210319 after more than 4 years, Swedish State Authorities react in good direction

 References:

https://zenosloim.blogspot.com/2016/02/it-services-outsourcing-between-cutting.html

https://zenosloim.blogspot.com/2017/07/transportstyrelsen-skandalen.html

Background:

During past years, keyword Outsourcing was the magic key for many Swedish responsibles from both government agencies, state authorities and big private companies.

Cutting costs without long term planning and analysis, became almost a catastrophic way of thinking and a 100% sure way to IT-security incidents and disasters.

Now it seems that many rational analysers have made their point listened and the result is here:

https://sverigesradio.se/artikel/regeringen-lagger-fram-ny-sakerhetslag

"Skärpt säkerhetslag ska skydda känslig information

Publicerat idag kl 10.30

Regeringen föreslår nu ändringar i säkerhetsskyddslagen som ska granskas av lagrådet. 

    Syftet är att hindra att känslig information kommer på avvägar. Till exempel måste myndigheter eller privata företag i vissa fall samråda med Säpo om IT-system ska läggas ut på entreprenad. Det kan gälla verksamhet med kopplingar till förvaret, energiförsörjning, eller telefon- och datanätverk.

    Struntar de i samrådet kan de straffas med en avgift på upp till 50 miljoner kronor."

At last...

Sådana chefer som lägger allt inkl. känslig IT-drift på entreprenad, utan att tänka på konsekvenser, borde också lägga deras eget tjänst på entreprenad, så att någon mer kompetent ersätter dem.

210306 Microsoft Outlook.com latest massive hack

 About 2 weeks ago something strange happened.

A mail sent apparently from Microsoft Outlook servers invited me to click on a link to reconfirm my Google account designed as recovery account for my Microsoft account.

Why strange?

1. In case of account suspicious activity or hacking, there are well defined rules of alert.

2. Having more accounts on Microsoft and Google, respective suspicious email came only on certain accounts: those used for corporate purpose which were associated with interesting list of Contacts.

3. Analysis of email's header revealed only real internal ip addresses from Microsoft Outlook.

Same for the clickable link sent to click on in order to reverify your data.

4. Despite message said if you do not reverify, you can no longer use the account, checking the account from a different ip and device, all was ok, and more, the pretended email did not even existed, alike so-called flash-sms.

My Good Sense told me do ignore the email and for sure something happened inside Microsoft.

Today, the world news showed I was right.

Massive internal attack on Microsoft Outlook servers and Cloud- based email services.

I can only imagine how many US and world companies and authorities using Microsoft Outlook.com services are now in big trouble.

Such a sofisticated attack and hack could only be done by a state actor: China or Russia.

Israel is not in discussion, being an US ally.

In any case, the whole trouble was kept totally secret for at least 10 days.