, which involved forged Entra ID tokens using a compromised MSA key.

The attack, attributed to a China-linked threat group, led to unauthorized email access across U.S. and European entities.

This update builds on the lessons from the U.S. Cyber Safety Review Board (CSRB) report and pushes forward a model where signing keys, support processes, and token validation are more tightly controlled than ever before.

At @Efani, we support these kinds of structural shifts — because real security isn’t just about patching flaws after the fact, it’s about re-engineering trust from the foundation up.

#CyberSecurity #Microsoft #EntraID #CloudSecurity #SecureFutureInitiative #Storm0558 #IdentitySecurity #EfaniSecure

Dass #Microsoft intransparent auftritt, nur strategisch Einblicke in seine #Cloud gibt und bei #Datenschutz und #Informationssicherheit viel schön redet, weil er #ToBigToFail sei, ist wohlbekannt.

Nun geht aber endlich auch mal das @bsi als Behörde im Auftrag der Bevölkerung gegen solche Praktiken vor und fordert Auskünfte ein, die bei einem #Hack wie dem von #Storm0558 im Sommer 2023 unaufgefordert und freiwillig erfolgen sollten.
https://www.heise.de/news/BSI-verklagt-Microsoft-auf-Herausgabe-von-Informationen-zu-Security-Desaster-9721245.html

Ich bin gespannt wie es weiter geht und stehe hinter der #Klage. Egal wie diese verläuft, die symbolische Bedeutung ist bereits ein Erfolg. Wer jetzt noch immer glaubt, dass er mit #Azure, #M365 und Co. gut aufgehoben ist, dem kann man mit Argumenten nicht erreichen. 🤯

The #CSRB report on the #Microsoft #Azure #Storm0558 security incident says that Cloud Service Providers (#CSP) should adopt a minimum standard for default audit logging.

A wonder which standard exist there? Any pointers welcome.
The report later mentions the #FedRAMP AU-2 "standard". But I couldn't find it 😠

#CyberSecurity

Last year’s Chinese hack of federal agencies’ email is still a mystery, and “should never have occurred,” says #CISA.

CISA’s Cyber Safety Review Board thinks #Microsoft’s #cybersecurity is rotten. The company needs cultural reform and needs to stop releasing new features until it fixes the problem, the board says.

Microsoft’s cloud email system was hacked by #Storm0558 in 2023. But Redmond still doesn’t know how. In #SBBlogwatch, we aggregate fruity reactions. At @TechstrongGroup’s @SecurityBlvd: https://securityboulevard.com/2024/04/csrb-microsoft-review-richixbw/?utm_source=richisoc&utm_medium=social&utm_content=richisoc&utm_campaign=richisoc

Microsoft Security Response Center (MSRC) quietly updated their 06 September 2023 blog post about the Storm-0558 technical investigation on 12 March 2024 (6 months later) due to DHS Cyber Safety Review Board (CSRB) repeatedly asking them when they were going to update the inaccurate information. 🔗 https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/

First, what hasn’t changed:

Here are the key items which we are updating based on what we have learned since September 6, 2023:

#Microsoft #China #cyberespionage #Storm0558